Set who can use Grok Bot with the Admin API

Enterprise teams can limit Grok Bot to selected billing groups instead of every member. Use GET / PUT https://api.cursor.com/grok-bot/access. Official references: Admin API → Grok Bot access; Grok Bot for teams and enterprises. Group access writes return 403 when the feature is not available to the team.

Authenticate with a team Admin API key (Basic auth, key as username, empty password). Reads need read:* or admin:*; writes need admin:*. Rate limit: 20 requests per minute per team per endpoint. Reads of the effective policy work on every plan.

Read current access

curl -X GET https://api.cursor.com/grok-bot/access \
  -u YOUR_API_KEY:

Example response:

{
  "mode": "limited",
  "groups": [
    {
      "id": "group_PDSPmvukpYgZEDXsoNirw3CFhy",
      "name": "Platform Engineering"
    }
  ]
}

Field	Meaning
mode	all (every member) or limited (selected billing groups)
groups	Selected groups when mode is limited; empty when mode is all

List billing group IDs

Encoded group IDs come from List Groups:

curl -X GET "https://api.cursor.com/teams/groups" \
  -u YOUR_API_KEY:

Use each group’s id (for example group_PDSPmvukpYgZEDXsoNirw3CFhy) in the access PUT below. Members can belong to only one billing group at a time; unassigned members sit in the reserved Unassigned group.

Limit access to groups

curl -X PUT https://api.cursor.com/grok-bot/access \
  -u YOUR_API_KEY: \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "limited",
    "groupIds": ["group_PDSPmvukpYgZEDXsoNirw3CFhy"]
  }'

Field	Rules
mode	Required. all or limited
groupIds	Required when mode is limited (1–100 IDs; duplicates count once). Omit when mode is all

Unknown or malformed IDs, an empty limited list, or groupIds with mode: "all" return 400.

Open access to every member

curl -X PUT https://api.cursor.com/grok-bot/access \
  -u YOUR_API_KEY: \
  -H "Content-Type: application/json" \
  -d '{ "mode": "all" }'

Access changes appear in audit logs as grok_bot_access_changed.

Pitfalls

• Passing dashboard display names instead of encoded group_… IDs from /teams/groups.
• Sending groupIds together with mode: "all" — that combination returns 400.
• Using a read:* key for PUT — writes require admin:*.
• Assuming access PUT enables or disables the product org-wide — use /grok-bot/enable and /grok-bot/disable for the Enterprise enable switch.