admin operations

The exact fields each admin.* operation takes and returns.

Every op is POST /v1/<op> over HTTP and the MCP tool loom_<op>. The identity fields (org, namespace, agent, user_id, session_id) are filled from the token and the MCP session when a transport can; for an HTTP call with no token on a single-user server, the install's org on every op but code.* and tracker.* (which keep their plane's), and on some ops its namespace and agent; see identities and namespaces. The operations index explains role, kind and the MCP all listing. Unknown input fields are served and named in ignored_args.

admin.users

Aggregate subjects from namespace_grants + namespaces.owner_email, join in last-active from the audit log, mark configured platform admins.

POST /v1/admin.users · MCP loom_admin_users · role org_admin · idempotent · not listed under the MCP all toolset

Input field	Type	Default	Meaning
org	str	required	The tenant (first element of the identity tuple).
namespace	str \| None	None	The namespace the op reads or writes.
include_service_accounts	bool	False	Also list subjects with neither a contact email nor a password (service accounts); off, they are left out.
limit	int	200	At most this many users, in subject order; 1 to 1,000.

Output field	Type	Meaning
users	list[UserSummary]	The page of users in subject order, each with its grants and owned namespaces.
total	int	Users matching the filters before limit was applied.
total_pending_elevations	int	Grants on this page with an unapproved elevation request.
total_active_last_7d	int	Users on this page with an audit row in the last 7 days.
platform_admins_configured	list[str]	The configured platform-admin identities, sorted; empty unless the caller is a platform admin (or auth is off).