Access

Use {"action":"approve_group","params":{...}}; only top-level keys are action and params. Action params schema: gitlab://schema/meta/gitlab_access/.

Manage GitLab access credentials: access tokens (project/group/personal), deploy tokens, deploy keys, access requests, and invitations. Revoke/delete actions are destructive and irreversible. When to use: provision and audit who/what can access a project or group; rotate (not revoke+create) to roll a token without invalidating CI configurations. NOT for: SSH/GPG keys or impersonation tokens (use gitlab_user), PAT creation (use gitlab_user create_personal_access_token / create_current_user_pat — gitlab_access exposes token_personal_* for list/get/rotate/revoke only), instance admin operations (use gitlab_admin), project membership/permissions (use gitlab_project member_*), 2FA/MFA flows.

Returns:

• token_list / deploy_token_list / deploy_key_list_* / request_list_* / invite_list_*: arrays with pagination.

• token_get / tokencreate / tokenrotate / deploy_token_get / deploy_token_create_* / deploy_key_get / deploy_key_add / deploy_key_update / deploy_key_enable / approve_* / request_*: token / key / request / invitation object. Create / rotate include the cleartext token only ONCE — store it securely; subsequent reads return only the metadata.

• token_revoke / deploy_token_delete / deploy_key_delete / deny_* : {success, message}. Errors: 401/403 (hint: requires Maintainer+ to manage project tokens, Owner for group, admin for instance / deploy_token_list_all / deploy_key_list_all / deploy_key_add_instance), 404 (hint: token_id and deploy_key_id are scoped to the project/group), 400 (hint: scopes must be a subset of {api, read_api, read_repository, write_repository, read_registry, write_registry}; expires_at must be a future ISO date).

Param conventions: * = required. List actions accept page, per_page. Token actions scope to project_id* or group_id*. Deploy token/key delete and token revoke are irreversible.

Access tokens (token_*) — project, group, and personal scopes. Rotate generates a new token and invalidates the old one:

• token_project_list / token_group_list: project_id* or group_id*

• token_project_get / token_group_get: project_id* or group_id*, token_id*

• token_project_create / token_group_create: project_id* or group_id*, name*, scopes*, expires_at, access_level

• token_project_rotate / token_group_rotate: project_id* or group_id*, token_id*, expires_at

• token_project_rotate_self / token_group_rotate_self: project_id* or group_id*, expires_at

• token_project_revoke / token_group_revoke: project_id* or group_id*, token_id*

• token_personal_list: user_id

• token_personal_get: token_id*

• token_personal_rotate: token_id*, expires_at

• token_personal_rotate_self: expires_at

• token_personal_revoke: token_id*

• token_personal_revoke_self: (no params)

Deploy tokens (deploy_token_*) — scoped to project or group, used for CI/CD registry access:

• deploy_token_list_all: (admin only)

• deploy_token_list_project / deploy_token_list_group: project_id* or group_id*

• deploy_token_get_project / deploy_token_get_group: project_id* or group_id*, deploy_token_id*

• deploy_token_create_project / deploy_token_create_group: project_id* or group_id*, name*, scopes*, expires_at

• deploy_token_delete_project / deploy_token_delete_group: project_id* or group_id*, deploy_token_id*

Deploy keys (deploy_key_*) — SSH keys for read/write repo access without a user account. For deploy-key wording, add/create maps to deploy_key_add, fetch/get maps to deploy_key_get, update maps to deploy_key_update, and delete/remove maps to deploy_key_delete.

• deploy_key_list_project / deploy_key_list_user_project: project_id*

• deploy_key_list_all: (admin only)

• deploy_key_get: project_id*, deploy_key_id*. If a workflow says add/create, then fetch/get, then update/delete, call deploy_key_get with the id returned by deploy_key_add before updating.

• deploy_key_add: project_id*, title*, key*, can_push

• deploy_key_update: project_id*, deploy_key_id*, title, can_push

• deploy_key_delete: project_id*, deploy_key_id*

• deploy_key_enable: project_id*, deploy_key_id*

• deploy_key_add_instance: title*, key*

Access requests (request_, approve_, deny_*):

• request_list_project / request_list_group: project_id* or group_id*

• request_project / request_group: project_id* or group_id*

• approve_project / approve_group: project_id* or group_id*, user_id*, access_level

• deny_project / deny_group: project_id* or group_id*, user_id*

Invitations (invite_*):

• invite_list_project / invite_list_group: project_id* or group_id*

• invite_project / invite_group: project_id* or group_id*, email*, access_level*, expires_at

See also: gitlab_user (SSH/GPG keys, user PATs), gitlab_admin (instance admin), gitlab_project (project settings)