Programmatic access

When MCP access is released, an organization owner will manage connections from Settings, then API & MCP in the web dashboard. The connection will act within your organization and only with the permissions you grant. Connection management will not be available in the mobile app.

​

Choose what your assistant may do

Reading, creating and editing records will be separate permissions. A tool appearing in a compatible client’s catalogue will not grant additional access by itself.

• Read permissions will cover the record types you choose, including contacts, requests, documents, appointments and accepted Recurring services.
• Contact editing will need contacts.write as well as contacts.read. Saved address changes will use the same guarded contact update.
• Invoice and job editing will need documents.update plus the matching document read permission. An existing documents.write grant will not acquire those edit capabilities.
• Appointment changes will need visits.write, visits.read and contacts.read.
• Recurring job booking will need service_plans.book, service_plans.read, jobs.read and contacts.read.
• Initial and change-proposal drafts will need the applicable document and service_plans.proposals.write permissions. Preparing a draft will not activate recurring terms.
• Financial reporting will remain read-only. Separately authorized invoice edits may change an unpaid balance. The owner-only payments.write permission will record a payment already received outside ShineCRM, rather than charge a card or issue a refund.

Existing credentials will keep their existing grants. New permissions added to Full operations will apply to future grants. An owner will need to approve any additional authority explicitly. The MCP server guide explains the planned tools and exact permission combinations.

​

Review changes before saving

Your assistant will need to find and read the exact record before editing it. It will return the revision from that read with the update. If the record changes in the meantime, ShineCRM will reject the stale edit instead of overwriting the newer version. Omitted fields will be preserved. A supplied invoice or job line list will replace that complete list, so existing line identities will need to be retained. A notes or due-date edit will not reprice unchanged invoice lines. After an uncertain response, the assistant will need to read and reconcile the saved record before retrying. Creation operations that use an idempotency key will require the same key and identical input for a retry.

​

Understand the customer effects

Scheduling, recurring booking and lifecycle changes can run existing customer reminders, staff notifications, Google Calendar sync and completion review requests. These effects will follow the applicable organization settings and safeguards and may use messaging or AI allowances. An unpaid invoice price edit will coordinate with existing checkout and payment activity. Older open checkout terms will be retired before they can collect a replaced price. A submitted or processing payment will need a definite outcome before a conflicting edit completes. Your customer will keep the same invoice portal link and review updated payment details when needed. Editing will not create a charge, refund, credit or write-off. Recording an already-received manual payment may send the existing standard receipt when the invoice settles.

​

Keep access under your control

An owner will need to accept the connected-agent acknowledgement before granting access. You will choose the scope of each connection. You will be able to revoke one connection or disable external access for the organization.

​

Keep sending approval separate

Permission to edit a record or prepare a proposal will not approve a separate send. Before asking an assistant to send an email on your behalf, approve its exact subject and body and every To, Cc and Bcc recipient. Customer SMS will use separate prepare and approve-and-queue permissions. Neither will be included in a preset. Preparing a proposal for up to 10 recipients will not queue messages. An owner-authorized second call will need to approve the exact unchanged recipients and message bodies before they are queued. Existing consent, opt-out, quiet-hours and messaging safeguards will still apply. Frequently asked Will an assistant be able to charge a card or issue a refund? No. Authorized invoice edits will be able to change an unpaid balance, and the manual payment tool will record money already received. Neither will take or return money. Will a draft proposal immediately change Recurring services? No. Existing customer acceptance will remain the activation step. What if a team member leaves? An owner will be able to revoke their related connection from Settings, then API & MCP.