Execute custom LinkedIn request (escape hatch)
ESCAPE HATCH: issue one arbitrary LinkedIn HTTP call (url + GET/POST + headers/body) under a chosen OWN account, for endpoints the typed methods do not cover. May be a read or an action (apply to a job, attend an event), so you own the semantics. High-risk: admin-gated + feature-flagged; the url must match the server host allowlist (else 403 forbidden_endpoint). OWN-ACCOUNT ONLY: linkedin_account_sid is REQUIRED, no pool fallback. Non-creditable: 0 credits, but it spends the account’s custom_request bucket, which returns 429 when saturated. A non-2xx response is still a successful dispatch (ok=false, status_code carries it; never throws). The response comes back inline, NOT stored; the audit is the linkedin-account-activity-log row (action_type=custom_request). PREFER TYPED METHODS FIRST: searches/lists → linkedin-scraping; one profile/company/post’s own data → linkedin-enrichment; sends/invites/reactions/comments → messaging & networking. Never use it to route around a rate limit or a missing permission.
Contract:
- MCP tool
execute_linkedin_custom_request, registry packagemcp.linkedin/linkedin_custom_requests, mountlinkedin.platform. - Operation
action, response envelopeaction. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.
Authorizations
Access token issued by gtm.service.id. Its access_identity claim carries team_sid, actor_sid and actor_type, and that team scope is authoritative.
Team scope for tokens that do not carry one. Ignored when the token already names a team.
Body
Request body of execute_linkedin_custom_request.
REQUIRED executor: the OWN account (ln_ac_…) the call runs on. There is NO pool fallback (an arbitrary call must never run under a shared infra account).
18^ln_ac_Absolute LinkedIn URL (e.g. "https://www.linkedin.com/voyager/api/…") or a bare path (resolved against https://www.linkedin.com). MUST match the server host + path allowlist (provisional: *.linkedin.com + path prefixes /voyager/api/, /sales-api/). Otherwise 403 forbidden_endpoint.
1 - 2048HTTP verb, default GET. Write-shaped verbs (PUT/DELETE/PATCH) are out of scope at launch (SAFETY).
GET, POST Extra request headers merged onto the default voyager headers.
POST JSON body (object → JSON-encoded) or raw string (passed through); ≤ 50 KB serialized; null/omitted for GET.
Modifier: when true, send body as application/x-www-form-urlencoded (NOT a separate body). POST only.
Inject the plugin's default voyager headers (default true); false to send only headers.