Set Enforce Auto-Review with the Admin API

Enterprise teams can lock Enforce Auto-Review for every member and ship team allow/block instruction lists over GET / PUT https://api.cursor.com/grok-bot/auto-review. Official references: Admin API → Enforce Auto-Review; Grok Bot security. Writes return 403 when Enforce Auto-Review is not available to the team.

Authenticate with a team Admin API key (Basic auth, key as username, empty password). Reads need read:* or admin:*; writes need admin:*. Rate limit: 20 requests per minute per team per endpoint. Reads of the effective policy work on every plan.

Read the current policy

curl -X GET https://api.cursor.com/grok-bot/auto-review \
  -u YOUR_API_KEY:

Example response:

{
  "enforced": true,
  "rules": {
    "allow": ["Read-only git commands"],
    "block": ["Publishing releases"]
  }
}

Field	Meaning
enforced	When true, every member must keep Enforce Auto-Review on
rules.allow	Team allow instructions that feed Auto Review
rules.block	Team block instructions that feed Auto Review

Replace the policy

PUT replaces the whole policy. Both enforced and rules are required.

curl -X PUT https://api.cursor.com/grok-bot/auto-review \
  -u YOUR_API_KEY: \
  -H "Content-Type: application/json" \
  -d '{
    "enforced": true,
    "rules": {
      "allow": ["Read-only git commands"],
      "block": ["Publishing releases"]
    }
  }'

Field	Rules
enforced	Required boolean
rules.allow / rules.block	Up to 20 instructions each, 1,000 characters each; trimmed and deduped

Lock Enforce without changing instructions

Empty allow/block lists keep stored instructions when your team cannot set Auto-Review rules. Non-empty lists return 403 in that case.

curl -X PUT https://api.cursor.com/grok-bot/auto-review \
  -u YOUR_API_KEY: \
  -H "Content-Type: application/json" \
  -d '{
    "enforced": true,
    "rules": { "allow": [], "block": [] }
  }'

Dashboard twin: Configure Auto-Review team instructions for the UI path.

Pitfalls

• Using a read:* key for PUT — writes require admin:*.
• Sending more than 20 instructions or instructions longer than 1,000 characters.
• Expecting empty lists to clear rules on every plan — empty lists preserve stored instructions when the team cannot edit Auto-Review rules; non-empty lists 403 in that case.
• Confusing Enforce Auto-Review with team rules (/grok-bot/team-rules) — different endpoints, different controls.