Access and permissions
Choose what your assistant may read or change, and understand credits and live sends.
Your assistant acts through the access you approve during sign-in. MCP does not grant extra access: your current workspace membership, selected access level and API availability still apply.
Choose an access level
| Access | Best for | Limits |
|---|---|---|
| Read-only | Reviewing workspace data, campaigns, CRM records and results. | Cannot create, update, delete, launch or run paid searches. |
| Full | Creating and changing supported CRM and campaign data; owners and admins can also register event webhooks. | Cannot manage workspace settings, update workspace knowledge or use payment tools. Some actions spend credits or start outreach. |
In every workspace, Read-only exposes the CRM read tools and Full exposes the supported CRM read and write tools.
The connection is limited to the workspace selected during approval. If you choose All my workspaces, it works in every workspace where you're an owner, admin or member, including ones you join later, with the role you have in each; client-role workspaces are never included. Owners, admins and members can connect; client-role users cannot. Acquisity rechecks the connecting user's membership and role on every request, so removing the user or changing them to client removes access to that workspace shortly afterward. An all-workspaces connection belongs to the workspace you were in when you connected: it's listed in that workspace's Connected apps, and it stops if you leave that workspace. Connecting the same app with All my workspaces replaces its other connections, and connecting it to a single workspace replaces an all-workspaces connection. Separate single-workspace connections stay as they are.
To change the workspace or access level, disconnect and sign in again. Revoking the connection in Settings → Connected apps invalidates its current and refresh tokens; cached access-token checks may remain valid for up to five seconds.
Static API keys
Clients that do not support sign-in can still use a workspace API key (acq_org_…) or personal access token (acq_live_…). Create or replace a key. Static keys use granular API scopes; signed-in connections use the two access levels above.
Choose scopes for a static key
| Task | Scopes |
|---|---|
| List workspaces and read campaign results | workspaces:read, campaigns:read |
| Also inspect or export campaign leads | Add campaignLeads:read |
| Create drafts, edit sequences, import supplied leads, preview or run campaign lead searches, launch or pause | Add campaigns:write; use a workspace key |
| Propose filters or preview a standalone lead search | leads:read; use a workspace key |
| Run a paid standalone lead search | leads:search; use a workspace key |
| Read the AI SDR knowledge base | workspaces:read |
| Replace the AI SDR knowledge base | workspaces:write; use a workspace key, or a personal token whose owner is a workspace owner or admin. Signed-in connections cannot do this |
| Register an event webhook | webhooks:write; personal-token users must also be workspace owners or admins |
| Search or read CRM records | The matching people:read, companies:read, deals:read, tasks:read or notes:read scopes; use a workspace key |
| Discover CRM owners, pipelines, stages and fields | members:read, pipelines:read, customFields:read; use a workspace key |
| Create or update CRM records | The matching people:write, companies:write, deals:write, tasks:write or notes:write scopes; use a workspace key |
For standalone lead tools, add workspaces:read only if your assistant also needs to discover or read workspaces. It is not required when you already supply the workspace ID.
CRM MCP is available in every workspace. Connection permissions still limit which tools appear and which actions are allowed. Credential scopes do not bypass the workspace boundary.
campaigns:write includes both drafts and live actions. There is no separate draft-only scope. A free campaign lead preview also requires this write scope, even though the preview itself does not bill or attach leads.
Understand the effect before allowing a change
| Action | Effect |
|---|---|
| Read results or existing leads | Views information without changing the campaign. |
| Generate lead filters or preview matches | Does not run the paid search or spend lead-search credits. |
| Create a draft | Does not launch it. Configured campaign-created automations may run. |
| Execute a lead search | Can spend credits. Campaign searches attach leads; active campaigns can begin contacting those new leads. |
| Import supplied campaign leads | Adds the supplied objects under existing duplicate and capacity rules. An active campaign can begin contacting them. |
| Launch or resume | Starts real outreach and can spend money. |
| Pause | Requests a stop to further sends. Messages already handed off may still be delivered. |
Ask the assistant to show its intended changes before taking action, but do not treat that wording as a security control. Client approval prompts vary. The signed-in access level or static key scopes enforce what the assistant can do.
For paid searches, always use a stable idempotencyKey and keep it for retries. Understand tools and operation status.
Every CRM MCP mutation requires a stable idempotencyKey. Reuse it only for an identical retry. A different logical mutation needs a new key.
Disconnect or revoke access
Remove the server from your client to stop using it there. Revoke a signed-in connection from Settings → Connected apps to stop future requests from that client. For a static key, revoke the key in Acquisity to stop every client using it.
Disconnecting or revoking access does not undo changes, cancel accepted operations or pause campaigns already launched. Pause the campaign separately when that is your intended action.