Update an org security profile

Update an organization-owned security profile. Omitted fields are left unchanged; explicit null clears net_policy / mcp_config.

PATCH /v3beta1/organizations/{org_id}/security-profiles/{profile_id}

Update an org security profile

cURL

curl --request PATCH \
  --url https://api.devin.ai/v3beta1/organizations/{org_id}/security-profiles/{profile_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "devin_mcp_read_only": true,
  "mcp_config": {
    "servers": [
      "<string>"
    ]
  },
  "name": "<string>",
  "net_policy": {
    "allow": [
      {
        "hostname": "<string>"
      }
    ]
  },
  "remove_github_cli_token": true,
  "slack_channel_access": {
    "channels": [
      {
        "channel_id": "<string>",
        "team_id": "<string>"
      }
    ]
  },
  "teams_channel_access": {
    "channels": [
      {
        "channel_id": "<string>",
        "team_id": "<string>"
      }
    ]
  }
}
'

200

{
  "created_at": 123,
  "devin_mcp_read_only": true,
  "enforcement_level": "recommended",
  "git_access_level": "read_only",
  "name": "<string>",
  "org_id": "<string>",
  "profile_id": "<string>",
  "remove_github_cli_token": true,
  "updated_at": 123,
  "mcp_config": {
    "servers": [
      "<string>"
    ]
  },
  "net_policy": {
    "allow": [
      {
        "hostname": "<string>"
      }
    ]
  },
  "slack_channel_access": {
    "mode": "none",
    "channels": [
      {
        "channel_id": "<string>",
        "team_id": "<string>"
      }
    ]
  },
  "slack_dm_scope": "disabled",
  "teams_channel_access": {
    "mode": "none",
    "channels": [
      {
        "channel_id": "<string>",
        "team_id": "<string>"
      }
    ]
  },
  "teams_dm_scope": "disabled",
  "teams_group_chat_scope": "disabled"
}

Updates an organization-owned security profile. Running sessions keep the restrictions they resolved at their last boot or wake; changes apply to new sessions immediately and to existing sessions when they next resume.

Permissions

Requires a service user or personal access token with the ManageSecureModeProfiles permission at the organization level. Tokens used by a running Devin session are rejected, so a session cannot change the profiles that govern it.

Behavior

• Omitted fields are left unchanged.
• An explicit null clears the profile’s opinion for net_policy, mcp_config, slack_channel_access, slack_dm_scope, teams_channel_access, teams_dm_scope, and teams_group_chat_scope. null is rejected for the other fields.
• net_policy: null means the profile has no network opinion, not deny-all. Use {"allow": []} for deny-all.
• mcp_config.servers lists MCP servers by slug (a marketplace slug such as github, or an installation’s slug).

Authorizations

Authorization · string · header · required

Service User credential (prefix: cog_)

Path Parameters

profile_id · string · required

org_id · string · required

Organization ID (prefix: org-)

Example:

"org-abc123def456"

Body

application/json

PATCH semantics: omitted fields are left unchanged; explicit null clears the nullable fields (net_policy, mcp_config, slack_channel_access, slack_dm_scope, teams_channel_access, teams_dm_scope, teams_group_chat_scope) and is rejected for the others.

devin_mcp_read_only · boolean | null

enforcement_level · enum<string> | null

Available options: recommended, mandatory

git_access_level · enum<string> | null

Available options: read_only, read_write

mcp_config · SecurityProfileMcpConfig · object | null

Show child attributes

name · string | null

Required string length: 1 - 128

net_policy · SecurityProfileNetPolicy · object | null

Show child attributes

remove_github_cli_token · boolean | null

slack_channel_access · SecurityProfileSlackChannelAccess · object | null

Show child attributes

slack_dm_scope · enum<string> | null

Available options: disabled, org_members, workspace

teams_channel_access · SecurityProfileTeamsChannelAccess · object | null

Show child attributes

teams_dm_scope · enum<string> | null

Available options: disabled, installed_users

teams_group_chat_scope · enum<string> | null

Available options: disabled, origin_chat

Response

200

application/json

Successful Response

An organization-owned security profile.

created_at · integer · required

devin_mcp_read_only · boolean · required

When true, sessions may only call read-only Devin MCP tools (no session creation, automation management, or other write operations).

enforcement_level · enum<string> · required

recommended profiles can be overridden by descendant bindings; mandatory profiles are a floor that descendant policies only narrow.

Available options: recommended, mandatory

git_access_level · enum<string> · required

Available options: read_only, read_write

name · string · required

org_id · string · required

profile_id · string · required

The security profile's ID.

remove_github_cli_token · boolean · required

When true, the GitHub CLI token is removed from the session's machine, preventing direct GitHub API access.

updated_at · integer · required

mcp_config · SecurityProfileMcpConfig · object | null

null = this profile has no MCP opinion.

Show child attributes

net_policy · SecurityProfileNetPolicy · object | null

null = this profile has no network opinion (it does NOT mean deny-all).

Show child attributes

slack_channel_access · SecurityProfileSlackChannelAccess · object | null

Ceiling on the Slack channels sessions governed by this profile may read and post in. null = this profile has no opinion and the organization's Slack setting applies.

Show child attributes

slack_dm_scope · enum<string> | null

Ceiling on who may DM Devin in Slack under this profile. null = this profile has no opinion and the organization's Slack setting applies. 'workspace' is narrowed to 'org_members' for enterprise accounts.

Available options: disabled, org_members, workspace

teams_channel_access · SecurityProfileTeamsChannelAccess · object | null

Ceiling on the Microsoft Teams channels sessions governed by this profile may read and post in. null = this profile has no opinion and the organization's Teams Default Access applies.

Show child attributes

teams_dm_scope · enum<string> | null

Ceiling on who Devin may DM in Microsoft Teams under this profile. null = this profile has no opinion and the organization's Teams Default Access applies.

Available options: disabled, installed_users

teams_group_chat_scope · enum<string> | null

Ceiling on which Teams group chats Devin may read under this profile; origin_chat = only the group chat the session was started from; null = no opinion, derived from the org's Teams Default Access like DMs.

Available options: disabled, origin_chat