Enable or disable a model access provider with the Admin API

Toggle a catalog provider on or off for the team with PUT https://api.cursor.com/teams/model-access/providers/:provider. Official reference: Admin API → Model access. These routes are in preview and may change before general availability.

Authenticate with a team Admin API key (Basic auth, key as username, empty password). Writes require models:* or admin:*. Generic read:* keys cannot call these routes. Rate limit: 20 requests per minute. Writes appear in team audit logs as team_settings events.

Returns 409 when the team is still unrestricted or legacy. Create a custom policy first: Set model access configuration with the Admin API. Discover catalog provider ids with List model access providers.

Path segments are catalog ids such as openai or anthropic. GET responses include display names; put the catalog id in the URL.

Enable or disable a provider

curl -X PUT https://api.cursor.com/teams/model-access/providers/openai \
  -u YOUR_API_KEY: \
  -H "Content-Type: application/json" \
  -d '{"enabled": false}'

Path / body	Rules
provider	Required catalog provider id (for example openai or anthropic)
enabled	Required boolean

Disabling a provider blocks its models for the team baseline. Organization Groups can still widen access for some members; group allowlists are outside this API.

Confirm with a list GET

After the PUT, re-read providers to confirm the flag:

curl -X GET https://api.cursor.com/teams/model-access/providers \
  -u YOUR_API_KEY:

Look for the matching providers[].id and its enabled value. Per-model toggles and parameter maps use a separate route: Set model access and parameters with the Admin API.

Pitfalls

• Calling while state is unrestricted or legacy — expect 409 until configuration seeds a custom policy.
• Using a display name in the path (OpenAI instead of openai) — the path needs the catalog id.
• Expecting a provider PUT to rewrite per-model parameter restrictions — this route only sets enabled on the provider.
• Automating against preview paths without checking docs — request shape and errors can change before GA.