Teams

The descriptions of the operations and fields are the contract’s own, in English.

GET/identity/v1/organizations/{org}/teams

List the organization's teams

Credential: API key
Permission: Any ofteams.read_ownteams.readsupport-access.read

Lists the organization's teams deterministic by team id. Open to teams.read_own at any level or teams.read.

WHICH teams: a caller holding teams.read at organization level (or at platform level) sees every team of the organization; any other caller sees only the teams where it has an active team-level role binding (a User or a Team Admin whose only role is a team's sees its own teams). include_archived=true includes archived teams for the first kind of caller; a binding in an archived team authorizes nothing, so the second kind never sees one. Each item is a TeamDetail (the create response's fields plus slug, status and updated_at) and carries member_count, the number of distinct principals with an active team-level role binding in the team, read with the list in one statement.

curl

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` required	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`include_archived` optional	query	string Optional. true includes archived teams in the list; any other value, or leaving the parameter out, leaves them out (no value is refused).

Responses

200
The team list (TeamDetail items).
Schema
ListTeamsResponseDetail
teamsarray of TeamDetailrequired
org_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringrequired
1 to 128 characters
slugstringrequired
Organization-scoped unique; defaults to team_id at creation.
pattern ^[a-z][a-z0-9._-]{0,63}$
statusstringrequired
Allowed values: "active""archived"
member_countintegerrequired
The number of distinct principals holding an active team-level role binding in the team.
at least 0
created_atstring (date-time)required
RFC 3339, second precision, UTC.
updated_atstring (date-time)required
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.
503
A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

POST/identity/v1/organizations/{org}/teams

Create a team in the organization

Credential: API key
Permission: teams.create
Request body: Body up to 1 MiB

team_id and name are both required. Idempotency: a duplicate (org, team) carrying the same name returns the stored team (200); a different name is 400 team-conflict.

curl

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "team_id": "platform",
  "name": "Platform"
}'

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` required	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Request body application/json

CreateTeamRequest

team_idstringrequired
The team id (C7 identifier).
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringrequired
The team name.
1 to 128 characters

Responses

200
The team view.
Schema
Team
org_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringrequired
1 to 128 characters
created_atstring (date-time)required
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

Example response

{
  "org_id": "acme",
  "team_id": "platform",
  "name": "Platform",
  "created_at": "2026-10-14T09:12:00Z"
}

GET/identity/v1/organizations/{org}/teams/{team}

Read one team

Credential: API key
Permission: Any ofteams.readsupport-access.read

Returns one team of the organization with its member_count (the number of distinct principals holding an active team-level role binding in it). An unknown organization or team is 404 team-not-found: the lookup cannot tell them apart.

curl

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` required	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`team` required	path	string The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Responses

200
The team detail view.
Schema
TeamDetail
org_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringrequired
1 to 128 characters
slugstringrequired
Organization-scoped unique; defaults to team_id at creation.
pattern ^[a-z][a-z0-9._-]{0,63}$
statusstringrequired
Allowed values: "active""archived"
member_countintegerrequired
The number of distinct principals holding an active team-level role binding in the team.
at least 0
created_atstring (date-time)required
RFC 3339, second precision, UTC.
updated_atstring (date-time)required
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.
503
A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

PATCH/identity/v1/organizations/{org}/teams/{team}

Rename a team

Credential: API key
Permission: teams.update
Request body: Body up to 1 MiB

Renames the team. name is required and non-empty (1 to 128 bytes of UTF-8).

curl

curl -X PATCH "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string"
}'

Built from the schema’s required members: replace the values.

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` required	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`team` required	path	string The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Request body application/json

PatchTeamRequest

namestringrequired
The new team name, 1 to 128 bytes of UTF-8 (a multi-byte character counts for each of its bytes).
1 to 128 characters

Responses

200
The updated team detail view.
Schema
TeamDetail
org_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringrequired
1 to 128 characters
slugstringrequired
Organization-scoped unique; defaults to team_id at creation.
pattern ^[a-z][a-z0-9._-]{0,63}$
statusstringrequired
Allowed values: "active""archived"
member_countintegerrequired
The number of distinct principals holding an active team-level role binding in the team.
at least 0
created_atstring (date-time)required
RFC 3339, second precision, UTC.
updated_atstring (date-time)required
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

POST/identity/v1/organizations/{org}/teams/{team}/archive

Archive a team

Credential: API key
Permission: teams.archive

Idempotent: archiving an already-archived team returns it unchanged. An archived team takes no new members (adding one, or reading the member candidates, answers 409 team-archived) and is left out of the default team list (include_archived=true brings it back).

curl

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/archive" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` required	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`team` required	path	string The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Responses

200
The team detail view, status archived.
Schema
TeamDetail
org_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringrequired
1 to 128 characters
slugstringrequired
Organization-scoped unique; defaults to team_id at creation.
pattern ^[a-z][a-z0-9._-]{0,63}$
statusstringrequired
Allowed values: "active""archived"
member_countintegerrequired
The number of distinct principals holding an active team-level role binding in the team.
at least 0
created_atstring (date-time)required
RFC 3339, second precision, UTC.
updated_atstring (date-time)required
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

POST/identity/v1/organizations/{org}/teams/{team}/unarchive

Unarchive a team

Credential: API key
Permission: teams.archive

Idempotent, symmetric with archive.

curl

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/teams/{team}/unarchive" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parameters

Name	In	Description
`X-Request-ID` optional	header	string Optional request ULID. A valid ULID (upper or lowercase) is honored; when the header is absent or invalid, the runtime mints the id. The response X-Request-ID header carries the canonical uppercase form.
`org` required	path	string The organization id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.
`team` required	path	string The team id (C7 identifier). A value outside the pattern is refused with 400 name-invalid.

Responses

200
The team detail view, status active.
Schema
TeamDetail
org_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
team_idstringrequired
pattern ^[a-z][a-z0-9._-]{0,63}$
namestringrequired
1 to 128 characters
slugstringrequired
Organization-scoped unique; defaults to team_id at creation.
pattern ^[a-z][a-z0-9._-]{0,63}$
statusstringrequired
Allowed values: "active""archived"
member_countintegerrequired
The number of distinct principals holding an active team-level role binding in the team.
at least 0
created_atstring (date-time)required
RFC 3339, second precision, UTC.
updated_atstring (date-time)required
RFC 3339, second precision, UTC.
400
Client refusal unrelated to authentication, including malformed input, a denied or failed request.
401
The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:
Read more
Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled
402
The organization has to pay first: its standing is payment_required.
Read more
The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required
403
The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.
Read more
Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)
404
The requested resource or path was not found.
405
The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.
500
Platform failure, rendered without internal cause details.

Generated from the platform contracts at commit 5f833620.

List the organization's teams

Parameters

Responses

Create a team in the organization

Parameters

Request body application/json

Responses

Read one team

Parameters

Responses

Rename a team

Parameters

Request body application/json

Responses

Archive a team

Parameters

Responses

Unarchive a team

Parameters

Responses

Get your first API key