MCP tools: remote-user-token-session-actions

All tool groups

remote-user-token-session-actions

Registered when: A human-issued user token with an explicit session ability, platform userTokens.sessionActions ON (default OFF), and an org owner opt-in inside its allow-list. REST rechecks grants, expiry, roles and approval on every call. With this flag on user_tokens_create is absent; tokens can never mint tokens..

user_token_session_action

Perform an explicitly human-granted session action: persona POST/PATCH, Zoho authorize or sealed app-password PUT, CRM timeline GET/POST, contact timeline GET, or API key create/edit/extend. Both userTokens.sessionActions and the org owner opt-in must be on. all alone is insufficient. Identity and credential actions always need approval unless this token has a live human pre-approval (at most seven days). Never reveal or echo a password. Tokens cannot mint/widen user tokens or decide approvals.

Parameter	Type	Required	Description
action	"POST /v1/orgs/:orgId/api-keys/:keyId/persona" \	"PATCH /v1/orgs/:orgId/api-keys/:keyId/persona" \	"POST /v1/orgs/:orgId/outreach/zoho/authorize" \
orgId	string	yes
keyId	string	no
contactId	string	no
body	object	no	The existing route body, unchanged on an approved retry. Credential values only from the authorised sealed form.
query	object	no	Existing route filters and pagination; unchanged on an approved retry.
approvalId	string	no	The approved request id from human_approval_required, spent once.

Example call:

{"name":"user_token_session_action","arguments":{"action":"POST /v1/orgs/:orgId/api-keys/:keyId/persona","orgId":"<orgId>"}}