Patch Group Members

Description

Adds, invites, updates or removes the members of an existing AttackForge Group. This is a write operation. Each member holds a project access level, which is the access they get to the projects the group is linked to, a project request access level, and flow and custom action sharing settings.

One call can mix up to 50 operations, one per user, and every operation is checked before anything is written. A user is added by user_id (source: find_users) or by the email address of an existing user; adding a current member updates them, and adding a former member restores them. Read the current members with find_group_members.

An invite operation creates a user account for somebody who has none yet, makes them a member and emails them an invitation to register. The accounts are created first and are not rolled back if a later step of the call fails, so after an Internal Server Error on a call that invited somebody, check find_users before retrying.

The shape of args is declared inline (see Building args for Write Tools), so no preparatory call is needed.

Preconditions: the caller must be an Admin or a member admin of the group (see patch_group_member_admins), and the group must not be archived; a member admin cannot grant a level above their limits, and can invite only when allowed to; an invite also needs the tenant to be within its user licence. As in the AttackForge UI, a newly added member is emailed. On success the user ids are returned, sorted by outcome.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool patch_group_members and click Add

Example Prompts

• Add [e-mail] to the Red Team group with Edit access to its projects.

• Invite [e-mail] to the Contractors group with View access.

• Give Bob Action access to the SOC group's project requests.

• Let the members of the Automation group share their flows with the group.

• Remove Bob from the ACME group.

Parameters

Parameter	Type	Required	Description
args	object	Yes	The group-members patch payload - see the keys below.

args keys:

Key	Type	Required	Description
group_id	string	Yes	Id (24-hex) of the group whose members are changed. Source: find_groups. The members of an archived group cannot be changed.
operations	array	Yes	1 to 50 operations, at most one per user - see the keys below.

operations item keys:

Key	Type	Required	Description
type	string	Yes	'add', 'invite', 'update' or 'remove'.
user_id	string	No	Id (24-hex) of the user. For 'add', give user_id or email but not both; the user must exist and not be deleted (source: find_users). Required for 'update' and 'remove', which need a current member (source: find_group_members, its user_id field). Removing a member leaves the user account itself as it is.
email	string	No	For 'add', in place of user_id: the email address of an existing, non-deleted user, matched case-insensitively; an address held by more than one user is refused. Required for 'invite': the email address of somebody who has no AttackForge account yet. A user account is created for them with the Invited status, they are made a member of the group, and they are emailed an invitation to register. An email address or username a user already holds is refused for 'invite' - add that user with an 'add' operation instead, after restore_user when the user is deleted.
project_access_level	string	No	The access the member has to the projects the group is linked to: 'None' gives no access, 'View' can read them, 'Upload' can also upload files, 'Edit' can also change them. Required for 'add' and 'invite'. It cannot exceed the caller's own member admin limit; Admins are not limited.
project_request_access_level	string	No	The access the member has to the project requests shared with the group: 'None' gives no access, 'View' can read them, 'Edit' can also change them, 'Action' can also action them. Required for 'add' and 'invite'. It cannot exceed the caller's own member admin limit; Admins are not limited.
flow_sharing	string	No	Whether the member may share their flows with the group: 'All' or 'None'. Defaults to 'None' when a new member is added. Refused when the tenant does not have the Flows module.
custom_action_sharing	string	No	Whether the member may share their custom actions with the group: 'All' or 'None'. Defaults to 'None' when a new member is added. Refused when the tenant does not have the Flows module.

An 'update' must supply at least one of project_access_level, project_request_access_level, flow_sharing or custom_action_sharing, and changes only those. 'remove' takes only user_id. invited lists the user accounts created by the call's 'invite' operations, in the order of those operations. unchanged lists the members that already had the settings asked for - it is not an error and the call should not be retried.

Example Response

{
  "group_id": "65b1f0a28cade68ca7bc71a4",
  "added": [
    "65a440c08cade68ca7bc7192"
  ],
  "invited": [
    "65b1f2448cade68ca7bc71d7"
  ],
  "updated": [
    "65a440c08cade68ca7bc7193"
  ],
  "removed": [],
  "unchanged": []
}