Users

List the users holding a membership of an organization

Credencial

API key

Permiso

users.read

curl "https://console.latam.ccsio.ai/identity/v1/users?org=<org>" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The users holding a membership of the organization.

  Esquema

  ListUsersResponse

  • usersarray of Userobligatorio

    • user_idstringobligatorio

      The platform-minted id (a ULID in practice).

      1 to 128 characters

    • issuerstringobligatorio

      The identity issuer; for a service account minted here, a platform-internal reference.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • subjectstringobligatorio

      The subject at that issuer.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • user_refstringobligatorio

      The reference every membership, key and event names this user by.

      pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

    • emailstringobligatorio

      The email address; empty when the identity has none (a service account never has one). At most 254 bytes.

      at most 254 characters

    • display_namestringobligatorio

      The display name; at most 128 bytes.

      at most 128 characters

    • kindstringobligatorio

      Valores permitidos: "human""service_account"

    • statusstringobligatorio

      Valores permitidos: "active""disabled"

    • created_atstring (date-time)obligatorio

      RFC 3339, second precision, UTC.

    • updated_atstring (date-time)obligatorio

      RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

Create a service-account identity with server-generated identifiers

Credencial

API key

Permiso

users.manage

Cuerpo de la solicitud

Cuerpo de hasta 1 MiB

curl -X POST "https://console.latam.ccsio.ai/identity/v1/users" \
  -H "Authorization: Bearer $CCSIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "kind": "service_account",
  "display_name": "string"
}'

Parámetros

Cuerpo de la solicitud application/json

Respuestas

• 200

  The new service account, with its generated issuer, subject and user_ref.

  Esquema

  User

  • user_idstringobligatorio

    The platform-minted id (a ULID in practice).

    1 to 128 characters

  • issuerstringobligatorio

    The identity issuer; for a service account minted here, a platform-internal reference.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • subjectstringobligatorio

    The subject at that issuer.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • user_refstringobligatorio

    The reference every membership, key and event names this user by.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • emailstringobligatorio

    The email address; empty when the identity has none (a service account never has one). At most 254 bytes.

    at most 254 characters

  • display_namestringobligatorio

    The display name; at most 128 bytes.

    at most 128 characters

  • kindstringobligatorio

    Valores permitidos: "human""service_account"

  • statusstringobligatorio

    Valores permitidos: "active""disabled"

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  A verified credential is required.

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The caller is not a platform service credential (membership-forbidden), or asked for a human account (identity-managed-by-provider).

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

Read one user

Credencial

API key

Permiso

users.read

curl "https://console.latam.ccsio.ai/identity/v1/users/{id}" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 200

  The user.

  Esquema

  User

  • user_idstringobligatorio

    The platform-minted id (a ULID in practice).

    1 to 128 characters

  • issuerstringobligatorio

    The identity issuer; for a service account minted here, a platform-internal reference.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • subjectstringobligatorio

    The subject at that issuer.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • user_refstringobligatorio

    The reference every membership, key and event names this user by.

    pattern ^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$

  • emailstringobligatorio

    The email address; empty when the identity has none (a service account never has one). At most 254 bytes.

    at most 254 characters

  • display_namestringobligatorio

    The display name; at most 128 bytes.

    at most 128 characters

  • kindstringobligatorio

    Valores permitidos: "human""service_account"

  • statusstringobligatorio

    Valores permitidos: "active""disabled"

  • created_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

  • updated_atstring (date-time)obligatorio

    RFC 3339, second precision, UTC.

• 400

  Client refusal unrelated to authentication, including malformed input, a denied or failed request.

• 401

  The request carries no credential, more than one, or one the platform does not accept, and is refused before the operation runs; `error.code` says why. Supply exactly one credential. Codes: invalid-request (no credential, or both Authorization:

  Leer más

  Bearer and x-api-key), api-key-invalid (a value that is not a platform API key, or a key of a kind the platform does not accept), api-key-unknown, api-key-revoked, api-key-expired, bootstrap-disabled (the one-shot installation credential, once a key exists), token-malformed (a bearer token that is not a JWT), token-algorithm-unsupported, token-signature-invalid, token-claim-invalid, token-issuer-mismatch, token-audience-mismatch, token-expired, token-not-yet-valid, issuer-untrusted, issuer-residency-mismatch (the issuer belongs to another plane), issuer-resolution-unknown, jwks-unavailable, jwks-key-not-found, staff-token-inactive (a platform operator's token), staff-not-operator, staff-directory-unavailable, identity-not-provisioned (a verified identity with no account on this plane), organization-not-found (a verified identity or key whose organization this plane does not know), internal-error (a fault while the credential is checked is refused too, fail closed), context-cancelled

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  The credential is valid but may not do this here; the request is refused by the request boundary before the handler runs, and `error.code` says which refusal. An operation may add codes of its own.

  Leer más

  Codes: policy-denied (no role of the caller holds the permission the operation needs, or the credential class may not call it: a personal API key outside inference and MCP, a route that needs a signed-in person, the one-shot installation credential outside its three steps), tenant-mismatch (the organization a path, query, body or X-Tenant header names is not the caller's own), organization-provisioning, organization-suspended, organization-disabled, organization-deleted (the state of the caller's organization), user-disabled, residency-mismatch (the organization lives on another plane), organization-selection-required (a caller with more than one organization, or a platform operator, must name one in X-Organization-Id), organization-not-selectable, no-active-organization-membership, team-not-selectable (the X-Organization-Id or X-Team-Id the caller sent does not name an organization or team it may act in), identity-managed-by-provider (a person who is not a platform operator changes an organization's status, which belongs to the identity provider), support-session-required (a platform operator reads an organization's data without an open support session)

• 404

  The requested resource or path was not found.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

Disable a user (always refused)

Credencial

API key

Permiso

users.manage

curl -X POST "https://console.latam.ccsio.ai/identity/v1/users/{id}/disable" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 401

  A verified credential is required.

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  identity-managed-by-provider: manage the global account at the identity provider.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.

Enable a user (always refused)

Credencial

API key

Permiso

users.manage

curl -X POST "https://console.latam.ccsio.ai/identity/v1/users/{id}/enable" \
  -H "Authorization: Bearer $CCSIO_API_KEY"

Parámetros

Respuestas

• 401

  A verified credential is required.

• 402

  The organization has to pay first: its standing is payment_required.

  Leer más

  The request boundary applies this payment gate to every route except an organization's billing routes, the caller's own context, organization list, onboarding, session report and personal keys, the public routes, and the routes of platform operators, who administer an organization that has to pay. The operations the gate covers declare this response. On /v1 the refusal is rendered in the OpenAI error format. Code: payment-required

• 403

  identity-managed-by-provider: manage the global account at the identity provider.

• 405

  The path is claimed but the request method is not allowed. Go ServeMux returns its standard plain-text response and lists permitted methods in Allow.

• 500

  Platform failure, rendered without internal cause details.