Team members

List the team roster

Anmeldedaten

API-Key

Berechtigung

Eine vonteam-members.readsupport-access.read

curl "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/members" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameter

Antworten

• 200

  The team roster (role bindings).

  Schema

  ListRoleBindingsResponse

  • membersarray of RoleBindingPflicht

    • emailstringoptional

      Provider profile email when known; never an authorization identifier.

    • display_namestringoptional

      Readable human or service account name when known.

    • kindstringoptional

      Erlaubte Werte: "human""service_account"

    • organization_idstringPflicht

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_idstring or nullPflicht

      null for an organization-level binding.

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • user_refstringPflicht

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • rolestringPflicht

      The binding's role: a built-in role id or the id of one of the organization's custom roles.

      pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

    • statusstringPflicht

      Erlaubte Werte: "active""disabled""removed"

    • created_atstring (date-time)Pflicht

      RFC 3339, second precision, UTC.

    • updated_atstring (date-time)Pflicht

      RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Weiterlesen

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Weiterlesen

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Weiterlesen

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Add (or re-add) a member to the team

Anmeldedaten

API-Key

Berechtigung

team-members.manage

Request-Body

Body bis 1 MiB

curl -X POST "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/members" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "member_ref": "user/onboard/01K7YN2C4D6F8H1K3M5P7R9T0V",
  "role": "user"
}'

Parameter

Request-Body application/json

Antworten

• 200

  The team role binding (status active; the stored role is authoritative on a re-add).

  Schema

  RoleBinding

  • emailstringoptional

    Provider profile email when known; never an authorization identifier.

  • display_namestringoptional

    Readable human or service account name when known.

  • kindstringoptional

    Erlaubte Werte: "human""service_account"

  • organization_idstringPflicht

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstring or nullPflicht

    null for an organization-level binding.

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • user_refstringPflicht

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • rolestringPflicht

    The binding's role: a built-in role id or the id of one of the organization's custom roles.

    pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • statusstringPflicht

    Erlaubte Werte: "active""disabled""removed"

  • created_atstring (date-time)Pflicht

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)Pflicht

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Weiterlesen

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Weiterlesen

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Weiterlesen

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

{
  "organization_id": "acme",
  "team_id": "platform",
  "user_ref": "user/onboard/01K7YN2C4D6F8H1K3M5P7R9T0V",
  "role": "user",
  "status": "active",
  "created_at": "2026-10-14T09:40:00Z",
  "updated_at": "2026-10-14T09:40:00Z",
  "email": "[email protected]",
  "display_name": "Ben Okafor",
  "kind": "human"
}

Change a team member's role

Anmeldedaten

API-Key

Berechtigung

team-members.manage

Request-Body

Body bis 1 MiB

curl -X PATCH "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/members" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "member_ref": "string",
  "role": "string"
}'

Parameter

Request-Body application/json

Antworten

• 200

  The updated team role binding.

  Schema

  RoleBinding

  • emailstringoptional

    Provider profile email when known; never an authorization identifier.

  • display_namestringoptional

    Readable human or service account name when known.

  • kindstringoptional

    Erlaubte Werte: "human""service_account"

  • organization_idstringPflicht

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstring or nullPflicht

    null for an organization-level binding.

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • user_refstringPflicht

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • rolestringPflicht

    The binding's role: a built-in role id or the id of one of the organization's custom roles.

    pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • statusstringPflicht

    Erlaubte Werte: "active""disabled""removed"

  • created_atstring (date-time)Pflicht

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)Pflicht

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Weiterlesen

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Weiterlesen

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Weiterlesen

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

Remove the member named by the query parameter

Anmeldedaten

API-Key

Berechtigung

team-members.manage

curl -X DELETE "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/members?member_ref=<member_ref>" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameter

Antworten

• 200

  The role binding, status removed (the tombstone).

  Schema

  RoleBinding

  • emailstringoptional

    Provider profile email when known; never an authorization identifier.

  • display_namestringoptional

    Readable human or service account name when known.

  • kindstringoptional

    Erlaubte Werte: "human""service_account"

  • organization_idstringPflicht

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstring or nullPflicht

    null for an organization-level binding.

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • user_refstringPflicht

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • rolestringPflicht

    The binding's role: a built-in role id or the id of one of the organization's custom roles.

    pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • statusstringPflicht

    Erlaubte Werte: "active""disabled""removed"

  • created_atstring (date-time)Pflicht

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)Pflicht

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Weiterlesen

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Weiterlesen

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Weiterlesen

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

List eligible members for one team's member picker

Anmeldedaten

API-Key

Berechtigung

team-members.manage

curl "https://console.eu.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/member-candidates" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameter

Antworten

• 200

  Eligible member profiles; candidates is empty when none remain.

  Schema

  TeamMemberCandidates

  • candidatesarray of TeamMemberCandidatePflicht

    • user_refstringPflicht

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • display_namestringPflicht
    • emailstringPflicht
    • kindstringPflicht

      Erlaubte Werte: "human""service_account"

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Weiterlesen

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Weiterlesen

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Weiterlesen

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.