Skip to main content
GET
Get an org security profile
Returns one of the organization’s own security profiles. Enterprise-shared profiles are not returned on this path. See Security profiles for what each restriction does and how profiles are resolved.

Permissions

Requires a service user or personal access token with the ManageSecureModeProfiles permission at the organization level. Tokens used by a running Devin session are rejected, so a session cannot change the profiles that govern it.

Authorizations

Authorization
string
header
required

Service User credential (prefix: cog_)

Path Parameters

profile_id
string
required
org_id
string
required

Organization ID (prefix: org-)

Example:

"org-abc123def456"

Response

Successful Response

An organization-owned security profile.

created_at
integer
required
devin_mcp_read_only
boolean
required

When true, sessions may only call read-only Devin MCP tools (no session creation, automation management, or other write operations).

enforcement_level
enum<string>
required

recommended profiles can be overridden by descendant bindings; mandatory profiles are a floor that descendant policies only narrow.

Available options:
recommended,
mandatory
git_access_level
enum<string>
required
Available options:
read_only,
read_write
name
string
required
org_id
string
required
profile_id
string
required

The security profile's ID.

remove_github_cli_token
boolean
required

When true, the GitHub CLI token is removed from the session's machine, preventing direct GitHub API access.

updated_at
integer
required
mcp_config
SecurityProfileMcpConfig · object | null

null = this profile has no MCP opinion.

net_policy
SecurityProfileNetPolicy · object | null

null = this profile has no network opinion (it does NOT mean deny-all).

slack_channel_access
SecurityProfileSlackChannelAccess · object | null

Ceiling on the Slack channels sessions governed by this profile may read and post in. null = this profile has no opinion and the organization's Slack setting applies.

slack_dm_scope
enum<string> | null

Ceiling on who may DM Devin in Slack under this profile. null = this profile has no opinion and the organization's Slack setting applies. 'workspace' is narrowed to 'org_members' for enterprise accounts.

Available options:
disabled,
org_members,
workspace
teams_channel_access
SecurityProfileTeamsChannelAccess · object | null

Ceiling on the Microsoft Teams channels sessions governed by this profile may read and post in. null = this profile has no opinion and the organization's Teams Default Access applies.

teams_dm_scope
enum<string> | null

Ceiling on who Devin may DM in Microsoft Teams under this profile. null = this profile has no opinion and the organization's Teams Default Access applies.

Available options:
disabled,
installed_users
teams_group_chat_scope
enum<string> | null

Ceiling on which Teams group chats Devin may read under this profile; origin_chat = only the group chat the session was started from; null = no opinion, derived from the org's Teams Default Access like DMs.

Available options:
disabled,
origin_chat