This page is for whoever manages your plnnrly organisation. Someone who only wants to connect an AI assistant or call the API may need you to switch it on first.
The MCP & API page
The switches live under Settings › Administration › MCP & API in plnnrly. Two permissions decide who can use the page:
- View MCP & API lets someone open the page and see which switches are on.
- Manage MCP & API lets them change the switches.
While your organisation is suspended, nothing on the page can be changed.
The three switches
| Switch | Default | What it does |
|---|---|---|
| Enable REST API | On | Lets people call the REST API with their own API tokens, and lets apps sign them in with OAuth. |
| Enable MCP | Off in a new organisation | Lets people connect an AI assistant, such as Claude or ChatGPT, by signing in. The assistant works through the REST API, as the person who connected it. |
| Allow destructive actions | Off | Lets a connected AI assistant delete anything the REST API can delete, within the person's own permissions and only after they confirm. While it is off, an assistant can read, create and update, but not delete. |
How the switches depend on each other:
- Enable MCP can only be switched on while Enable REST API is on, because AI assistants work through the REST API.
- Switching MCP off also switches Allow destructive actions off. Switching MCP back on later does not bring it back.
- Allow destructive actions only applies to AI assistants. A personal API token with the Delete scope can delete whatever its owner may delete, whatever this switch says. Apps that call the REST API with an OAuth sign-in can never delete through it.
Connecting an AI assistant needs no extra permission. While MCP is on, everyone in the organisation sees the AI panel (the sparkles icon in the top bar) and can connect one. The assistant can only do what that person's account can.
What happens when a switch is off
REST API off
- Every request to
/api/v2answers404endpoint-not-found with the detail "The REST API is not enabled for this organisation.", including requests with a token that already exists. - Apps can no longer sign people in with OAuth.
- API access disappears from the user menu, so nobody can create, roll or revoke tokens.
- MCP is switched off as well. Switching the REST API back on does not switch MCP back on.
- Existing tokens are kept. They work again once the REST API is back on, unless they expired in the meantime.
MCP off
- Connected AI assistants get
404with the message "The MCP server is not enabled for this organisation." - No AI assistant can sign in to connect.
- The AI panel disappears from the top bar.
Who may create tokens and connect apps
The permission is Manage API tokens. Someone who holds it can:
- open API access in the user menu, and create, roll and revoke their own API tokens
- connect an app to the REST API by signing in with OAuth
In a new organisation the Admin role has it from the start. To give it to another role, open the role under HRM › User Management › Roles, go to the Settings tab and select Manage API tokens in the API tokens group.
When you take the permission away:
- Apps that the person connected to the REST API with OAuth are refused at once, with
403insufficient-permission. - Their personal API tokens keep working until they expire. The person can no longer open API access, so they can no longer see, roll or revoke those tokens.
Areas your organisation does not use
Billing and sprints are optional parts of plnnrly. Without billing, every billing operation answers 404 endpoint-not-found. Without sprints, the operations for workflows, workflow statuses, workflow transitions, work types and labels answer 404 too. Sprints and work items themselves are always available.
Discovery leaves out what your organisation does not have. How the data fits together lists the resources of each area.
Your own domain
If your organisation uses its own domain, use that exact domain for the REST API and for MCP. The REST API answers 404 on any other address. Inside plnnrly, the AI panel shows the MCP server URL on your domain, and API access in the user menu shows the REST API's base URL.
When plnnrly is unavailable
While an organisation is being set up, is suspended or is archived, the REST API answers 503 tenant-unavailable, and the MCP server answers 503 too. Both work again once the organisation is active. If it lasts, contact plnnrly support.