> ## Documentation Index > Fetch the complete documentation index at: https://docs.devin.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get an org security profile > Get one of the organization's own security profiles by ID. Returns one of the organization's own security profiles. Enterprise-shared profiles are not returned on this path. See [Security profiles](https://docs.devin.ai/product-guides/security-profiles.md) for what each restriction does and how profiles are resolved. ## Permissions Requires a [service user](https://docs.devin.ai/api-reference/v3/service-users/members-service-users.md) or [personal access token](https://docs.devin.ai/api-reference/personal-access-tokens.md) with the `ManageSecureModeProfiles` permission at the organization level. Tokens used by a running Devin session are rejected, so a session cannot change the profiles that govern it. ## OpenAPI ````yaml v3-openapi.yaml GET /v3beta1/organizations/{org_id}/security-profiles/{profile_id} openapi: 3.1.0 info: description: Devin v3 API with Service User authentication and RBAC title: Devin API v3 version: 3.0.0 servers: [] security: - bearerAuth: [] paths: /v3beta1/organizations/{org_id}/security-profiles/{profile_id}: get: tags: - security-profiles summary: Get an org security profile description: Get one of the organization's own security profiles by ID. operationId: >- handle_get_security_profile_v3beta1_organizations__org_id__security_profiles__profile_id__get parameters: - in: path name: profile_id required: true schema: title: Profile Id type: string - description: 'Organization ID (prefix: org-)' in: path name: org_id required: true schema: example: org-abc123def456 title: Org Id type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityProfileResponse' description: Successful Response '401': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Not Found '409': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Conflict '422': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Unprocessable Content '429': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Too Many Requests components: schemas: SecurityProfileResponse: additionalProperties: false description: An organization-owned security profile. properties: created_at: title: Created At type: integer devin_mcp_read_only: description: >- When true, sessions may only call read-only Devin MCP tools (no session creation, automation management, or other write operations). title: Devin Mcp Read Only type: boolean enforcement_level: description: >- recommended profiles can be overridden by descendant bindings; mandatory profiles are a floor that descendant policies only narrow. enum: - recommended - mandatory title: Enforcement Level type: string git_access_level: enum: - read_only - read_write title: Git Access Level type: string mcp_config: anyOf: - $ref: '#/components/schemas/SecurityProfileMcpConfig' - type: 'null' description: null = this profile has no MCP opinion. name: title: Name type: string net_policy: anyOf: - $ref: '#/components/schemas/SecurityProfileNetPolicy' - type: 'null' description: >- null = this profile has no network opinion (it does NOT mean deny-all). org_id: title: Org Id type: string profile_id: description: The security profile's ID. title: Profile Id type: string remove_github_cli_token: description: >- When true, the GitHub CLI token is removed from the session's machine, preventing direct GitHub API access. title: Remove Github Cli Token type: boolean slack_channel_access: anyOf: - $ref: '#/components/schemas/SecurityProfileSlackChannelAccess' - type: 'null' description: >- Ceiling on the Slack channels sessions governed by this profile may read and post in. null = this profile has no opinion and the organization's Slack setting applies. slack_dm_scope: anyOf: - enum: - disabled - org_members - workspace type: string - type: 'null' description: >- Ceiling on who may DM Devin in Slack under this profile. null = this profile has no opinion and the organization's Slack setting applies. 'workspace' is narrowed to 'org_members' for enterprise accounts. title: Slack Dm Scope teams_channel_access: anyOf: - $ref: '#/components/schemas/SecurityProfileTeamsChannelAccess' - type: 'null' description: >- Ceiling on the Microsoft Teams channels sessions governed by this profile may read and post in. null = this profile has no opinion and the organization's Teams Default Access applies. teams_dm_scope: anyOf: - enum: - disabled - installed_users type: string - type: 'null' description: >- Ceiling on who Devin may DM in Microsoft Teams under this profile. null = this profile has no opinion and the organization's Teams Default Access applies. title: Teams Dm Scope teams_group_chat_scope: anyOf: - enum: - disabled - origin_chat type: string - type: 'null' description: >- Ceiling on which Teams group chats Devin may read under this profile; `origin_chat` = only the group chat the session was started from; null = no opinion, derived from the org's Teams Default Access like DMs. title: Teams Group Chat Scope updated_at: title: Updated At type: integer required: - profile_id - name - git_access_level - enforcement_level - devin_mcp_read_only - remove_github_cli_token - created_at - updated_at - org_id title: SecurityProfileResponse type: object ProblemDetail: description: >- RFC 9457 application/problem+json error body for the v3 API. detail is retained from the legacy {"detail": ...} body for back-compat; the other members are additive. errors carries field-level validation failures (422 only). properties: detail: anyOf: - type: string - type: 'null' description: A human-readable explanation specific to this occurrence. title: Detail error_code: anyOf: - type: string - type: 'null' description: >- Machine-readable code for blocked-action refusals (e.g. "user_frozen", "migrated_session"). title: Error Code errors: anyOf: - items: additionalProperties: true type: object type: array - type: 'null' description: Field-level validation errors (422 responses only). title: Errors instance: anyOf: - type: string - type: 'null' description: A URI reference (the request path) for this occurrence. title: Instance status: description: The HTTP status code. title: Status type: integer title: description: A short, human-readable summary of the problem type. title: Title type: string type: default: about:blank description: A URI reference identifying the problem type. title: Type type: string required: - title - status title: ProblemDetail type: object SecurityProfileMcpConfig: additionalProperties: false properties: servers: description: >- MCP servers sessions governed by this profile may use, keyed by slug: a marketplace slug (the slug field of the mcp-servers resource, e.g. 'github', 'notion') or an installation's slug. When a custom installation shares a slug with a marketplace server, the custom installation wins. items: type: string title: Servers type: array required: - servers title: SecurityProfileMcpConfig type: object SecurityProfileNetPolicy: additionalProperties: false properties: allow: description: >- Allowed destinations; anything not listed is blocked. Hostname entries support wildcards (e.g. *.github.com). An empty list is a valid deny-all policy. items: anyOf: - $ref: '#/components/schemas/SecurityProfileHostnameDestination' - $ref: '#/components/schemas/SecurityProfileIpv4Destination' - $ref: '#/components/schemas/SecurityProfileIpv6Destination' title: Allow type: array required: - allow title: SecurityProfileNetPolicy type: object SecurityProfileSlackChannelAccess: additionalProperties: false properties: channels: description: >- Channels allowed when mode is 'specific'; ignored (and returned empty) for the other modes. items: $ref: '#/components/schemas/SecurityProfileSlackChannel' title: Channels type: array mode: description: >- none = sessions may not read or post in any channel; specific = only the listed channels; all_public = any public channel the Slack app is a member of. enum: - none - specific - all_public title: Mode type: string required: - mode title: SecurityProfileSlackChannelAccess type: object SecurityProfileTeamsChannelAccess: additionalProperties: false properties: channels: description: >- Channels allowed when mode is 'specific'; ignored (and returned empty) for the other modes. items: $ref: '#/components/schemas/SecurityProfileTeamsChannel' title: Channels type: array mode: description: >- none = sessions may not read or post in any channel; specific = only the listed channels; installed_teams = any channel of a team the Devin app is installed in. enum: - none - specific - installed_teams title: Mode type: string required: - mode title: SecurityProfileTeamsChannelAccess type: object SecurityProfileHostnameDestination: additionalProperties: false properties: hostname: title: Hostname type: string required: - hostname title: SecurityProfileHostnameDestination type: object SecurityProfileIpv4Destination: additionalProperties: false properties: ipv4: title: Ipv4 type: string required: - ipv4 title: SecurityProfileIpv4Destination type: object SecurityProfileIpv6Destination: additionalProperties: false properties: ipv6: title: Ipv6 type: string required: - ipv6 title: SecurityProfileIpv6Destination type: object SecurityProfileSlackChannel: additionalProperties: false properties: channel_id: description: Slack channel ID. minLength: 1 title: Channel Id type: string team_id: description: Slack workspace (team) ID. minLength: 1 title: Team Id type: string required: - team_id - channel_id title: SecurityProfileSlackChannel type: object SecurityProfileTeamsChannel: additionalProperties: false properties: channel_id: description: Teams channel ID ('19:...@thread.tacv2'). minLength: 1 title: Channel Id type: string team_id: description: Entra group ID of the Microsoft Teams team. minLength: 1 title: Team Id type: string required: - team_id - channel_id title: SecurityProfileTeamsChannel type: object securitySchemes: bearerAuth: description: 'Service User credential (prefix: cog_)' scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.