Sign Up
Docs v2.0

Members

GET /orgs/{id}/members

GET
/orgs/{id}/members

List the members of one organization. The caller must be a seated member holding read:members. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Authorization

user_jwt
headerAuthorizationBearer <token>

OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.

Path Parameters

id*string

Organization id

Formatuuid

Response Body

Organization members

application/json
  1. response
members*array<>
curl -X GET 'https://example.com/orgs/497f6eca-6276-4993-bfeb-53cbbbba6f08/members'
{  "members": [    {      "email": "string",      "name": "string",      "role": "string",      "roles": [        "string"      ],      "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5"    }  ]}

PATCH /orgs/:id/members/:user_id — replace a member's role assignments wholesale. Requires `write:members`, and is the ONLY surface that can narrow a seated member, which is why the cascade has one call site.

PATCH
/orgs/{id}/members/{user_id}

Replace a member's role assignments in one organization. The caller must be a seated member holding write:members; the route also enforces the delegation rules and last-admin guard. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Authorization

user_jwt
headerAuthorizationBearer <token>

OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.

Path Parameters

id*string

Organization id

Formatuuid
user_id*string

Member user id

Formatuuid

Request Body

application/json
  1. body
dry_run?|

Rehearse: run the full path and the cascade, then roll back (PLAN-NARROWING-REVOCATION-WARNING.md). Absent means false.

roles*array<string>

The member's complete new role set (slugs). Required and non-empty: the handler answers 400 otherwise — Option only so the error names the field instead of failing at deserialization.

Items1 <= items

Response Body

Updated member, or a dry-run preview when dry_run is true

application/json
  1. response
dry_run*boolean
revoked_keys*integer
Formatint64
Range0 <= value
curl -X PATCH 'https://example.com/orgs/497f6eca-6276-4993-bfeb-53cbbbba6f08/members/497f6eca-6276-4993-bfeb-53cbbbba6f08' \  -H 'Content-Type: application/json' \  -d '{  "roles": [    "string"  ]}'
{  "dry_run": true,  "revoked_keys": 0}

DELETE /orgs/{id}/members/{user_id}

DELETE
/orgs/{id}/members/{user_id}

Remove a membership from one organization. Removing yourself requires only read:organization; removing another member requires delete:members. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Authorization

user_jwt
headerAuthorizationBearer <token>

OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.

Path Parameters

id*string

Organization id

Formatuuid
user_id*string

Member user id

Formatuuid

Response Body

Removed member

application/json
  1. response
removed*string
Formatuuid
revoked_keys*integer
Formatint64
Range0 <= value
revoked_preview_grants*integer

Signed preview grants the member minted that the removal deleted (issue #1297, Leg B; PLAN-MEMBER-REMOVAL-KEY-REVOCATION.md D12).

Formatint64
Range0 <= value
curl -X DELETE 'https://example.com/orgs/497f6eca-6276-4993-bfeb-53cbbbba6f08/members/497f6eca-6276-4993-bfeb-53cbbbba6f08'
{  "removed": "b07f53d7-69c3-4e70-b8bd-5f0f78ddacb1",  "revoked_keys": 0,  "revoked_preview_grants": 0}

Read-only preview of the member-removal key-revocation cascade (PLAN-MEMBER-REMOVAL-PREVIEW.md). Authorization copies `remove_member`'s self/other split and checks authority, not last-Admin or delegation feasibility (D2).

GET
/orgs/{id}/members/{user_id}/removal-preview

Preview how many keys would be revoked if this membership were removed. Removing yourself requires only read:organization; removing someone else requires delete:members. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Authorization

user_jwt
headerAuthorizationBearer <token>

OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.

Path Parameters

id*string

Organization id

Formatuuid
user_id*string

Member user id

Formatuuid

Response Body

Membership-removal preview

application/json
  1. response
revoked_keys*integer
Formatint64
revoked_preview_grants?|

Signed preview grants the member minted that removal would delete (issue #1297, Leg B). null — not 0 — when Redis is unconfigured or unreachable: an unknown must not read as an all-clear.

Formatint64
user_id*string
Formatuuid
curl -X GET 'https://example.com/orgs/497f6eca-6276-4993-bfeb-53cbbbba6f08/members/497f6eca-6276-4993-bfeb-53cbbbba6f08/removal-preview'
{  "revoked_keys": 0,  "revoked_preview_grants": 0,  "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5"}

GET /projects/:id/members — who can access the project. Every explicit row, plus every admin flagged `implicit`; on the default project every org member is listed and every row is implicit.

GET
/projects/{id}/members

List who can access one project. The caller must be able to enter the project and hold read:members in the owning organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Authorization

user_jwt
headerAuthorizationBearer <token>

OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.

Path Parameters

id*string

Project id, or the literal default for the caller's default project alias

Response Body

Project members

application/json
  1. response
members*array<>
curl -X GET 'https://example.com/projects/string/members'
{  "members": [    {      "added_at": "2019-08-24T14:15:22Z",      "email": "string",      "implicit": true,      "name": "string",      "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5"    }  ]}

POST /projects/:id/members — add one member. Idempotent: `{"added": [id]}` when a row was inserted, `{"added": []}` when it already existed — the same contract as the bulk route.

POST
/projects/{id}/members

Add one explicit project-membership row. The caller must be able to enter the project and hold write:members in the owning organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Authorization

user_jwt
headerAuthorizationBearer <token>

OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.

Path Parameters

id*string

Project id, or the literal default for the caller's default project alias

Request Body

application/json
  1. body
user_id*string
Formatuuid

Response Body

Added project member ids

application/json
  1. response
added*array<>
curl -X POST 'https://example.com/projects/string/members' \  -H 'Content-Type: application/json' \  -d '{  "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5"}'
{  "added": [    "cfeefd5f-7de0-424c-ae7a-a31ee9b42101"  ]}

POST /projects/:id/members/bulk — add up to 200 members, all-or-nothing.

POST
/projects/{id}/members/bulk

Add up to 200 explicit project-membership rows in one request. The caller must be able to enter the project and hold write:members in the owning organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Authorization

user_jwt
headerAuthorizationBearer <token>

OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.

Path Parameters

id*string

Project id, or the literal default for the caller's default project alias

Request Body

application/json
  1. body
user_ids*array<>

Response Body

Added project member ids

application/json
  1. response
added*array<>
curl -X POST 'https://example.com/projects/string/members/bulk' \  -H 'Content-Type: application/json' \  -d '{  "user_ids": [    "2d98503d-4ab4-41bd-8fc6-78cc006fd2db"  ]}'
{  "added": [    "cfeefd5f-7de0-424c-ae7a-a31ee9b42101"  ]}

DELETE /projects/:id/members/:user_id — remove an explicit row and, unless the member holds `admin` (implicit access anyway), revoke the live keys they minted in this project (D9). Self-removal is allowed; there is no last-member guard because every admin can still reach the project.

DELETE
/projects/{id}/members/{user_id}

Remove one explicit project-membership row and revoke that member's keys in the project when needed. The caller must be able to enter the project and hold write:members in the owning organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Authorization

user_jwt
headerAuthorizationBearer <token>

OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.

Path Parameters

id*string

Project id, or the literal default for the caller's default project alias

user_id*string

Member user id

Formatuuid

Response Body

Removed project member

application/json
  1. response
removed*string
Formatuuid
revoked_keys*integer
Range0 <= value
curl -X DELETE 'https://example.com/projects/string/members/497f6eca-6276-4993-bfeb-53cbbbba6f08'
{  "removed": "b07f53d7-69c3-4e70-b8bd-5f0f78ddacb1",  "revoked_keys": 0}

Computersfor Agents

Isolated sandboxes for agent code,
ready in under 100 ms.

Start for Free