Spec revisions

openapi.yaml · source b826f2a

Added (1)

• POST /users/{id}/sessions/revoke-all Revoke every session (self or users.manage)

Changed (1)

• GET /users parameters added: query:role_id; description

openapi.yaml · source 2b62498

Whole API

• Schemas added: AuditExportRequest, AuditExport

Added (2)

• POST /audit-exports Export Audit Events to a file (asynchronous)
• GET /audit-exports/{id} Fetch an export's status, and its download link once ready

openapi.yaml · source 87741be

Changed (2)

• POST /applications responses added: 429; summary; description
• POST /auth/app-tokens description

openapi.yaml · source db02d07

Changed (5)

• POST /auth/mfa/verify responses added: 403
• POST /auth/signup schema or examples
• POST /auth/token/refresh responses added: 403
• POST /users schema or examples
• PATCH /users/{id} schema or examples

openapi.yaml · source f66cb8d

Whole API

• Substratal-Version header declared (versions: 1)
• Schemas added: ScimToken

Added (3)

• DELETE /organizations/{id}/scim-token Turn SCIM off for the Organization
• GET /organizations/{id}/scim-token Show the Organization's SCIM token (never its secret)
• POST /organizations/{id}/scim-token Create (or rotate) the Organization's SCIM token

Changed (116)

• GET /api-keys parameters added: $ref:ApiVersion; responses added: 400
• POST /api-keys parameters added: $ref:ApiVersion; responses added: 400
• DELETE /api-keys/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /api-keys/{id} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /api-keys/{id} parameters added: $ref:ApiVersion; responses added: 400
• POST /api-keys/{id}/rotate parameters added: $ref:ApiVersion; responses added: 400
• GET /applications parameters added: $ref:ApiVersion; responses added: 400
• POST /applications parameters added: $ref:ApiVersion; responses added: 400
• GET /applications/{id} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /applications/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /applications/{id}/push-credentials parameters added: $ref:ApiVersion; responses added: 400
• POST /applications/{id}/push-credentials parameters added: $ref:ApiVersion
• DELETE /applications/{id}/push-credentials/{provider} parameters added: $ref:ApiVersion
• GET /applications/{id}/push-credentials/{provider} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /applications/{id}/push-credentials/{provider} parameters added: $ref:ApiVersion
• GET /audit-events parameters added: $ref:ApiVersion; responses added: 400
• GET /audit-events/{id} parameters added: $ref:ApiVersion; responses added: 400
• POST /auth/app-tokens parameters added: $ref:ApiVersion
• POST /auth/email/verify parameters added: $ref:ApiVersion
• POST /auth/email/verify/resend parameters added: $ref:ApiVersion; responses added: 400
• POST /auth/invitations/accept parameters added: $ref:ApiVersion
• POST /auth/login parameters added: $ref:ApiVersion; responses added: 400
• POST /auth/logout parameters added: $ref:ApiVersion
• POST /auth/mfa/verify parameters added: $ref:ApiVersion; responses added: 400
• POST /auth/oauth/authorization-codes parameters added: $ref:ApiVersion; responses added: 400
• POST /auth/password/forgot parameters added: $ref:ApiVersion; responses added: 400
• POST /auth/password/reset parameters added: $ref:ApiVersion
• POST /auth/signup parameters added: $ref:ApiVersion; responses added: 400
• POST /auth/sso/{provider}/callback parameters added: $ref:ApiVersion; responses added: 400
• POST /auth/token/refresh parameters added: $ref:ApiVersion; responses added: 400
• GET /entitlements parameters added: $ref:ApiVersion; responses added: 400
• DELETE /entitlements/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /entitlements/{id} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /entitlements/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /organizations parameters added: $ref:ApiVersion; responses added: 400
• POST /organizations parameters added: $ref:ApiVersion
• GET /organizations/{id} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /organizations/{id} parameters added: $ref:ApiVersion; responses added: 400
• POST /organizations/{id}/billing/checkout-sessions parameters added: $ref:ApiVersion
• POST /organizations/{id}/billing/portal-sessions parameters added: $ref:ApiVersion
• GET /organizations/{id}/entitlements parameters added: $ref:ApiVersion; responses added: 400
• POST /organizations/{id}/entitlements parameters added: $ref:ApiVersion; responses added: 400
• GET /organizations/{id}/members parameters added: $ref:ApiVersion; responses added: 400
• POST /organizations/{id}/members parameters added: $ref:ApiVersion; responses added: 400
• DELETE /organizations/{id}/members/{userId} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /organizations/{id}/members/{userId} parameters added: $ref:ApiVersion; responses added: 400
• POST /organizations/{id}/members/me/accept parameters added: $ref:ApiVersion
• GET /organizations/{id}/subscription parameters added: $ref:ApiVersion; responses added: 400
• PATCH /organizations/{id}/subscription parameters added: $ref:ApiVersion; responses added: 400
• GET /permissions parameters added: $ref:ApiVersion; responses added: 400
• GET /roles parameters added: $ref:ApiVersion; responses added: 400
• POST /roles parameters added: $ref:ApiVersion; responses added: 400
• DELETE /roles/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /roles/{id} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /roles/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /tenants parameters added: $ref:ApiVersion; responses added: 400
• GET /tenants/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /tenants/{id}/tier-change-requests parameters added: $ref:ApiVersion; responses added: 400
• POST /tenants/{id}/tier-change-requests parameters added: $ref:ApiVersion; responses added: 400
• GET /tenants/{id}/tier-change-requests/{requestId} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /tenants/{id}/tier-change-requests/{requestId} parameters added: $ref:ApiVersion; responses added: 400
• GET /users parameters added: $ref:ApiVersion; responses added: 400
• POST /users parameters added: $ref:ApiVersion; responses added: 400
• DELETE /users/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /users/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/apps/{appId}/effective-permissions parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/apps/{appId}/profile parameters added: $ref:ApiVersion; responses added: 400
• PATCH /users/{id}/apps/{appId}/profile parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/apps/{appId}/settings parameters added: $ref:ApiVersion; responses added: 400
• PATCH /users/{id}/apps/{appId}/settings parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/devices parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/devices parameters added: $ref:ApiVersion; responses added: 400
• DELETE /users/{id}/devices/{deviceId} parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/devices/{deviceId} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /users/{id}/devices/{deviceId} parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/devices/{deviceId}/test parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/entitlements parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/entitlements parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/erasure-requests parameters added: $ref:ApiVersion; responses added: 400
• DELETE /users/{id}/erasure-requests/current parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/export parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/invitation parameters added: $ref:ApiVersion; responses added: 400
• DELETE /users/{id}/mfa/totp parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/mfa/totp parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/mfa/totp/confirm parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/mfa/totp/disable parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/notifications parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/notifications parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/notifications/{notificationId} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /users/{id}/notifications/{notificationId} parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/notifications/mark-read parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/notifications/unread-count parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/password parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/profile parameters added: $ref:ApiVersion; responses added: 400
• PATCH /users/{id}/profile parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/roles parameters added: $ref:ApiVersion; responses added: 400
• DELETE /users/{id}/roles/{roleId} parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/roles/{roleId} parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/sessions parameters added: $ref:ApiVersion; responses added: 400
• DELETE /users/{id}/sessions/{sessionId} parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/settings parameters added: $ref:ApiVersion; responses added: 400
• PATCH /users/{id}/settings parameters added: $ref:ApiVersion; responses added: 400
• GET /users/{id}/subscription parameters added: $ref:ApiVersion; responses added: 400
• POST /users/{id}/suspend parameters added: $ref:ApiVersion; responses added: 400
• POST /users/me/billing/checkout-sessions parameters added: $ref:ApiVersion
• POST /users/me/billing/portal-sessions parameters added: $ref:ApiVersion
• GET /webhooks parameters added: $ref:ApiVersion; responses added: 400
• POST /webhooks parameters added: $ref:ApiVersion; responses added: 400
• DELETE /webhooks/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /webhooks/{id} parameters added: $ref:ApiVersion; responses added: 400
• PATCH /webhooks/{id} parameters added: $ref:ApiVersion; responses added: 400
• GET /webhooks/{id}/deliveries parameters added: $ref:ApiVersion; responses added: 400
• POST /webhooks/{id}/deliveries/{deliveryId}/redeliver parameters added: $ref:ApiVersion; responses added: 400
• POST /webhooks/{id}/rotate-secret parameters added: $ref:ApiVersion; responses added: 400
• POST /webhooks/{id}/test parameters added: $ref:ApiVersion; responses added: 400

openapi.yaml · source 1565cd9

Whole API

• Server URL: https://api.substratalapps.com/v1 → https://api.substratalapps.com

openapi.yaml · source 3e6327f

Whole API

• Schemas added: ApplicationAccessTier, Plan, PlanSource, UserSubscription, OrganizationSubscription, CheckoutSessionCreate, PortalSessionCreate, PushProvider, PushCredentialCreate, PushCredentialUpdate, PushCredential, PushCredentialList, DeviceStatus, DeviceInactiveReason, WebPushSubscription, DeviceRegistration, DeviceUpdate, Device, DevicePage, DeviceTestResult, NotificationPriority, NotificationSource, NotificationState, NotificationPushStatus, NotificationSkipReason, NotificationCreate, NotificationPush, Notification, NotificationDelivery, NotificationWithDeliveries, NotificationPage, NotificationUnreadCount
• Schemas removed: TenantPlan, TenantUsage

Added (24)

• GET /applications/{id}/push-credentials List the push providers an Application has configured (the owner, the app's own key, or applications.manage)
• POST /applications/{id}/push-credentials Configure one push provider (the owner or applications.manage, User token only)
• DELETE /applications/{id}/push-credentials/{provider} Remove a push provider (User token only)
• GET /applications/{id}/push-credentials/{provider} Fetch one provider's configuration
• PATCH /applications/{id}/push-credentials/{provider} Replace key material, change non-secret fields, or re-enable a failed credential (User token only)
• POST /organizations/{id}/billing/checkout-sessions Start a Stripe Checkout to subscribe the Organization to Standard (org admin, User token)
• POST /organizations/{id}/billing/portal-sessions Open the Stripe Customer Portal for the Organization's subscription (org admin or billing.manage, User token)
• GET /organizations/{id}/subscription An Organization's plan and Standard subscription (org admin or billing.manage)
• PATCH /organizations/{id}/subscription Choose which members the Organization's subscription covers (org admin)
• GET /users/{id}/devices List a User's push devices (self, the app's own key, or users.list)
• POST /users/{id}/devices Register a push device, or refresh an existing registration (self or the app's own key)
• DELETE /users/{id}/devices/{deviceId} Unregister a device (self, the app's own key, or users.manage)
• GET /users/{id}/devices/{deviceId} Fetch one device
• PATCH /users/{id}/devices/{deviceId} Update a device's name, app version, environment, or rotated token (self or the app's own key)
• POST /users/{id}/devices/{deviceId}/test Send a test push to one device and wait for the provider's answer (self or the app's own key)
• GET /users/{id}/notifications List a User's notification inbox (self, the app's own key, or users.list)
• POST /users/{id}/notifications Send one notification to one User (the app's own key with notifications.send, or platform notifications.send)
• GET /users/{id}/notifications/{notificationId} Fetch one notification, with its per-device deliveries
• PATCH /users/{id}/notifications/{notificationId} Mark one notification read, unread, or archived (self or the app's own key)
• POST /users/{id}/notifications/mark-read Mark every unread notification matching the filters as read (self or the app's own key)
• GET /users/{id}/notifications/unread-count Count unread notifications, in total and per Application (self or the app's own key)
• GET /users/{id}/subscription A User's plan, what covers it, and their own subscription (self or billing.manage)
• POST /users/me/billing/checkout-sessions Start a Stripe Checkout to subscribe yourself to Standard (User token)
• POST /users/me/billing/portal-sessions Open the Stripe Customer Portal for your own subscription (User token)

Removed (4)

• POST /tenants/{id}/billing/checkout-sessions Start a Stripe Checkout to subscribe to Team (owner)
• POST /tenants/{id}/billing/portal-sessions Open the Stripe Customer Portal (owner or billing.manage)
• GET /tenants/{id}/subscription Current plan, subscription status, period, and seats
• GET /tenants/{id}/usage Usage against every plan limit

Changed (6)

• GET /applications parameters added: query:access_tier
• POST /applications responses removed: 402
• POST /organizations/{id}/entitlements responses removed: 402
• GET /tenants parameters removed: query:plan, query:restricted
• POST /users/{id}/entitlements responses removed: 402
• POST /webhooks responses removed: 402

openapi.yaml · source ea851ae

Whole API

• Authentication schemes changed
• Schemas added: OAuthError, PageInfo, PageEnvelope, Actor, Region, MfaChallenge, AppToken, AppTokenClaims, OAuthTokenRequest, Session, ErasureRequest, ApplicationPermission, ResolvedEntitlementStatus, RoleCreate, OrganizationMembershipStatus, SubscriptionStatus, Subscription, TenantUsage, RedirectSession, AuditTargetType, AccessEventReason, WebhookEventEnvelope, WebhookDelivery
• Schemas removed: Page, RoleWrite

Added (40)

• GET /api-keys/{id} Fetch one key (never the secret)
• PATCH /api-keys/{id} Change name, permissions, or restrict_destructive
• GET /audit-events/{id} Fetch one Audit Event
• POST /auth/app-tokens Mint a per-app JWT from a platform session (embedded login)
• POST /auth/email/verify Confirm an email address from an emailed token
• POST /auth/email/verify/resend Re-send a verification email (always 202)
• POST /auth/invitations/accept Set a password on an invited account, activate it, and sign in
• POST /auth/mfa/verify Complete a login that returned an MFA challenge
• POST /auth/oauth/authorization-codes Mint a one-time authorization code for a hosted launch (PKCE)
• POST /auth/oauth/token Exchange an authorization code or app refresh token for an app token
• POST /auth/password/forgot Send a password-reset email (always 202)
• POST /auth/password/reset Set a new password from a reset token (revokes every session)
• POST /auth/signup Create an account with email and password
• PATCH /organizations/{id}/members/{userId} Change a member's role
• POST /organizations/{id}/members/me/accept Accept a pending membership (the invited User's own token)
• DELETE /roles/{id} Delete an unassigned, non-seed Role
• GET /roles/{id} Fetch one Role
• PATCH /roles/{id} Change a Role's permissions or description
• POST /tenants/{id}/billing/checkout-sessions Start a Stripe Checkout to subscribe to Team (owner)
• POST /tenants/{id}/billing/portal-sessions Open the Stripe Customer Portal (owner or billing.manage)
• GET /tenants/{id}/subscription Current plan, subscription status, period, and seats
• GET /tenants/{id}/tier-change-requests/{requestId} Fetch one tier-change request
• PATCH /tenants/{id}/tier-change-requests/{requestId} Schedule, start, complete, or cancel a tier-change request (tenants.manage)
• GET /tenants/{id}/usage Usage against every plan limit
• GET /users/{id}/apps/{appId}/effective-permissions The live access check (always 200)
• POST /users/{id}/erasure-requests Request right-to-erasure (soft-delete now, hard-delete cascade in 7 days)
• DELETE /users/{id}/erasure-requests/current Cancel a scheduled erasure inside its 7-day window (users.manage)
• POST /users/{id}/invitation Re-send the invitation email to an invited user (users.manage)
• DELETE /users/{id}/mfa/totp Support reset of a user's TOTP (requires users.manage)
• POST /users/{id}/mfa/totp/confirm Confirm TOTP enrollment with a first code; returns recovery codes once
• POST /users/{id}/mfa/totp/disable Turn TOTP off given a current code or recovery code (self only)
• POST /users/{id}/password Change password given the current one (self only)
• GET /users/{id}/sessions List active sessions (self or users.manage)
• DELETE /users/{id}/sessions/{sessionId} Revoke one session
• GET /webhooks/{id} Fetch one subscription
• PATCH /webhooks/{id} Change url, events, description, api_version, or re-enable
• GET /webhooks/{id}/deliveries Recent delivery attempts (30-day log)
• POST /webhooks/{id}/deliveries/{deliveryId}/redeliver Re-send one past event (same event id)
• POST /webhooks/{id}/rotate-secret Issue a new signing secret (24-hour overlap)
• POST /webhooks/{id}/test Send a webhook.test event now

Removed (1)

• GET /users/{id}/applications/{appId}/effective-permissions The live access check

Changed (57)

• GET /api-keys parameters added: $ref:Cursor, $ref:Limit, query:include_inactive, query:intended_use, query:mode, query:scope; summary; description
• POST /api-keys responses added: 403; summary; description
• DELETE /api-keys/{id} responses added: 404; description; destructive: no → always
• POST /api-keys/{id}/rotate responses added: 404; summary; description; destructive: no → always
• GET /applications parameters added: query:owned, query:owner_organization_id, query:owner_user_id, query:review_status, query:tenant_id; summary; description
• POST /applications parameters added: $ref:IdempotencyKeyOptional; responses added: 402, 403, 409, 422; summary; description
• GET /applications/{id} responses added: 404
• PATCH /applications/{id} parameters added: $ref:IfMatch; responses added: 403, 422; summary; description; destructive: no → conditional
• GET /audit-events parameters added: query:actor_id, query:actor_type, query:organization_id, query:target_id, query:target_type, query:tenant_id; parameters removed: query:actor_user_id; responses added: 403; summary; description
• POST /auth/login responses added: 403, 429; summary
• POST /auth/logout responses added: 400, 401; summary; destructive: no → conditional; request body added
• POST /auth/sso/{provider}/callback responses added: 501; summary
• POST /auth/token/refresh summary
• GET /entitlements parameters added: query:ends_before, query:include_inactive, query:order_id, query:organization_id; responses added: 403; summary; description
• DELETE /entitlements/{id} responses added: 403, 404; summary; description; destructive: no → always
• GET /entitlements/{id} responses added: 404; description
• PATCH /entitlements/{id} parameters added: $ref:IfMatch; responses added: 403, 404, 422; summary; description; destructive: no → conditional
• GET /organizations parameters added: query:q, query:status; summary; description
• POST /organizations parameters added: $ref:IdempotencyKeyOptional; responses added: 400, 429; summary; description
• GET /organizations/{id} responses added: 404; description
• PATCH /organizations/{id} parameters added: $ref:IfMatch; responses added: 403; summary; description; destructive: no → conditional
• GET /organizations/{id}/entitlements parameters added: $ref:Cursor, $ref:Limit, query:application_id, query:ends_before, query:include_inactive, query:order_id, query:status; summary; description
• POST /organizations/{id}/entitlements responses added: 402, 403, 409, 422; summary; description
• GET /organizations/{id}/members parameters added: $ref:Cursor, $ref:Limit, query:membership_status, query:q, query:role; summary
• POST /organizations/{id}/members responses added: 403, 404; summary; description
• DELETE /organizations/{id}/members/{userId} responses added: 403, 409; summary; description; destructive: no → always
• GET /permissions parameters added: query:scope; summary
• GET /roles schema or examples
• POST /roles responses added: 403, 409; summary; description
• GET /tenants parameters added: query:owner_organization_id, query:owner_user_id, query:plan, query:restricted, query:status, query:tier; summary; description
• GET /tenants/{id} description
• GET /tenants/{id}/tier-change-requests parameters added: $ref:Cursor, $ref:Limit; description
• POST /tenants/{id}/tier-change-requests responses added: 403, 422; summary; description; destructive: no → always
• GET /users parameters added: query:application_id, query:created_after, query:created_before, query:email, query:organization_id, query:q; summary; description
• POST /users parameters added: $ref:IdempotencyKeyOptional; responses added: 403, 422; summary; description
• DELETE /users/{id} responses added: 403, 404; summary; description; destructive: no → always
• GET /users/{id} description
• PATCH /users/{id} parameters added: $ref:IfMatch; responses added: 403, 409, 422; summary; description; destructive: no → conditional
• GET /users/{id}/apps/{appId}/profile responses added: 403; summary; description
• PATCH /users/{id}/apps/{appId}/profile parameters added: $ref:IfMatch; responses added: 403, 409, 422; summary
• GET /users/{id}/apps/{appId}/settings responses added: 403, 404; summary
• PATCH /users/{id}/apps/{appId}/settings parameters added: $ref:IfMatch; responses added: 403, 409; summary; description
• GET /users/{id}/entitlements parameters added: $ref:Cursor, $ref:Limit, query:application_id, query:include_inactive, query:source, query:status; summary
• POST /users/{id}/entitlements responses added: 402, 403, 422; summary; description
• GET /users/{id}/export responses added: 429; description
• POST /users/{id}/mfa/totp responses added: 409; summary; description; request body removed
• GET /users/{id}/profile responses added: 404; description
• PATCH /users/{id}/profile parameters added: $ref:IfMatch; responses added: 409, 422; summary; description
• GET /users/{id}/roles parameters added: $ref:Cursor, $ref:Limit, query:application_id; summary
• DELETE /users/{id}/roles/{roleId} responses added: 403, 409; summary; description; destructive: no → always
• POST /users/{id}/roles/{roleId} responses added: 200, 403, 404; responses removed: 409; summary; description
• GET /users/{id}/settings summary; description
• PATCH /users/{id}/settings parameters added: $ref:IfMatch; responses added: 409, 422; summary; description
• POST /users/{id}/suspend responses added: 403, 409; summary; description; destructive: no → always; request body added
• GET /webhooks parameters added: $ref:Cursor, $ref:Limit, query:application_id; summary
• POST /webhooks responses added: 402, 409; summary
• DELETE /webhooks/{id} responses added: 404; destructive: no → always

openapi.yaml · source e7c76a6

Added (59)

• GET /api-keys List keys in scope for the caller
• POST /api-keys Create a key
• DELETE /api-keys/{id} Revoke permanently
• POST /api-keys/{id}/rotate Issue a new secret for the same key record
• GET /applications List the catalog
• POST /applications Add a catalog entry
• GET /applications/{id} Fetch one Application
• PATCH /applications/{id} Update a catalog entry
• GET /audit-events Query the audit log
• POST /auth/login Exchange credentials for a session
• POST /auth/logout Invalidate the current session
• POST /auth/sso/{provider}/callback Complete an SSO login
• POST /auth/token/refresh Exchange a refresh token for a new access token
• GET /entitlements List entitlements across all users (admin/support)
• DELETE /entitlements/{id} Hard-remove a grant made in error
• GET /entitlements/{id} Fetch one entitlement
• PATCH /entitlements/{id} Change status (the on/off toggle), or narrow an org-wide grant's member_scope
• GET /health Health check
• GET /organizations List organizations
• POST /organizations Create an organization
• GET /organizations/{id} Fetch one Organization
• PATCH /organizations/{id} Update name, or suspend/reactivate
• GET /organizations/{id}/entitlements List org-wide (seat) entitlements
• POST /organizations/{id}/entitlements Grant an app to the whole org
• GET /organizations/{id}/members List member users
• POST /organizations/{id}/members Add a member
• DELETE /organizations/{id}/members/{userId} Remove a member
• GET /permissions List every known Permission key
• GET /roles List Roles
• POST /roles Define a new Role
• GET /tenants List Tenants
• GET /tenants/{id} Fetch one Tenant
• GET /tenants/{id}/tier-change-requests List tier-change requests for a Tenant
• POST /tenants/{id}/tier-change-requests Request a tier change on a customer's behalf
• GET /users List users
• POST /users Create a user
• DELETE /users/{id} Soft-delete a user
• GET /users/{id} Fetch one user
• PATCH /users/{id} Update mutable fields
• GET /users/{id}/applications/{appId}/effective-permissions The live access check
• GET /users/{id}/apps/{appId}/profile Fetch per-app AppProfile
• PATCH /users/{id}/apps/{appId}/profile Update per-app AppProfile
• GET /users/{id}/apps/{appId}/settings Fetch fully-resolved per-app settings
• PATCH /users/{id}/apps/{appId}/settings Write per-app overrides
• GET /users/{id}/entitlements List a user's entitlements
• POST /users/{id}/entitlements Grant access to an app
• GET /users/{id}/export Export everything this API holds about this user
• POST /users/{id}/mfa/totp Enroll TOTP-based MFA for a password UserIdentity
• GET /users/{id}/profile Fetch global Profile
• PATCH /users/{id}/profile Update global Profile
• GET /users/{id}/roles List a user's Role assignments
• DELETE /users/{id}/roles/{roleId} Remove a Role assignment
• POST /users/{id}/roles/{roleId} Assign a Role to a user
• GET /users/{id}/settings Fetch global Settings
• PATCH /users/{id}/settings Update global Settings
• POST /users/{id}/suspend Suspend a user
• GET /webhooks List this caller's webhook subscriptions
• POST /webhooks Subscribe a URL to one or more event types
• DELETE /webhooks/{id} Unsubscribe