Members

List organization-level members

Credencial

API key

Permiso

Cualquiera demembers.readsupport-access.read

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/members" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The organization-level roster.

  Esquema

  ListRoleBindingsResponse

  • membersarray of RoleBindingobligatorio

    • emailstringopcional

      Provider profile email when known; never an authorization identifier.

    • display_namestringopcional

      Readable human or service account name when known.

    • kindstringopcional

      Valores permitidos: "human""service_account"

    • organization_idstringobligatorio

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_idstring or nullobligatorio

      null for an organization-level binding.

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • user_refstringobligatorio

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • rolestringobligatorio

      The binding's role: a built-in role id or the id of one of the organization's custom roles.

      pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

    • statusstringobligatorio

      Valores permitidos: "active""disabled""removed"

    • created_atstring (date-time)obligatorio

      RFC 3339, second precision, UTC.

    • updated_atstring (date-time)obligatorio

      RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Add (or re-activate) an organization-level member

Credencial

API key

Permiso

members.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/members" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "user_ref": "user/onboard/01K7YN2C4D6F8H1K3M5P7R9T0V",
  "role": "organization_admin"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The added or re-activated organization-level role binding.

  Esquema

  RoleBinding

  • emailstringopcional

    Provider profile email when known; never an authorization identifier.

  • display_namestringopcional

    Readable human or service account name when known.

  • kindstringopcional

    Valores permitidos: "human""service_account"

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstring or nullobligatorio

    null for an organization-level binding.

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • user_refstringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • rolestringobligatorio

    The binding's role: a built-in role id or the id of one of the organization's custom roles.

    pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • statusstringobligatorio

    Valores permitidos: "active""disabled""removed"

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

{
  "organization_id": "acme",
  "team_id": null,
  "user_ref": "user/onboard/01K7YN2C4D6F8H1K3M5P7R9T0V",
  "role": "organization_admin",
  "status": "active",
  "created_at": "2026-10-14T09:40:00Z",
  "updated_at": "2026-10-14T09:40:00Z",
  "email": "[email protected]",
  "display_name": "Ben Okafor",
  "kind": "human"
}

Change an organization-level member's role

Credencial

API key

Permiso

members.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X PATCH "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/members" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "user_ref": "string",
  "role": "string"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The updated organization-level role binding.

  Esquema

  RoleBinding

  • emailstringopcional

    Provider profile email when known; never an authorization identifier.

  • display_namestringopcional

    Readable human or service account name when known.

  • kindstringopcional

    Valores permitidos: "human""service_account"

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstring or nullobligatorio

    null for an organization-level binding.

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • user_refstringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • rolestringobligatorio

    The binding's role: a built-in role id or the id of one of the organization's custom roles.

    pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • statusstringobligatorio

    Valores permitidos: "active""disabled""removed"

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

Remove an organization-level member

Credencial

API key

Permiso

members.manage

curl -X DELETE "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/members?user_ref=<user_ref>" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The removed (tombstoned) role binding.

  Esquema

  RoleBinding

  • emailstringopcional

    Provider profile email when known; never an authorization identifier.

  • display_namestringopcional

    Readable human or service account name when known.

  • kindstringopcional

    Valores permitidos: "human""service_account"

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstring or nullobligatorio

    null for an organization-level binding.

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • user_refstringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • rolestringobligatorio

    The binding's role: a built-in role id or the id of one of the organization's custom roles.

    pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • statusstringobligatorio

    Valores permitidos: "active""disabled""removed"

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

Add a human member by email

Credencial

El token de una persona con sesión iniciada (consola)

Permiso

members.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/member-invitations" \
  -H "Authorization: Bearer $CCSIO_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "request_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "email": "[email protected]",
  "display_name": "Ben Okafor",
  "role": "user"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The member's role binding and the outcome: member_added (membership confirmed, no setup email claimed) or invitation_sent (the provider accepted the setup email).

  Esquema

  MemberInvitationResponse

  • statusstringobligatorio

    member_added confirms membership without claiming a setup email; invitation_sent confirms provider acceptance of the invitation email.

    Valores permitidos: "member_added""invitation_sent"

  • memberobjectobligatorio

    A role binding as every member route renders it: the member's role in the organization (team_id null) or in one team, and whether the binding is active, blocked (disabled) or removed. The profile members (email, display_name, kind) are left out when the identity has no profile.

    • emailstringopcional

      Provider profile email when known; never an authorization identifier.

    • display_namestringopcional

      Readable human or service account name when known.

    • kindstringopcional

      Valores permitidos: "human""service_account"

    • organization_idstringobligatorio

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • team_idstring or nullobligatorio

      null for an organization-level binding.

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • user_refstringobligatorio

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • rolestringobligatorio

      The binding's role: a built-in role id or the id of one of the organization's custom roles.

      pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

    • statusstringobligatorio

      Valores permitidos: "active""disabled""removed"

    • created_atstring (date-time)obligatorio

      RFC 3339, second precision, UTC.

    • updated_atstring (date-time)obligatorio

      RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The invitation conflicts with the request or with the current identity or membership state, or needs a seat the organization does not have. No provider account details are disclosed. Codes: member-invitation-conflict, seat-confirmation-required, seat-limit-reached, organization-identity-unlinked (the organization is not linked to the identity provider, so new people cannot be invited by e-mail; action: ask a platform operator to link the organization)

• 500

  Platform failure, rendered without internal cause details.

• 503

  Provider identity or notification delivery could not be confirmed, or invitations are unavailable. Retry with the original request_id and body. Codes: organization-identity-unavailable (the link to the identity provider cannot be read, or belongs to another issuer), onboarding-unavailable (the plane has no identity provider)

{
  "status": "invitation_sent",
  "member": {
    "organization_id": "acme",
    "team_id": null,
    "user_ref": "user/onboard/01K7YN2C4D6F8H1K3M5P7R9T0V",
    "role": "user",
    "status": "active",
    "created_at": "2026-10-14T09:50:00Z",
    "updated_at": "2026-10-14T09:50:00Z",
    "email": "[email protected]",
    "display_name": "Ben Okafor",
    "kind": "human"
  }
}

Block an organization member

Credencial

API key

Permiso

members.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/members/block" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "user_ref": "string"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The member's membership, now disabled.

  Esquema

  MemberBinding

  • emailstringopcional

    Provider profile email when known; never an authorization identifier.

  • display_namestringopcional

    Readable human or service account name when known.

  • kindstringopcional

    Valores permitidos: "human""service_account"

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstring or nullobligatorio

    null for an organization-level binding.

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • user_refstringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • rolestringobligatorio

    The binding's role: a built-in role id or the id of one of the organization's custom roles.

    pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • statusstringobligatorio

    Valores permitidos: "active""disabled""removed"

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

Unblock an organization member

Credencial

API key

Permiso

members.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/members/unblock" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "user_ref": "string"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The member's membership, now active.

  Esquema

  MemberBinding

  • emailstringopcional

    Provider profile email when known; never an authorization identifier.

  • display_namestringopcional

    Readable human or service account name when known.

  • kindstringopcional

    Valores permitidos: "human""service_account"

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstring or nullobligatorio

    null for an organization-level binding.

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • user_refstringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • rolestringobligatorio

    The binding's role: a built-in role id or the id of one of the organization's custom roles.

    pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • statusstringobligatorio

    Valores permitidos: "active""disabled""removed"

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

Move a member to another organization

Credencial

API key

Permiso

members.transfer

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/members/transfer" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "user_ref": "string",
  "target_org": "string"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The member's new, active organization-level membership in the target organization.

  Esquema

  MemberBinding

  • emailstringopcional

    Provider profile email when known; never an authorization identifier.

  • display_namestringopcional

    Readable human or service account name when known.

  • kindstringopcional

    Valores permitidos: "human""service_account"

  • organization_idstringobligatorio

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • team_idstring or nullobligatorio

    null for an organization-level binding.

    pattern ^[a-z][a-z0-9._-]{0,63}$

  • user_refstringobligatorio

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • rolestringobligatorio

    The binding's role: a built-in role id or the id of one of the organization's custom roles.

    pattern ^(ccsio_admin|root|organization_admin|team_admin|user|role_[a-z0-9_]{1,59})$

  • statusstringobligatorio

    Valores permitidos: "active""disabled""removed"

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

List the organizations a member may be moved to

Credencial

API key

Permiso

members.transfer

curl "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/members/transfer-targets" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The organizations the caller may move a member to.

  Esquema

  TransferTargetsResponse

  • organizationsarray of TransferTargetobligatorio

    • organization_idstringobligatorio

      pattern ^[a-z][a-z0-9._-]{0,63}$

    • display_namestringobligatorio

      1 to 128 characters

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Email a member a link to set a new password

Credencial

API key

Permiso

members.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/members/password-reset" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "user_ref": "string"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 202

  The identity provider was asked to email the member the link.

  Esquema

  MemberNotice

  • user_refstringobligatorio

    The member's C0 ref.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • sentbooleanobligatorio

    Always true: the identity provider was asked to send the email. It does not say the person received or followed it.

    Valores permitidos: true

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)

Send a member's invitation again

Credencial

API key

Permiso

members.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/organizations/{org}/member-invitations/resend" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "user_ref": "string"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 202

  The identity provider was asked to send the invitation again.

  Esquema

  MemberNotice

  • user_refstringobligatorio

    The member's C0 ref.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • sentbooleanobligatorio

    Always true: the identity provider was asked to send the email. It does not say the person received or followed it.

    Valores permitidos: true

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 409

  The request conflicts with the current state of the resource or with an invariant it protects (a taken name, a role still in use, an organization that must not be deleted, an archived team, the last active root, a seat or service account limit).

• 500

  Platform failure, rendered without internal cause details.

• 503

  A dependency the operation needs is not configured on this plane or could not be reached, and nothing was changed. `error.code` names it; an operation lists the ones it can answer besides the boundary's. Retry later. Codes: support-audit-unavailable (the request boundary: an operator's read under an open support session could not be recorded, so nothing was served)