Get and update Grok Bot capabilities with the Admin API

Read the team's Grok Bot capability flags with GET https://api.cursor.com/grok-bot/capabilities, then change them with PATCH on the same path. Official reference: Admin API → Get / Update Grok Bot Capabilities.

Authenticate with a team Admin API key (Basic auth, key as username, empty password). Reads need read:* or admin:*. Writes need admin:*. Rate limit: 20 requests per minute per team per endpoint.

Read capabilities

curl -X GET https://api.cursor.com/grok-bot/capabilities \
  -u YOUR_API_KEY:

{
  "enabled": true,
  "cloudAgents": true,
  "templateSharing": "team_only",
  "actionRecording": false,
  "localExecution": "ask",
  "localEgressAllowed": true
}

Field	Meaning
enabled	Whether Grok Bot is on. Read-only here — use Enable / Disable routes
cloudAgents	Whether members can delegate work to Cloud Agents
templateSharing	all, team_only, none, or null for the team default
actionRecording	Whether Action Recording is on
localExecution	Team ceiling for Bots on a member's machine: never, ask, always, or null for no ceiling
localEgressAllowed	Whether members can route Bot web traffic through their own computer (Allow Local Egress Routing; Enterprise only)

Update capabilities

Omitted fields stay unchanged. Send at least one writable field. Returns 403 when a field is not available to the team.

curl -X PATCH https://api.cursor.com/grok-bot/capabilities \
  -u YOUR_API_KEY: \
  -H "Content-Type: application/json" \
  -d '{
    "cloudAgents": false,
    "localExecution": "never",
    "localEgressAllowed": false
  }'

Response echoes the full capability object after the patch.

Writable field	Values
cloudAgents	boolean
templateSharing	all, team_only, none, or null to restore the team default
actionRecording	boolean
localExecution	never, ask, always, or null to clear the ceiling
localEgressAllowed	boolean (403 when local egress routing controls are not enabled for the team)

Related routes

• Flip enabled with Enable Grok Bot with the Admin API or Disable Grok Bot with the Admin API
• Dashboard twins for Cloud Agents, template sharing, Action Recording, and related controls live on the Grok Bot admin page

Pitfalls

• PATCH with only enabled — the API rejects it; enable/disable are separate POSTs
• Empty PATCH body — send at least one writable field
• Treating a 403 on localEgressAllowed as a bad API key — that field is Enterprise-gated when the control is off for the team