> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devin.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List enterprise security profiles

> List the enterprise's security profiles, shared with every org in the
enterprise. Each org's own profiles are listed on the org paths.

Returns the enterprise's security profiles, paginated. These profiles are shared with every organization in the enterprise; each organization's own profiles are listed with [List org security profiles](https://docs.devin.ai/api-reference/v3/security-profiles/list-organizations-security-profiles.md).

See [Security profiles](https://docs.devin.ai/product-guides/security-profiles.md) for what each restriction does and how profiles are resolved.

## Permissions

Requires a [service user](https://docs.devin.ai/api-reference/v3/service-users/members-service-users.md) or [personal access token](https://docs.devin.ai/api-reference/personal-access-tokens.md) with the `ManageAccountSecureModeProfiles` permission at the enterprise level. Only available on enterprise accounts.


## OpenAPI

````yaml v3-openapi.yaml GET /v3beta1/enterprise/security-profiles
openapi: 3.1.0
info:
  description: Devin v3 API with Service User authentication and RBAC
  title: Devin API v3
  version: 3.0.0
servers: []
security:
  - bearerAuth: []
paths:
  /v3beta1/enterprise/security-profiles:
    get:
      tags:
        - security-profiles
      summary: List enterprise security profiles
      description: |-
        List the enterprise's security profiles, shared with every org in the
        enterprise. Each org's own profiles are listed on the org paths.
      operationId: handle_list_security_profiles_v3beta1_enterprise_security_profiles_get
      parameters:
        - in: query
          name: after
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: After
        - in: query
          name: first
          required: false
          schema:
            default: 100
            maximum: 200
            minimum: 1
            title: First
            type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/PaginatedResponse_EnterpriseSecurityProfileResponse_
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unauthorized
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Not Found
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Conflict
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unprocessable Content
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Too Many Requests
components:
  schemas:
    PaginatedResponse_EnterpriseSecurityProfileResponse_:
      properties:
        end_cursor:
          anyOf:
            - type: string
            - type: 'null'
          description: Cursor to fetch the next page, or None if this is the last page.
          title: End Cursor
        has_next_page:
          default: false
          description: Whether there are more items available after this page.
          title: Has Next Page
          type: boolean
        items:
          items:
            $ref: '#/components/schemas/EnterpriseSecurityProfileResponse'
          title: Items
          type: array
        total:
          anyOf:
            - type: integer
            - type: 'null'
          description: Optional total count (can be omitted for performance).
          title: Total
      required:
        - items
      title: PaginatedResponse[EnterpriseSecurityProfileResponse]
      type: object
    ProblemDetail:
      description: >-
        RFC 9457 application/problem+json error body for the v3 API.


        detail is retained from the legacy {"detail": ...} body for back-compat;
        the

        other members are additive. errors carries field-level validation
        failures

        (422 only).
      properties:
        detail:
          anyOf:
            - type: string
            - type: 'null'
          description: A human-readable explanation specific to this occurrence.
          title: Detail
        error_code:
          anyOf:
            - type: string
            - type: 'null'
          description: >-
            Machine-readable code for blocked-action refusals (e.g.
            "user_frozen", "migrated_session").
          title: Error Code
        errors:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: Field-level validation errors (422 responses only).
          title: Errors
        instance:
          anyOf:
            - type: string
            - type: 'null'
          description: A URI reference (the request path) for this occurrence.
          title: Instance
        status:
          description: The HTTP status code.
          title: Status
          type: integer
        title:
          description: A short, human-readable summary of the problem type.
          title: Title
          type: string
        type:
          default: about:blank
          description: A URI reference identifying the problem type.
          title: Type
          type: string
      required:
        - title
        - status
      title: ProblemDetail
      type: object
    EnterpriseSecurityProfileResponse:
      additionalProperties: false
      description: |-
        An enterprise-owned security profile, shared with every org in the
        enterprise. The owning enterprise is implied by the caller's token.
      properties:
        created_at:
          title: Created At
          type: integer
        devin_mcp_read_only:
          description: >-
            When true, sessions may only call read-only Devin MCP tools (no
            session creation, automation management, or other write operations).
          title: Devin Mcp Read Only
          type: boolean
        enforcement_level:
          description: >-
            recommended profiles can be overridden by descendant bindings;
            mandatory profiles are a floor that descendant policies only narrow.
          enum:
            - recommended
            - mandatory
          title: Enforcement Level
          type: string
        git_access_level:
          enum:
            - read_only
            - read_write
          title: Git Access Level
          type: string
        mcp_config:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileMcpConfig'
            - type: 'null'
          description: null = this profile has no MCP opinion.
        name:
          title: Name
          type: string
        net_policy:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileNetPolicy'
            - type: 'null'
          description: >-
            null = this profile has no network opinion (it does NOT mean
            deny-all).
        profile_id:
          description: The security profile's ID.
          title: Profile Id
          type: string
        remove_github_cli_token:
          description: >-
            When true, the GitHub CLI token is removed from the session's
            machine, preventing direct GitHub API access.
          title: Remove Github Cli Token
          type: boolean
        slack_channel_access:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileSlackChannelAccess'
            - type: 'null'
          description: >-
            Ceiling on the Slack channels sessions governed by this profile may
            read and post in. null = this profile has no opinion and the
            organization's Slack setting applies.
        slack_dm_scope:
          anyOf:
            - enum:
                - disabled
                - org_members
                - workspace
              type: string
            - type: 'null'
          description: >-
            Ceiling on who may DM Devin in Slack under this profile. null = this
            profile has no opinion and the organization's Slack setting applies.
            'workspace' is narrowed to 'org_members' for enterprise accounts.
          title: Slack Dm Scope
        teams_channel_access:
          anyOf:
            - $ref: '#/components/schemas/SecurityProfileTeamsChannelAccess'
            - type: 'null'
          description: >-
            Ceiling on the Microsoft Teams channels sessions governed by this
            profile may read and post in. null = this profile has no opinion and
            the organization's Teams Default Access applies.
        teams_dm_scope:
          anyOf:
            - enum:
                - disabled
                - installed_users
              type: string
            - type: 'null'
          description: >-
            Ceiling on who Devin may DM in Microsoft Teams under this profile.
            null = this profile has no opinion and the organization's Teams
            Default Access applies.
          title: Teams Dm Scope
        teams_group_chat_scope:
          anyOf:
            - enum:
                - disabled
                - origin_chat
              type: string
            - type: 'null'
          description: >-
            Ceiling on which Teams group chats Devin may read under this
            profile; `origin_chat` = only the group chat the session was started
            from; null = no opinion, derived from the org's Teams Default Access
            like DMs.
          title: Teams Group Chat Scope
        updated_at:
          title: Updated At
          type: integer
      required:
        - profile_id
        - name
        - git_access_level
        - enforcement_level
        - devin_mcp_read_only
        - remove_github_cli_token
        - created_at
        - updated_at
      title: EnterpriseSecurityProfileResponse
      type: object
    SecurityProfileMcpConfig:
      additionalProperties: false
      properties:
        servers:
          description: >-
            MCP servers sessions governed by this profile may use, keyed by
            slug: a marketplace slug (the slug field of the mcp-servers
            resource, e.g. 'github', 'notion') or an installation's slug. When a
            custom installation shares a slug with a marketplace server, the
            custom installation wins.
          items:
            type: string
          title: Servers
          type: array
      required:
        - servers
      title: SecurityProfileMcpConfig
      type: object
    SecurityProfileNetPolicy:
      additionalProperties: false
      properties:
        allow:
          description: >-
            Allowed destinations; anything not listed is blocked. Hostname
            entries support wildcards (e.g. *.github.com). An empty list is a
            valid deny-all policy.
          items:
            anyOf:
              - $ref: '#/components/schemas/SecurityProfileHostnameDestination'
              - $ref: '#/components/schemas/SecurityProfileIpv4Destination'
              - $ref: '#/components/schemas/SecurityProfileIpv6Destination'
          title: Allow
          type: array
      required:
        - allow
      title: SecurityProfileNetPolicy
      type: object
    SecurityProfileSlackChannelAccess:
      additionalProperties: false
      properties:
        channels:
          description: >-
            Channels allowed when mode is 'specific'; ignored (and returned
            empty) for the other modes.
          items:
            $ref: '#/components/schemas/SecurityProfileSlackChannel'
          title: Channels
          type: array
        mode:
          description: >-
            none = sessions may not read or post in any channel; specific = only
            the listed channels; all_public = any public channel the Slack app
            is a member of.
          enum:
            - none
            - specific
            - all_public
          title: Mode
          type: string
      required:
        - mode
      title: SecurityProfileSlackChannelAccess
      type: object
    SecurityProfileTeamsChannelAccess:
      additionalProperties: false
      properties:
        channels:
          description: >-
            Channels allowed when mode is 'specific'; ignored (and returned
            empty) for the other modes.
          items:
            $ref: '#/components/schemas/SecurityProfileTeamsChannel'
          title: Channels
          type: array
        mode:
          description: >-
            none = sessions may not read or post in any channel; specific = only
            the listed channels; installed_teams = any channel of a team the
            Devin app is installed in.
          enum:
            - none
            - specific
            - installed_teams
          title: Mode
          type: string
      required:
        - mode
      title: SecurityProfileTeamsChannelAccess
      type: object
    SecurityProfileHostnameDestination:
      additionalProperties: false
      properties:
        hostname:
          title: Hostname
          type: string
      required:
        - hostname
      title: SecurityProfileHostnameDestination
      type: object
    SecurityProfileIpv4Destination:
      additionalProperties: false
      properties:
        ipv4:
          title: Ipv4
          type: string
      required:
        - ipv4
      title: SecurityProfileIpv4Destination
      type: object
    SecurityProfileIpv6Destination:
      additionalProperties: false
      properties:
        ipv6:
          title: Ipv6
          type: string
      required:
        - ipv6
      title: SecurityProfileIpv6Destination
      type: object
    SecurityProfileSlackChannel:
      additionalProperties: false
      properties:
        channel_id:
          description: Slack channel ID.
          minLength: 1
          title: Channel Id
          type: string
        team_id:
          description: Slack workspace (team) ID.
          minLength: 1
          title: Team Id
          type: string
      required:
        - team_id
        - channel_id
      title: SecurityProfileSlackChannel
      type: object
    SecurityProfileTeamsChannel:
      additionalProperties: false
      properties:
        channel_id:
          description: Teams channel ID ('19:...@thread.tacv2').
          minLength: 1
          title: Channel Id
          type: string
        team_id:
          description: Entra group ID of the Microsoft Teams team.
          minLength: 1
          title: Team Id
          type: string
      required:
        - team_id
        - channel_id
      title: SecurityProfileTeamsChannel
      type: object
  securitySchemes:
    bearerAuth:
      description: 'Service User credential (prefix: cog_)'
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.