carto-manage-platform

Org-level operations: managing users and invitations, monitoring quotas, auditing activity, and superadmin bulk ops on resources. Most of these require Admin or Superadmin role; non-admin users will see permission errors.

Access-path routing. With the CARTO MCP server attached over OAuth, route interactive single-item admin to MCP: manage_users (list/invite/role/delete-with-handoff), manage_api_access_tokens, manage_oauth_clients, manage_connections, organize_projects, admin_carto / admin_carto_customizations (org config + stats), export_activity_data, superadmin_carto_resources (cross-user resource listing), and delete for single-resource removal (kind: map|workflow|connection|token|oauth_client|project_item). These admin tools are hidden on token-authenticated MCP sessions (read/discovery subset only) — reconnect over OAuth or fall back to the CLI. Stays CLI: bulk/scripted deletes (admin batch-delete), ownership transfer (admin transfer), and local DuckDB analysis over exported activity data. Detection signals: carto-basics/references/access-paths.md.

When to use this skill

• Provisioning or removing team members.
• Auditing who did what (security review, debugging unexpected changes).
• Monitoring API and LDS quota consumption.
• Rotating ownership of orphaned resources after a user leaves.
• Bulk-deleting test resources.

For querying activity data interactively (the exploratory side), use carto-query-datawarehouse/references/activity-queries.md. This skill is for the operational/admin surface around activity data.

Quick reference

Interactive single-item admin (MCP over OAuth): manage_users, manage_api_access_tokens, manage_oauth_clients, manage_connections, admin_carto, delete. CLI covers everything below and is the fallback on token sessions or headless/scripted runs.