Tools Reference

Overview

BalkanID MCP exposes BalkanID capabilities as tools your AI assistant can call.

Tool availability depends on your scopes and role. For an in-session list tailored to your connection, ask the assistant to call help.

How to read Access

Each tool shows compact access chips:

• Scope — Read or Write (API key / connection scope required)

• Min. role — lowest BalkanID role that can use the tool (Reviewer+, Risk Manager+, or Administrator). Higher roles in the hierarchy inherit access.

OAuth sessions currently receive both Read and Write — see Authentication and Permissions.

Utility

Tool	Access	Description
whoami	Read · Reviewer+	Returns the current authenticated user email and tenant ID. Use to verify the connection.
help	Read · Reviewer+	Returns a server overview, available tools, usage examples, and service health.

Documentation

These tools search and read BalkanID product documentation (proxied from GitBook). Use them when you need setup steps, feature behavior, or troubleshooting without leaving the chat.

Tool	Access	Description
docs_askQuestion	Read · Reviewer+	Ask a natural-language question; returns a synthesized answer with links to source pages.
docs_searchDocumentation	Read · Reviewer+	Search published docs for matching pages and excerpts.
docs_getPage	Read · Reviewer+	Fetch full markdown for a docs page URL (for example from search results).
docs_sendFeedback	Write · Reviewer+	Report a documentation issue or suggestion to the BalkanID docs team.

Discovery

Tool	Access	Description
list_integrations	Read · Reviewer+	Lists integration instances. Defaults to active status unless you pass another status.
sync_integration	Write · Administrator	Triggers a data sync for an integration.
list_identities	Read · Reviewer+	Lists identities (users, bots, service accounts) across connected apps. Supports rich filtering and pagination.
list_connections	Read · Reviewer+	Lists connections (roles, groups, permission sets).
list_resources	Read · Reviewer+	Lists resources (repos, channels, projects, and similar).
list_credentials	Read · Reviewer+	Lists credentials (API keys, tokens, service account keys). Filter by type, status, owner, app, or integration.
list_entity_relations	Read · Reviewer+	Lists directed relationships between entities (for example identity → connection, identity → credential, credential → resource).
filter_dimension_options	Read · Reviewer+	Returns distinct filter values for a field (for example departments or apps).

Employees

Tool	Access	Description
list_employees	Read · Reviewer+	Lists HR employee records with optional filters.
create_employee	Write · Administrator	Creates a new employee (or updates if the email already exists).
edit_employee	Write · Administrator	Updates an existing employee by email.

User access reviews

Tool	Access	Description
list_campaigns	Read · Risk Manager+	Lists user access review / certification campaigns.
list_campaign_access_reviews	Read · Reviewer+	Lists review items within a campaign.
list_request_access_reviews	Read · Reviewer+	Lists review items within an access request.
approve_reviews	Write · Reviewer+	Approves one or more reviews by review ID. Optional reason for audit.
reject_reviews	Write · Reviewer+	Rejects one or more reviews by review ID. Optional reason for audit.
delegate_reviews	Write · Reviewer+	Delegates reviews to another reviewer by email.

Access requests (lifecycle)

Tool	Access	Description
list_requests	Read · Reviewer+	Lists access requests with optional filters.
get_request_details	Read · Reviewer+	Returns full detail for a request, including review history.
approve_request	Write · Reviewer+	Approves all reviews for a request.
reject_request	Write · Reviewer+	Rejects all reviews for a request.
delegate_request	Write · Reviewer+	Delegates a request’s reviews to another employee.

JITPBAC — Purposes

Tool	Access	Description
list_purposes	Read · Reviewer+	Lists Purposes (structured entitlement bundles).
get_purpose_details	Read · Reviewer+	Returns full Purpose detail, including integrations and entities.
create_purpose_request	Write · Reviewer+	Creates an access request for a Purpose for an employee.
assign_employee_to_purpose	Write · Reviewer+	Assigns the current user to a Purpose (requires eligibility).
unassign_employee_from_purpose	Write · Reviewer+	Removes the current user’s assignment from a Purpose.

JITPBAC — Constraints

Constraints are denial policies: employees in scope must not access entities in scope. They are enforced when someone requests a Purpose that includes a constrained entity. See Constraints.

Tool	Access	Description
list_constraints	Read · Reviewer+	Lists Constraints for the tenant.
create_constraint	Write · Risk Manager+	Creates a Constraint.
update_constraint	Write · Risk Manager+	Updates an existing Constraint.
delete_constraint	Write · Risk Manager+	Deletes a Constraint.