Permissions & Access Lists

Tools for DAM access control — access lists, permission definitions, and the preview and apply pairs that change permissions on records, classifications, and collections.

This page covers 38 tools, all of them available on request rather than in the default tool list, and 2 destructive.

How to read this page

• Status — In the default tool list means the tool is one of the ~200 Aprimo advertises to every agent out of the box, so the agent discovers and calls it on its own. Available on request means the tool is registered and fully callable, but sits outside that default list — call it by name, or ask Aprimo to extend the list your tenant is served.
• Both statuses work identically when called. Status affects discovery, not capability or authorization.
• Visibility is not authorization. Every tool call executes as the authenticated user, and any tool can return an authorization error if that user lacks rights to the record, task, or file. See the MCP Tool Permission Map.
• Destructive tools are labelled as such. They delete or irreversibly overwrite data, and will not act unless the call sets both confirmed and confirmedDestructive to true.
• Activity and Project labels vary by tenant. Where this page says Activity or Project, your tenant's own configured terminology is substituted at runtime.

Why isn't every tool in the default list?

Aprimo's MCP Server exposes far more tools than most MCP clients handle well — many degrade or truncate their tool list well below the full catalogue. Rather than let a client truncate arbitrarily, Aprimo advertises a curated set of roughly 200 tools covering the tasks customers most commonly automate. Everything outside that set remains fully supported and callable by name; it simply isn't offered up front. If your integration leans on a tool that is available on request, talk to your Aprimo Customer Success Manager about extending the advertised list for your tenant.

Tools at a Glance

Tool	Status	What it does
apply_access_list_members_by_id	On request	Applies a membership change to one Aprimo access list (identified by its id) that was already previewed via preview_access_list_members_by_id.
apply_access_list_members_by_key	On request	Applies a membership change to one Aprimo access list (identified by externalId + permission + type) that was already previewed via preview_access_list_members_by_key.
apply_classification_permissions	On request	Applies a group-based permission change to one Aprimo classification (kind selects tree/download/record -- see preview_classification_permissions) that was already previewed via preview_classification_permissions.
apply_collection_permissions	On request	Applies a permission change to one Aprimo collection that was already previewed via preview_collection_permissions.
apply_create_access_list	On request	Creates a new Aprimo access list that was already previewed via preview_create_access_list.
apply_permission_definition	On request	Applies a change to one Aprimo permission definition that was already previewed via preview_permission_definition.
apply_user_group_permissions	On request	Applies a named-permission grant change to one Aprimo user group that was already previewed via preview_user_group_permissions.
apply_user_groups_permissions_batch	On request	Applies a named-permission grant change across multiple Aprimo user groups that was already previewed via preview_user_groups_permissions_batch.
apply_user_permissions	On request	Applies a named-permission grant change to one Aprimo user that was already previewed via preview_user_permissions.
delete_access_list	On request	Destructive. Permanently deletes an Aprimo access list by its id.
delete_access_list_by_key	On request	Destructive. Permanently deletes an Aprimo access list identified by its (externalId, permission, type) composite key.
get_access_list	On request	Gets one Aprimo access list by its id -- not get_access_list_by_key, which looks up by a different key shape (the (externalId, permission, type) triplet), not an id.
get_access_list_by_key	On request	Gets one Aprimo access list by its (externalId, permission, type) composite key — the way access lists are addressed when the caller doesn't already know the access list's id.
get_calculated_permission	On request	Gets the calling user's calculated value (Granted/Denied/None) for one named permission in Aprimo, by its exact name — this reflects role/group inheritance, not just an explicit grant.
get_permission	On request	Gets one Aprimo named-permission definition (its display labels) by its exact name.
get_user	On request	Gets one Aprimo user's detail (name, email, active status, storage usage, and dates) by id or by name.
get_user_field	On request	Gets one custom field value set on an Aprimo user, by the user's id/name and the field's id (from list_user_fields or get_custom_field_definition).
get_user_group	On request	Gets one Aprimo user group's detail (name, organization, active status, and dates) by id or by name.
get_user_image	On request	Returns the profile image URL (plus width/height/size/extension) for an Aprimo user, by id or by name.
list_access_lists	On request	Lists the access lists configured in Aprimo: externalId, type, permission, member users/groups, and dates.
list_calculated_permissions	On request	Lists the calling user's calculated values (Granted/Denied/None) for named permissions in Aprimo, with the names sent in the query string.
list_permissions	On request	Lists the named-permission definitions configured in Aprimo: name and display labels.
list_user_fields	On request	Lists the custom field values set on an Aprimo user, by id or by name.
list_user_group_permissions	On request	Lists an Aprimo user group's explicit named-permission values (Granted/Denied/None — these apply to every member of the group), by id or by name.
list_user_groups	On request	Lists the user groups configured in Aprimo: name, organization, active status, and dates.
list_user_memberships	On request	Lists the Aprimo user groups a user is a member of, by id or by name.
list_user_permissions	On request	Lists an Aprimo user's explicit named-permission values (Granted/Denied/None), by id or by name.
list_users	On request	Lists the users configured in Aprimo: name, email, active status, storage usage, and dates.
lookup_calculated_permissions	On request	Looks up the calling user's calculated values (Granted/Denied/None) for named permissions in Aprimo, with the names sent in the request body — functionally equivalent to list_calculated_permissions, but usable when the name list is too long for a query string.
preview_access_list_members_by_id	On request	Previews adding/removing users and user groups from one Aprimo access list, identified by its id.
preview_access_list_members_by_key	On request	Previews adding/removing users and user groups from one Aprimo access list, identified by its externalId + permission + type (rather than its id).
preview_classification_permissions	On request	Previews an access-control change to one Aprimo classification's group-based permissions.
preview_collection_permissions	On request	Previews an access-control change to one Aprimo collection's permissions (who can read/modify it, and what the public can do).
preview_create_access_list	On request	Previews creating a new Aprimo access list (a reusable, named set of users/groups with a permission grant that can be assigned to records or classifications in bulk).
preview_permission_definition	On request	Previews a change to one Aprimo permission definition -- its display labels and/or its name.
preview_user_group_permissions	On request	Previews a named-permission grant change for one Aprimo user group (its explicit Granted/Denied/None value for named permissions -- these apply to every member of the group).
preview_user_groups_permissions_batch	On request	Previews a named-permission grant change across multiple Aprimo user groups in one call.
preview_user_permissions	On request	Previews a named-permission grant change for one Aprimo user (their explicit Granted/Denied/None value for named permissions, e.g. role-derived rights).

---

apply_access_list_members_by_id

Available on request

Applies a membership change to one Aprimo access list (identified by its id) that was already previewed via preview_access_list_members_by_id. Must be called with the exact same arguments used in that preview call, plus its confirm_token -- any difference invalidates the token and this is refused. This modifies data -- the change affects every record/classification this access list is assigned to. Do not call without having shown the user the preview's diff and gotten explicit confirmation, then call again with confirmed=true.

Parameters:

Parameter	Type	Required	Description
accessListId	string	Yes	The access list id (32-char hex). Must match the preview call.
addUsers	array of string	Yes	Must match the value passed to preview_access_list_members_by_id.
removeUsers	array of string	Yes	Must match the value passed to preview_access_list_members_by_id.
addGroups	array of string	Yes	Must match the value passed to preview_access_list_members_by_id.
removeGroups	array of string	Yes	Must match the value passed to preview_access_list_members_by_id.
confirmToken	string	Yes	The confirm_token returned by preview_access_list_members_by_id for this exact change.
confirmed	boolean	Yes	Must be true to apply. Call preview_access_list_members_by_id first, review the diff with the user, then call again with confirmed=true.
server	McpServer	Yes

Returns:

Field	Type	Description
accessListId	string
applied	boolean
current	object (optional)
note	string (optional)

---

apply_access_list_members_by_key

Available on request

Applies a membership change to one Aprimo access list (identified by externalId + permission + type) that was already previewed via preview_access_list_members_by_key. Must be called with the exact same arguments used in that preview call, plus its confirm_token -- any difference invalidates the token and this is refused. This modifies data -- the change affects every record/classification this access list is assigned to. Do not call without having shown the user the preview's diff and gotten explicit confirmation, then call again with confirmed=true.

Parameters:

Parameter	Type	Required	Description
externalId	string	Yes	Must match the value passed to preview_access_list_members_by_key.
permission	string	Yes	Must match the value passed to preview_access_list_members_by_key.
type	string	Yes	Must match the value passed to preview_access_list_members_by_key.
addUsers	array of string	Yes	Must match the value passed to preview_access_list_members_by_key.
removeUsers	array of string	Yes	Must match the value passed to preview_access_list_members_by_key.
addGroups	array of string	Yes	Must match the value passed to preview_access_list_members_by_key.
removeGroups	array of string	Yes	Must match the value passed to preview_access_list_members_by_key.
confirmToken	string	Yes	The confirm_token returned by preview_access_list_members_by_key for this exact change.
confirmed	boolean	Yes	Must be true to apply. Call preview_access_list_members_by_key first, review the diff with the user, then call again with confirmed=true.
server	McpServer	Yes

Returns:

Field	Type	Description
externalId	string
permission	string
type	string
applied	boolean
current	object (optional)
note	string (optional)

---

apply_classification_permissions

Available on request

Applies a group-based permission change to one Aprimo classification (kind selects tree/download/record -- see preview_classification_permissions) that was already previewed via preview_classification_permissions. Must be called with the exact same arguments used in that preview call, plus its confirm_token -- any difference invalidates the token and this is refused. This modifies data. Do not call without having shown the user the preview's diff (especially any break-inheritance warning) and gotten explicit confirmation, then call again with confirmed=true.

Parameters:

Parameter	Type	Required	Description
classificationId	string	Yes	The classification id (32-char hex). Must match the preview call.
kind	string	Yes	Must match the value passed to preview_classification_permissions.
breakInheritance	boolean	Yes	Must match the value passed to preview_classification_permissions.
addOrUpdate	array of DamModels.ClassificationPermissionEntryInput	Yes	Must match the value passed to preview_classification_permissions.
remove	array of string	Yes	Must match the value passed to preview_classification_permissions.
confirmToken	string	Yes	The confirm_token returned by preview_classification_permissions for this exact change.
confirmed	boolean	Yes	Must be true to apply. Call preview_classification_permissions first, review the diff (and any break-inheritance warning) with the user, then call again with confirmed=true.
server	McpServer	Yes

Returns:

Field	Type	Description
classificationId	string
kind	string
applied	boolean
current	object (optional)
note	string (optional)

---

apply_collection_permissions

Available on request

Applies a permission change to one Aprimo collection that was already previewed via preview_collection_permissions. Must be called with the exact same arguments used in that preview call, plus its confirm_token -- any difference invalidates the token and this is refused. This modifies data. Do not call without having shown the user the preview's diff (especially any public-exposure warning) and gotten explicit confirmation, then call again with confirmed=true.

Parameters:

Parameter	Type	Required	Description
collectionId	string	Yes	The collection id (32-char hex). Must match the preview call.
collectionOwnerId	string	Yes	Must match the value passed to preview_collection_permissions.
addOrUpdateUsers	array of DamModels.CollectionUserPermissionInput	Yes	Must match the value passed to preview_collection_permissions.
removeUsers	array of string	Yes	Must match the value passed to preview_collection_permissions.
addOrUpdateGroups	array of DamModels.CollectionGroupPermissionInput	Yes	Must match the value passed to preview_collection_permissions.
removeGroups	array of string	Yes	Must match the value passed to preview_collection_permissions.
publicPermission	string	Yes	Must match the value passed to preview_collection_permissions.
confirmToken	string	Yes	The confirm_token returned by preview_collection_permissions for this exact change.
confirmed	boolean	Yes	Must be true to apply. Call preview_collection_permissions first, review the diff (and any public-exposure warning) with the user, then call again with confirmed=true.
server	McpServer	Yes

Returns:

Field	Type	Description
collectionId	string
applied	boolean
current	object (optional)	The collection's permissions after the write, HAL-stripped. Null if the re-read failed (see ).
note	string (optional)

---

apply_create_access_list

Available on request

Creates a new Aprimo access list that was already previewed via preview_create_access_list. Must be called with the exact same arguments used in that preview call, plus its confirm_token -- any difference invalidates the token and this is refused. This modifies data. Do not call without having shown the user the preview's diff (especially any duplicate-externalId warning) and gotten explicit confirmation, then call again with confirmed=true.

Parameters:

Parameter	Type	Required	Description
externalId	string	Yes	Must match the value passed to preview_create_access_list.
type	string	Yes	Must match the value passed to preview_create_access_list.
permission	string	Yes	Must match the value passed to preview_create_access_list.
users	array of string	Yes	Must match the value passed to preview_create_access_list.
userGroups	array of string	Yes	Must match the value passed to preview_create_access_list.
confirmToken	string	Yes	The confirm_token returned by preview_create_access_list for this exact change.
confirmed	boolean	Yes	Must be true to apply. Call preview_create_access_list first, review the diff (and any duplicate warning) with the user, then call again with confirmed=true.
server	McpServer	Yes

Returns:

Field	Type	Description
externalId	string
id	string (optional)
applied	boolean
current	object (optional)
note	string (optional)

---

apply_permission_definition

Available on request

Applies a change to one Aprimo permission definition that was already previewed via preview_permission_definition. Must be called with the exact same arguments used in that preview call, plus its confirm_token -- any difference invalidates the token and this is refused. This modifies data. Do not call without having shown the user the preview's diff (especially any rename warning -- a rename affects every grant referencing the permission by name) and gotten explicit confirmation, then call again with confirmed=true.

Parameters:

Parameter	Type	Required	Description
permissionName	string	Yes	The permission's current name. Must match the preview call.
newName	string	Yes	Must match the value passed to preview_permission_definition.
labels	array of DamModels.PermissionLabelInput	Yes	Must match the value passed to preview_permission_definition.
confirmToken	string	Yes	The confirm_token returned by preview_permission_definition for this exact change.
confirmed	boolean	Yes	Must be true to apply. Call preview_permission_definition first, review the diff (and any rename warning) with the user, then call again with confirmed=true.
server	McpServer	Yes

Returns:

Field	Type	Description
permissionName	string
applied	boolean
current	object (optional)
note	string (optional)

---

apply_user_group_permissions

Available on request

Applies a named-permission grant change to one Aprimo user group that was already previewed via preview_user_group_permissions. Must be called with the exact same arguments used in that preview call, plus its confirm_token -- any difference invalidates the token and this is refused. This modifies data -- the change affects every member of the group. Do not call without having shown the user the preview's diff and gotten explicit confirmation, then call again with confirmed=true.

Parameters:

Parameter	Type	Required	Description
userGroupId	string	Yes	The user group id (32-char hex). Must match the preview call.
addOrUpdate	array of DamModels.PermissionValueInput	Yes	Must match the value passed to preview_user_group_permissions.
remove	array of string	Yes	Must match the value passed to preview_user_group_permissions.
confirmToken	string	Yes	The confirm_token returned by preview_user_group_permissions for this exact change.
confirmed	boolean	Yes	Must be true to apply. Call preview_user_group_permissions first, review the diff with the user (this affects every member of the group), then call again with confirmed=true.
server	McpServer	Yes

Returns:

Field	Type	Description
userGroupId	string
applied	boolean
current	object (optional)
note	string (optional)

---

apply_user_groups_permissions_batch

Available on request

Applies a named-permission grant change across multiple Aprimo user groups that was already previewed via preview_user_groups_permissions_batch. Must be called with the exact same groups used in that preview call, plus its confirm_token -- any difference invalidates the token and this is refused. This modifies data. Not atomic across groups -- a partial failure can leave some groups updated and others not. Do not call without having shown the user the preview's diff and gotten explicit confirmation, then call again with confirmed=true.

Parameters:

Parameter	Type	Required	Description
groups	array of DamModels.UserGroupPermissionsBatchInput	Yes	Must match the groups passed to preview_user_groups_permissions_batch.
confirmToken	string	Yes	The confirm_token returned by preview_user_groups_permissions_batch for this exact change.
confirmed	boolean	Yes	Must be true to apply. Call preview_user_groups_permissions_batch first, review the diff (not atomic across groups) with the user, then call again with confirmed=true.
server	McpServer	Yes

Returns:

Field	Type	Description
applied	boolean
current	array of UserGroupPermissionsBatchEntryResult
current[].userGroupId	string
current[].permissions	object (optional)
current[].note	string (optional)

---

apply_user_permissions

Available on request

Applies a named-permission grant change to one Aprimo user that was already previewed via preview_user_permissions. Must be called with the exact same arguments used in that preview call, plus its confirm_token -- any difference invalidates the token and this is refused. This modifies data. Do not call without having shown the user the preview's diff and gotten explicit confirmation, then call again with confirmed=true.

Parameters:

Parameter	Type	Required	Description
userId	string	Yes	The user id (32-char hex). Must match the preview call.
addOrUpdate	array of DamModels.PermissionValueInput	Yes	Must match the value passed to preview_user_permissions.
remove	array of string	Yes	Must match the value passed to preview_user_permissions.
confirmToken	string	Yes	The confirm_token returned by preview_user_permissions for this exact change.
confirmed	boolean	Yes	Must be true to apply. Call preview_user_permissions first, review the diff with the user, then call again with confirmed=true.
server	McpServer	Yes

Returns:

Field	Type	Description
userId	string
applied	boolean
current	object (optional)
note	string (optional)

---

delete_access_list

Available on request · Destructive

Permanently deletes an Aprimo access list by its id. This cannot be undone. Requires both confirmed=true and confirmedDestructive=true, after explicitly confirming the exact access list with the user.

Parameters:

Parameter	Type	Required	Description
accessListId	string	Yes	The access list id (GUID) to delete.
confirmed	boolean	No	Must be true to proceed. Set to false (or omit) to get a confirmation gate error, then call again with confirmed=true after the user has explicitly confirmed the exact access list.
confirmedDestructive	boolean	No	Must also be true (in addition to confirmed) — deleting an access list is permanent and cannot be undone. Set only after stating the exact access list to the user and getting explicit go-ahead.

Returns:

Field	Type	Description
id	string
deleted	boolean

Destructive operation

This tool deletes or irreversibly overwrites data in the live tenant; the change cannot be rolled back through the API. It will not act unless the call sets both confirmed and confirmedDestructive to true.

---

delete_access_list_by_key

Available on request · Destructive

Permanently deletes an Aprimo access list identified by its (externalId, permission, type) composite key. This cannot be undone. Requires both confirmed=true and confirmedDestructive=true, after explicitly confirming the exact access list with the user.

Parameters:

Parameter	Type	Required	Description
externalId	string	Yes	The access list's externalId.
permission	string	Yes	The access list's permission. One of: Read, Modify, Delete, FullControl.
type	string	Yes	The access list's type.
confirmed	boolean	No	Must be true to proceed. Set to false (or omit) to get a confirmation gate error, then call again with confirmed=true after the user has explicitly confirmed the exact access list.
confirmedDestructive	boolean	No	Must also be true (in addition to confirmed) — deleting an access list is permanent and cannot be undone. Set only after stating the exact access list to the user and getting explicit go-ahead.

Returns:

Field	Type	Description
externalId	string
permission	string
type	string
deleted	boolean

Destructive operation

This tool deletes or irreversibly overwrites data in the live tenant; the change cannot be rolled back through the API. It will not act unless the call sets both confirmed and confirmedDestructive to true.

---

get_access_list

Available on request

Gets one Aprimo access list by its id -- not get_access_list_by_key, which looks up by a different key shape (the (externalId, permission, type) triplet), not an id. Use list_access_lists first, or get_access_list_by_key when only that key is known.

Parameters:

Parameter	Type	Required	Description
accessListId	string	Yes	The access list id (GUID), from list_access_lists.

Returns:

Field	Type	Description
id	string
externalId	string (optional)
type	string (optional)
permission	integer (optional)	Undocumented integer encoding — see 's remarks.
userIds	array of string
userGroupIds	array of string
createdOn	string (optional)
modifiedOn	string (optional)

---

get_access_list_by_key

Available on request

Gets one Aprimo access list by its (externalId, permission, type) composite key — the way access lists are addressed when the caller doesn't already know the access list's id. Use get_access_list instead when the id is already known.

Parameters:

Parameter	Type	Required	Description
externalId	string	Yes	The access list's externalId.
permission	string	Yes	The access list's permission. One of: Read, Modify, Delete, FullControl.
type	string	Yes	The access list's type.

Returns:

Field	Type	Description
id	string
externalId	string (optional)
type	string (optional)
permission	integer (optional)	Undocumented integer encoding — see 's remarks.
userIds	array of string
userGroupIds	array of string
createdOn	string (optional)
modifiedOn	string (optional)

---

get_calculated_permission

Available on request

Gets the calling user's calculated value (Granted/Denied/None) for one named permission in Aprimo, by its exact name — this reflects role/group inheritance, not just an explicit grant.

Parameters:

Parameter	Type	Required	Description
calculatedPermissionName	string	Yes	The permission's exact name, e.g. "RoleMyPermission".

Returns:

Field	Type	Description
name	string (optional)
value	string (optional)	One of "None", "Granted", "Denied".

---

get_permission

Available on request

Gets one Aprimo named-permission definition (its display labels) by its exact name. Distinct from list_user_permissions/list_user_group_permissions, which read a principal's granted/denied value for a permission, not its definition.

Parameters:

Parameter	Type	Required	Description
permissionName	string	Yes	The permission's exact name, e.g. "RoleMyPermission".

Returns:

Field	Type	Description
name	string
labels	array of PermissionLabelPayload
labels[].value	string (optional)
labels[].languageId	string

---

get_user

Available on request

Gets one Aprimo user's detail (name, email, active status, storage usage, and dates) by id or by name. Use list_users first, or use the name selector when the user names the account directly. Not a custom field (get_user_field), the user's group (get_user_group), image (get_user_image), or role (get_user_role).

Parameters:

Parameter	Type	Required	Description
userId	string	No	The user id (GUID). Provide this or name, not both.
name	string	No	The user's account name (case-insensitive, exact match). Provide this or userId, not both.

Returns:

Field	Type	Description
id	string
name	string (optional)
firstName	string (optional)
lastName	string (optional)
email	string (optional)
isActive	boolean (optional)
aprimoUserId	integer (optional)
languageId	string (optional)
languageForUIId	string (optional)
imageUri	string (optional)
createdOn	string (optional)
modifiedOn	string (optional)

---

get_user_field

Available on request

Gets one custom field value set on an Aprimo user, by the user's id/name and the field's id (from list_user_fields or get_custom_field_definition). Display it as "label: value" — never show the id/fieldName/dataType to the user.

Parameters:

Parameter	Type	Required	Description
fieldId	string	Yes	The field definition id (GUID) whose value to read.
userId	string	No	The user id (GUID). Provide this or name, not both.
name	string	No	The user's account name (case-insensitive, exact match). Provide this or userId, not both.

Returns:

Field	Type	Description
userId	string
id	string
fieldName	string (optional)
label	string (optional)
dataType	string (optional)
value	string (optional)

---

get_user_group

Available on request

Gets one Aprimo user group's detail (name, organization, active status, and dates) by id or by name. Use list_user_groups first, or use the name selector when the user names the group directly.

Parameters:

Parameter	Type	Required	Description
userGroupId	string	No	The user group id (GUID). Provide this or name, not both.
name	string	No	The user group's name (case-insensitive, exact match). Provide this or userGroupId, not both.

Returns:

Field	Type	Description
id	string
name	string (optional)
organizationId	string (optional)
isActive	boolean (optional)
createdOn	string (optional)
modifiedOn	string (optional)

---

get_user_image

Available on request

Returns the profile image URL (plus width/height/size/extension) for an Aprimo user, by id or by name. The URL remains valid for twenty-four hours. Returns a friendly message if the user has no profile image. Important: Display the URL as plain text, never as an HTML img tag.

Parameters:

Parameter	Type	Required	Description
userId	string	No	The user id (GUID). Provide this or name, not both.
name	string	No	The user's account name (case-insensitive, exact match). Provide this or userId, not both.

Returns:

Field	Type	Description
userId	string
uri	string (optional)
width	integer (optional)
height	integer (optional)
size	integer (optional)
extension	string (optional)

---

list_access_lists

Available on request

Lists the access lists configured in Aprimo: externalId, type, permission, member users/groups, and dates. Use to look up an access list's id, or its (externalId, permission, type) key, before calling get_access_list(_by_key) or delete_access_list(_by_key).

Parameters:

Parameter	Type	Required	Description
filter	string	No	Optional filter expression (DAM query syntax). Omit to list every access list.
sort	string	No	Optional sort expression. Omit for the endpoint's default order.
skip	integer	No	Number of items to skip, for paging. Defaults to 0.
take	integer	No	Maximum number of items to return. Omit for the endpoint's default page size.

Returns:

Field	Type	Description
count	integer
items	array of AccessListPayload
items[].id	string
items[].externalId	string (optional)
items[].type	string (optional)
items[].permission	integer (optional)	Undocumented integer encoding — see 's remarks.
items[].userIds	array of string
items[].userGroupIds	array of string
items[].createdOn	string (optional)
items[].modifiedOn	string (optional)

---

list_calculated_permissions

Available on request

Lists the calling user's calculated values (Granted/Denied/None) for named permissions in Aprimo, with the names sent in the query string. Use lookup_calculated_permissions instead when the name list is long enough to risk exceeding a query-string length limit.

Parameters:

Parameter	Type	Required	Description
names	string	Yes	Comma-separated list of permission names to look up, e.g. "RoleMyPermission,AnotherPermission". Required -- the endpoint has no "return every permission" default and 400s if this is omitted.

Returns:

Field	Type	Description
count	integer
items	array of PermissionValuePayload
items[].name	string (optional)
items[].value	string (optional)	One of "None", "Granted", "Denied".

---

list_permissions

Available on request

Lists the named-permission definitions configured in Aprimo: name and display labels. Use to look up a permission's exact name before calling get_permission, apply_permission_definition, or list_user_permissions/list_user_group_permissions filters.

Parameters:

Parameter	Type	Required	Description
skip	integer	No	Number of items to skip, for paging. Defaults to 0.
take	integer	No	Maximum number of items to return. Omit for the endpoint's default page size.

Returns:

Field	Type	Description
count	integer
items	array of PermissionPayload
items[].name	string
items[].labels	array of PermissionLabelPayload
items[].labels[].value	string (optional)
items[].labels[].languageId	string

---

list_user_fields

Available on request

Lists the custom field values set on an Aprimo user, by id or by name. Use includeFields to filter to specific fields (matches by id exactly, or by fieldName/label substring). Display each as "label: value" — never show id/fieldName/dataType to the user.

Parameters:

Parameter	Type	Required	Description
userId	string	No	The user id (GUID). Provide this or name, not both.
name	string	No	The user's account name (case-insensitive, exact match). Provide this or userId, not both.
includeFields	string	No	Optional comma-separated list of custom field terms to include. Matching is case-insensitive: an exact match on field id, or a substring match on fieldName or label. Examples: "keywords", "Status", "brand,campaign". Omit to return all fields.
skip	integer	No	Number of items to skip, for paging. Defaults to 0.
take	integer	No	Maximum number of items to return. Omit for the endpoint's default page size.

Returns:

Field	Type	Description
userId	string
count	integer
items	array of UserFieldPayload
items[].userId	string
items[].id	string
items[].fieldName	string (optional)
items[].label	string (optional)
items[].dataType	string (optional)
items[].value	string (optional)

---

list_user_group_permissions

Available on request

Lists an Aprimo user group's explicit named-permission values (Granted/Denied/None — these apply to every member of the group), by id or by name. Read-only — use preview_user_group_permissions/apply_user_group_permissions to change these.

Parameters:

Parameter	Type	Required	Description
userGroupId	string	No	The user group id (GUID). Provide this or name, not both.
name	string	No	The user group's name (case-insensitive, exact match). Provide this or userGroupId, not both.
filter	string	No	Optional filter expression (DAM query syntax). Omit to return every permission value.
skip	integer	No	Number of items to skip, for paging. Defaults to 0.
take	integer	No	Maximum number of items to return. Omit for the endpoint's default page size.

Returns:

Field	Type	Description
userGroupId	string
count	integer
items	array of PermissionValuePayload
items[].name	string (optional)
items[].value	string (optional)	One of "None", "Granted", "Denied".

---

list_user_groups

Available on request

Lists the user groups configured in Aprimo: name, organization, active status, and dates. Use when the user asks what user groups exist, or to look up a group's id/exact name before calling get_user_group or list_user_group_permissions by name.

Parameters:

Parameter	Type	Required	Description
filter	string	No	Optional filter expression (DAM query syntax), e.g. "IsActive = true". Omit to list every user group.
sort	string	No	Optional sort expression, e.g. "Name asc". Omit for the endpoint's default order.
skip	integer	No	Number of items to skip, for paging. Defaults to 0.
take	integer	No	Maximum number of items to return. Omit for the endpoint's default page size.

Returns:

Field	Type	Description
count	integer
items	array of UserGroupPayload
items[].id	string
items[].name	string (optional)
items[].organizationId	string (optional)
items[].isActive	boolean (optional)
items[].createdOn	string (optional)
items[].modifiedOn	string (optional)

---

list_user_memberships

Available on request

Lists the Aprimo user groups a user is a member of, by id or by name.

Parameters:

Parameter	Type	Required	Description
userId	string	No	The user id (GUID). Provide this or name, not both.
name	string	No	The user's account name (case-insensitive, exact match). Provide this or userId, not both.

Returns:

Field	Type	Description
userId	string
count	integer
items	array of UserGroupPayload
items[].id	string
items[].name	string (optional)
items[].organizationId	string (optional)
items[].isActive	boolean (optional)
items[].createdOn	string (optional)
items[].modifiedOn	string (optional)

---

list_user_permissions

Available on request

Lists an Aprimo user's explicit named-permission values (Granted/Denied/None), by id or by name. Read-only — use preview_user_permissions/apply_user_permissions to change these.

Parameters:

Parameter	Type	Required	Description
userId	string	No	The user id (GUID). Provide this or name, not both.
name	string	No	The user's account name (case-insensitive, exact match). Provide this or userId, not both.
skip	integer	No	Number of items to skip, for paging. Defaults to 0.
take	integer	No	Maximum number of items to return. Omit for the endpoint's default page size.

Returns:

Field	Type	Description
userId	string
count	integer
items	array of PermissionValuePayload
items[].name	string (optional)
items[].value	string (optional)	One of "None", "Granted", "Denied".

---

list_users

Available on request

Lists the users configured in Aprimo: name, email, active status, storage usage, and dates. Use when the user asks what users exist, or to look up a user's id/exact name before calling get_user, list_user_fields, list_user_memberships, or list_user_permissions by name.

Parameters:

Parameter	Type	Required	Description
filter	string	No	Optional filter expression (DAM query syntax), e.g. "IsActive = true". Omit to list every user.
sort	string	No	Optional sort expression, e.g. "Name asc". Omit for the endpoint's default order.
skip	integer	No	Number of items to skip, for paging. Defaults to 0.
take	integer	No	Maximum number of items to return. Omit for the endpoint's default page size.

Returns:

Field	Type	Description
count	integer
items	array of UserPayload
items[].id	string
items[].name	string (optional)
items[].firstName	string (optional)
items[].lastName	string (optional)
items[].email	string (optional)
items[].isActive	boolean (optional)
items[].aprimoUserId	integer (optional)
items[].languageId	string (optional)
items[].languageForUIId	string (optional)
items[].imageUri	string (optional)
items[].createdOn	string (optional)
items[].modifiedOn	string (optional)

---

lookup_calculated_permissions

Available on request

Looks up the calling user's calculated values (Granted/Denied/None) for named permissions in Aprimo, with the names sent in the request body — functionally equivalent to list_calculated_permissions, but usable when the name list is too long for a query string. This is a read: it never modifies data, despite using POST.

Parameters:

Parameter	Type	Required	Description
names	.")] List<string>	Yes	Permission names to look up, e.g. ["RoleMyPermission", "AnotherPermission"].

Returns:

Field	Type	Description
count	integer
items	array of PermissionValuePayload
items[].name	string (optional)
items[].value	string (optional)	One of "None", "Granted", "Denied".

---

preview_access_list_members_by_id

Available on request

Previews adding/removing users and user groups from one Aprimo access list, identified by its id. Read-only dry run -- changes nothing. Returns the current access list, the proposed membership diff, and a confirm_token. To actually apply the change, call apply_access_list_members_by_id next with the exact same arguments plus that confirm_token and confirmed=true.

Parameters:

Parameter	Type	Required	Description
accessListId	string	Yes	The access list id (32-char hex).
addUsers	array of string	No	User ids (32-char hex) to add to this access list.
removeUsers	array of string	No	User ids (32-char hex) to remove from this access list.
addGroups	array of string	No	User group ids (32-char hex) to add to this access list.
removeGroups	array of string	No	User group ids (32-char hex) to remove from this access list.

Returns:

Field	Type	Description
accessListId	string
current	object (optional)
proposed	AccessListMembersDiffBody
proposed.users	EditableIdCollectionModel (optional)
proposed.users.addOrUpdate	array of string
proposed.users.remove	array of string
proposed.userGroups	EditableIdCollectionModel (optional)
proposed.userGroups.addOrUpdate	array of string
proposed.userGroups.remove	array of string
confirmToken	string

---

preview_access_list_members_by_key

Available on request

Previews adding/removing users and user groups from one Aprimo access list, identified by its externalId + permission + type (rather than its id). Read-only dry run -- changes nothing. Returns the current access list, the proposed membership diff, and a confirm_token. To actually apply the change, call apply_access_list_members_by_key next with the exact same arguments plus that confirm_token and confirmed=true.

Parameters:

Parameter	Type	Required	Description
externalId	string	Yes	The access list's external identifier.
permission	string	Yes	The access list's permission level. One of Read, Modify, Delete, FullControl.
type	string	Yes	The access list's type (e.g. "Record", "Classification").
addUsers	array of string	No	User ids (32-char hex) to add to this access list.
removeUsers	array of string	No	User ids (32-char hex) to remove from this access list.
addGroups	array of string	No	User group ids (32-char hex) to add to this access list.
removeGroups	array of string	No	User group ids (32-char hex) to remove from this access list.

Returns:

Field	Type	Description
externalId	string
permission	string
type	string
current	object (optional)
proposed	AccessListMembersByKeyBody
proposed.externalId	string
proposed.permission	string	One of "Read", "Modify", "Delete", "FullControl".
proposed.type	string
proposed.users	EditableIdCollectionModel (optional)
proposed.users.addOrUpdate	array of string
proposed.users.remove	array of string
proposed.userGroups	EditableIdCollectionModel (optional)
proposed.userGroups.addOrUpdate	array of string
proposed.userGroups.remove	array of string
confirmToken	string

---

preview_classification_permissions

Available on request

Previews an access-control change to one Aprimo classification's group-based permissions. kind selects which permission set: tree (who can read/classify/modify/delete the classification tree node itself), download (who can download files classified under it), or record (who can read/modify records classified under it). Read-only dry run -- changes nothing. Returns the current permissions, the proposed diff, and a confirm_token. To actually apply the change, call apply_classification_permissions next with the exact same arguments plus that confirm_token and confirmed=true. A break_inheritance=true change is flagged break-inheritance in the response -- it affects every child classification under this one; confirm it explicitly with the user before applying.

Parameters:

Parameter	Type	Required	Description
classificationId	string	Yes	The classification id (32-char hex).
kind	string	Yes	Which permission set to change. One of tree, download, record.
breakInheritance	boolean	No	Optional: when true, breaks permission inheritance from the parent classification for this permission set. High-impact -- affects every child classification.
addOrUpdate	array of DamModels.ClassificationPermissionEntryInput	No	User group grants to add or update. Each entry is {userGroupId, accessRight}; valid accessRight values depend on kind (see tool description).
remove	array of string	No	User group ids (32-char hex) whose explicit grant for this permission set should be removed.

Returns:

Field	Type	Description
classificationId	string
kind	string
current	object (optional)
proposed	ClassificationPermissionsEditCommand
proposed.breakInheritance	boolean (optional)
proposed.permissions	ClassificationPermissionsDiff
proposed.permissions.addOrUpdate	array of ClassificationPermissionEntryInput
proposed.permissions.remove	array of ClassificationPermissionRemoveEntry
breakInheritanceWarning	string (optional)	Non-null only when this change would set breakInheritance=true — see AclTools.BuildBreakInheritanceWarning.
confirmToken	string

---

preview_collection_permissions

Available on request

Previews an access-control change to one Aprimo collection's permissions (who can read/modify it, and what the public can do). Read-only dry run -- changes nothing. Returns the current permissions, the proposed diff (only the principals you specify are changed; everyone else is left alone), and a confirm_token. To actually apply the change, call apply_collection_permissions next with the exact same arguments plus that confirm_token and confirmed=true. A public_permission change is flagged public-exposure in the response -- read that flag and confirm it explicitly with the user before applying.

Parameters:

Parameter	Type	Required	Description
collectionId	string	Yes	The collection id (32-char hex).
collectionOwnerId	string	No	Optional: transfer ownership of the collection to this user id (32-char hex).
addOrUpdateUsers	array	No	Users to grant or change a permission for. Each entry is {userId, permission}, permission one of None, Read, Modify.
removeUsers	array	No	User ids (32-char hex) whose explicit permission on this collection should be removed.
addOrUpdateGroups	array	No	Groups to grant or change a permission for. Each entry is {groupId, permission}, permission one of None, Read, Modify.
removeGroups	array	No	Group ids (32-char hex) whose explicit permission on this collection should be removed.
publicPermission	string	No	Optional: what users with no explicit or group permission can do. One of None, Read. Any change here is public-exposure-sensitive.

Returns:

Field	Type	Description
collectionId	string
current	object (optional)	/// The collection's current permissions as returned by DAM, with HAL (_links/_embedded) stripped. A rather than a named dto deliberately — 's StripHal is the shared, generic "make a raw DAM response safe to return" helper every later ACL preview tool reuses, so this field mirrors whatever shape the underlying DAM resource has rather than duplicating it as a hand-typed model.
proposed	CollectionPermissionsEditBody
proposed.collectionOwnerId	string (optional)
proposed.permissions	CollectionUserPermissionsDiff (optional)
proposed.permissions.addOrUpdate	array of CollectionUserPermissionInput
proposed.permissions.remove	array of CollectionUserRemoveEntry
proposed.groupsPermissions	CollectionGroupPermissionsDiff (optional)
proposed.groupsPermissions.addOrUpdate	array of CollectionGroupPermissionInput
proposed.groupsPermissions.remove	array of CollectionGroupRemoveEntry
proposed.publicPermission	string (optional)
publicExposureWarning	string (optional)	Non-null only when this change would alter publicPermission — see AclTools.BuildPublicExposureWarning.
confirmToken	string

---

preview_create_access_list

Available on request

Previews creating a new Aprimo access list (a reusable, named set of users/groups with a permission grant that can be assigned to records or classifications in bulk). Read-only dry run -- changes nothing. Checks whether an access list with this externalId already exists and flags it as a duplicate advisory (DAM's real key is externalId+type+permission, so a second list under the same externalId is legal but is often a copy/paste mistake) -- decide whether to reuse the existing one instead. Returns the proposed access list and a confirm_token. To actually create it, call apply_create_access_list next with the exact same arguments plus that confirm_token and confirmed=true.

Parameters:

Parameter	Type	Required	Description
externalId	string	Yes	External identifier for the new access list (caller-defined, used to look it up later).
type	string	Yes	The access list's type -- confirmed live against the tenant: this must be the GUID id of an existing DAM entity (not a free-text category label like "Record" or "Classification" -- passing one of those 400s with "The specified access list type does not exist.", and passing an otherwise-well-formed but non-existent GUID 500s ungracefully instead of a clean validation error). Find a valid value by reading the type field off an existing access list via list_access_lists/get_access_list first, and reuse it, rather than guessing one.
permission	string	Yes	The permission level this access list grants. One of Read, Modify, Delete, FullControl.
users	array of string	No	User ids (32-char hex) to include as initial members.
userGroups	array of string	No	User group ids (32-char hex) to include as initial members.

Returns:

Field	Type	Description
externalId	string
type	string
permission	string
proposed	CreateAccessListBody
proposed.externalId	string
proposed.type	string
proposed.permission	string	One of "Read", "Modify", "Delete", "FullControl".
proposed.users	EditableIdCollectionModel (optional)
proposed.users.addOrUpdate	array of string
proposed.users.remove	array of string
proposed.userGroups	EditableIdCollectionModel (optional)
proposed.userGroups.addOrUpdate	array of string
proposed.userGroups.remove	array of string
duplicateWarning	string (optional)	Non-null only when an existing access list already uses this externalId — see AclTools.BuildDuplicateExternalIdWarning.
confirmToken	string

---

preview_permission_definition

Available on request

Previews a change to one Aprimo permission definition -- its display labels and/or its name. Read-only dry run -- changes nothing. Returns the current definition, the proposed change, and a confirm_token. To actually apply the change, call apply_permission_definition next with the exact same arguments plus that confirm_token and confirmed=true. Renaming a permission affects every user/group grant that references it by name -- a rename is flagged in the response; confirm it explicitly with the user before applying.

Parameters:

Parameter	Type	Required	Description
permissionName	string	Yes	The permission's current name.
newName	string	No	Optional: rename the permission to this name. Affects every grant referencing the old name.
labels	array of DamModels.PermissionLabelInput	No	Optional: replace the permission's display labels. Each entry is {languageId, value}.

Returns:

Field	Type	Description
permissionName	string
current	object (optional)
proposed	PermissionDefinitionBody
proposed.originalName	string
proposed.name	string
proposed.labels	array of PermissionLabelInput (optional)	Only populated when the caller specified labels — this is a diff (rename-only otherwise), not a full label replacement.
proposed.labels[].languageId	string	The language id (GUID) this label is in.
proposed.labels[].value	string	The label text for that language.
renameWarning	string (optional)	Non-null only when this change would rename the permission — see AclTools.BuildPermissionRenameWarning.
confirmToken	string

---

preview_user_group_permissions

Available on request

Previews a named-permission grant change for one Aprimo user group (its explicit Granted/Denied/None value for named permissions -- these apply to every member of the group). Read-only dry run -- changes nothing. Returns the current permission values, the proposed diff, and a confirm_token. To actually apply the change, call apply_user_group_permissions next with the exact same arguments plus that confirm_token and confirmed=true.

Parameters:

Parameter	Type	Required	Description
userGroupId	string	Yes	The user group id (32-char hex).
addOrUpdate	array of DamModels.PermissionValueInput	No	Permissions to grant or change for this user group. Each entry is {name, value}, value one of None, Granted, Denied.
remove	array of string	No	Permission names whose explicit value for this user group should be removed.

Returns:

Field	Type	Description
userGroupId	string
current	object (optional)
proposed	PermissionsEditBody
proposed.permissions	PermissionDiff
proposed.permissions.addOrUpdate	array of PermissionValueInput
proposed.permissions.remove	array of PermissionRemoveEntry (optional)
confirmToken	string

---

preview_user_groups_permissions_batch

Available on request

Previews a named-permission grant change across multiple Aprimo user groups in one call. Read-only dry run -- changes nothing. Reads each group's current permissions individually and returns the proposed diff per group, plus a single confirm_token covering the whole batch. Important: applying this batch is not atomic across groups -- if the underlying Aprimo API call fails partway through, some groups may already be updated while others are not; there is no automatic rollback.

Parameters:

Parameter	Type	Required	Description
groups	array of DamModels.UserGroupPermissionsBatchInput	Yes	The user groups to change. Each entry is {userGroupId, addOrUpdate, remove}, mirroring preview_user_group_permissions' per-group args.

Returns:

Field	Type	Description
current	array of UserGroupPermissionsBatchEntryResult
current[].userGroupId	string
current[].permissions	object (optional)
current[].note	string (optional)
proposed	UserGroupsPermissionsBatchBody
proposed.userGroups	array of UserGroupPermissionsBatchEntry
proposed.userGroups[].id	string
proposed.userGroups[].permissions	PermissionDiff
confirmToken	string

---

preview_user_permissions

Available on request

Previews a named-permission grant change for one Aprimo user (their explicit Granted/Denied/None value for named permissions, e.g. role-derived rights). Read-only dry run -- changes nothing. Returns the current permission values, the proposed diff, and a confirm_token. To actually apply the change, call apply_user_permissions next with the exact same arguments plus that confirm_token and confirmed=true.

Parameters:

Parameter	Type	Required	Description
userId	string	Yes	The user id (32-char hex).
addOrUpdate	array of DamModels.PermissionValueInput	No	Permissions to grant or change for this user. Each entry is {name, value}, value one of None, Granted, Denied.
remove	array of string	No	Permission names whose explicit value for this user should be removed.

Returns:

Field	Type	Description
userId	string
current	object (optional)
proposed	PermissionsEditBody
proposed.permissions	PermissionDiff
proposed.permissions.addOrUpdate	array of PermissionValueInput
proposed.permissions.remove	array of PermissionRemoveEntry (optional)
confirmToken	string

---

Related

• Aprimo MCP Server — configuration, connection details, and authentication
• MCP Tool Permission Map — the Aprimo permissions that make each tool visible to your agent
• REST API vs. MCP — choosing the right integration approach for your agent