# For administrators Switch MCP and the REST API on or off for your organisation, and decide who may create API tokens and connect apps. This page is for whoever manages your plnnrly organisation. Someone who only wants to connect an AI assistant or call the API may need you to switch it on first. ## The MCP & API page The switches live under **Settings › Administration › MCP & API** in plnnrly. Two permissions decide who can use the page: - **View MCP & API** lets someone open the page and see which switches are on. - **Manage MCP & API** lets them change the switches. While your organisation is suspended, nothing on the page can be changed. ## The three switches | Switch | Default | What it does | | ----------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Enable REST API** | On | Lets people call the REST API with their own API tokens, and lets apps sign them in with OAuth. | | **Enable MCP** | Off in a new organisation | Lets people connect an AI assistant, such as Claude or ChatGPT, by signing in. The assistant works through the REST API, as the person who connected it. | | **Allow destructive actions** | Off | Lets a connected AI assistant delete anything the REST API can delete, within the person's own permissions and only after they confirm. While it is off, an assistant can read, create and update, but not delete. | How the switches depend on each other: - **Enable MCP** can only be switched on while **Enable REST API** is on, because AI assistants work through the REST API. - Switching MCP off also switches **Allow destructive actions** off. Switching MCP back on later does not bring it back. - **Allow destructive actions** only applies to AI assistants. A personal API token with the **Delete** scope can delete whatever its owner may delete, whatever this switch says. Apps that call the REST API with an OAuth sign-in can never delete through it. Connecting an AI assistant needs no extra permission. While MCP is on, everyone in the organisation sees the **AI** panel (the sparkles icon in the top bar) and can connect one. The assistant can only do what that person's account can. ## What happens when a switch is off ### REST API off - Every request to `/api/v2` answers `404` [endpoint-not-found](https://developers.plnnrly.com/en/docs/api/v2/guides/errors/#endpoint-not-found) with the detail "The REST API is not enabled for this organisation.", including requests with a token that already exists. - Apps can no longer sign people in with OAuth. - **API access** disappears from the user menu, so nobody can create, roll or revoke tokens. - MCP is switched off as well. Switching the REST API back on does not switch MCP back on. - Existing tokens are kept. They work again once the REST API is back on, unless they expired in the meantime. ### MCP off - Connected AI assistants get `404` with the message "The MCP server is not enabled for this organisation." - No AI assistant can sign in to connect. - The **AI** panel disappears from the top bar. ## Who may create tokens and connect apps The permission is **Manage API tokens**. Someone who holds it can: - open **API access** in the user menu, and create, roll and revoke their own API tokens - connect an app to the REST API by signing in with OAuth In a new organisation the **Admin** role has it from the start. To give it to another role, open the role under **HRM › User Management › Roles**, go to the **Settings** tab and select **Manage API tokens** in the **API tokens** group. When you take the permission away: - Apps that the person connected to the REST API with OAuth are refused at once, with `403` [insufficient-permission](https://developers.plnnrly.com/en/docs/api/v2/guides/errors/#insufficient-permission). - Their personal API tokens keep working until they expire. The person can no longer open **API access**, so they can no longer see, roll or revoke those tokens. ## Areas your organisation does not use Billing and sprints are optional parts of plnnrly. Without billing, every billing operation answers `404` [endpoint-not-found](https://developers.plnnrly.com/en/docs/api/v2/guides/errors/#endpoint-not-found). Without sprints, the operations for workflows, workflow statuses, workflow transitions, work types and labels answer `404` too. Sprints and work items themselves are always available. [Discovery](https://developers.plnnrly.com/en/docs/api/v2/discovery/) leaves out what your organisation does not have. [How the data fits together](https://developers.plnnrly.com/en/docs/api/v2/guides/data-model/#optional-areas) lists the resources of each area. ## Your own domain If your organisation uses its own domain, use that exact domain for the REST API and for MCP. The REST API answers `404` on any other address. Inside plnnrly, the **AI** panel shows the MCP server URL on your domain, and **API access** in the user menu shows the REST API's base URL. ## When plnnrly is unavailable While an organisation is being set up, is suspended or is archived, the REST API answers `503` [tenant-unavailable](https://developers.plnnrly.com/en/docs/api/v2/guides/errors/#tenant-unavailable), and the MCP server answers `503` too. Both work again once the organisation is active. If it lasts, contact [plnnrly support](https://www.plnnrly.com/en/support). ## Related - [MCP overview](https://developers.plnnrly.com/en/docs/mcp/) - [Permissions and safety](https://developers.plnnrly.com/en/docs/mcp/permissions-and-safety/) - [API tokens](https://developers.plnnrly.com/en/docs/api/v2/guides/tokens/) - [Authentication](https://developers.plnnrly.com/en/docs/api/v2/guides/authentication/)