Manage Grok Bot team rules with the Admin API

Team Rules are short, always-on instructions applied to every member’s Bots. They live on the Grok Bot dashboard page for Teams and Enterprise. This guide covers the Admin API CRUD routes. Official references: Admin API → Grok Bot team rules; Grok Bot for teams and enterprises → Team Rules; Grok Bot security.

Team Rules are separate from Auto Review allow/block instructions (those sit under Team Settings → Security and Automation; see Configure Auto Review team instructions and the Admin API /grok-bot/auto-review routes). Keep rules short and few — for hard enforcement of never-acceptable actions, prefer Auto Review block instructions.

Authenticate with a team Admin API key (Basic auth, key as username, empty password). Reads need read:* or admin:*; writes need admin:*. Rate limit: 20 requests per minute per team per endpoint. A team can store up to 50 Grok Bot rules.

List rules

curl -X GET "https://api.cursor.com/grok-bot/team-rules?limit=50" \
  -u YOUR_API_KEY:

Param	Purpose
limit	Results per page (default 50, max 100)
cursor	Opaque cursor from the previous nextCursor

Rules return newest first:

{
  "teamRules": [
    {
      "id": "rule_PDSPmvukpYgZEDXsoNirw3CFhy",
      "name": "Ask before publishing",
      "content": "Never publish a release without an explicit go from the requester.",
      "enabled": true,
      "scope": "grokBot",
      "createdAt": "2024-01-15T10:30:00.000Z",
      "updatedAt": "2024-01-15T10:30:00.000Z"
    }
  ],
  "nextCursor": null
}

Create a rule

curl -X POST https://api.cursor.com/grok-bot/team-rules \
  -u YOUR_API_KEY: \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Ask before publishing",
    "content": "Never publish a release without an explicit go from the requester.",
    "enabled": true
  }'

Field	Rules
name	Required, 1–255 characters
content	Required, 1–30,000 characters
enabled	Required boolean

Success returns 201 with the created teamRule (including encoded id).

Update a rule

Send at least one field:

curl -X PATCH https://api.cursor.com/grok-bot/team-rules/rule_PDSPmvukpYgZEDXsoNirw3CFhy \
  -u YOUR_API_KEY: \
  -H "Content-Type: application/json" \
  -d '{ "enabled": false }'

You can also PATCH name and/or content. A well-formed id that does not exist returns 404. Empty PATCH bodies return 400.

Delete a rule

curl -X DELETE https://api.cursor.com/grok-bot/team-rules/rule_PDSPmvukpYgZEDXsoNirw3CFhy \
  -u YOUR_API_KEY:

Success returns 204 No Content.

Pitfalls

• Treating Team Rules as a hard deny gate — Auto Review instructions are the enforcement layer for never-acceptable actions.
• Hitting the 50-rule ceiling with long, overlapping rules instead of a short required set.
• Using a read:* key for POST/PATCH/DELETE — writes require admin:*.
• Confusing /grok-bot/team-rules with /grok-bot/auto-review (Enforce Auto-Review + allow/block lists).