Your organization: its profile and company profile, invitations, recipient lists, delegated access, and restrictions on organizations below yours.
List pending invitations
Returns every still-pending invitation for the active organization, newest first. Existence of the row IS the pending state; accepted invitations are deleted on first sign-in.
Required scope: org.invite.read (Read invitations).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List pending invitations › Responses
OK
Invite a user to the organization
Sends a Keycloak-hosted invitation email to the supplied address and records the roles to apply on acceptance, by role_ids (each a role's uuid, or a built-in role's name). Re-inviting the same address replaces the previous pending role intent. No roles grants no_access.
Required scope: org.invite.write (Send invitations).
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Invite a user to the organization › Request Body
emailrole_idsThe roles to grant on acceptance, each by its uuid (Role.subject_id) or, for a built-in role, by its name (Role.id today). Empty grants no_access. Send role_ids or role_names, not both.
role_namesThe roles to grant on acceptance, by name. Deprecated: use role_ids instead. Removed on 2026-11-30.
Invite a user to the organization › Responses
Created
Revoke a pending invitation
Cancels a pending invitation: deletes the kontier row and best-effort removes the matching Keycloak org-invitation so the action token in the user's inbox stops working. Already-accepted invitations don't exist as rows - remove the user via the membership API instead.
Required scope: org.invite.write (Send invitations).
path Parameters
idInvitation UUID
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Revoke a pending invitation › Responses
No Content
Get the current organization
Returns the organization resolved from the caller's auth context: its names, contact addresses, defaults and identifiers. include=provenance adds registered_name; it is sent without being asked until 2026-11-30, after that only with include=provenance.
Required scope: org.read (Read organization profile).
query Parameters
includeExtra data to add to the response: provenance. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. provenance is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Get the current organization › Responses
OK
Update the current organization
Deprecated: use PATCH /organization instead. Removed on 2026-11-30.
Partial update: an absent field is left alone. The default_locale must be one of the supported invoicing languages (en, de, fr, es, it, pt, nl, ja). Returns the organization. include=provenance adds registered_name; it is sent without being asked until 2026-11-30, after that only with include=provenance.
Required scope: org.update (Update organization profile).
query Parameters
includeExtra data to add to the response: provenance. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. provenance is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Update the current organization › Request Body
company_size_tierdefault_currencydefault_date_formatiso, us or eu; null clears it back to inherit, omitted leaves it.
default_first_day_of_weekmonday, sunday or saturday; null clears it back to inherit, omitted leaves it.
default_languageDefault document language; null clears it back to inherit, omitted leaves it.
default_localedefault_number_format"1,234.56", "1.234,56" or "1 234,56"; null clears it back to inherit, omitted leaves it.
default_timezonelegal_namemain_emailnamephonesales_audienceb2b, b2c or both; null clears it, omitted leaves it.
signup_emailsupport_emailtax_inclusivevat_id_collectionhidden, optional or required; null clears it, omitted leaves it.
Update the current organization › Responses
OK
Update the current organization
Partial update: an absent field is left alone. The default_locale must be one of the supported invoicing languages (en, de, fr, es, it, pt, nl, ja). Returns the organization. include=provenance adds registered_name; it is sent without being asked until 2026-11-30, after that only with include=provenance.
Required scope: org.update (Update organization profile).
query Parameters
includeExtra data to add to the response: provenance. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. provenance is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Update the current organization › Request Body
company_size_tierdefault_currencydefault_date_formatiso, us or eu; null clears it back to inherit, omitted leaves it.
default_first_day_of_weekmonday, sunday or saturday; null clears it back to inherit, omitted leaves it.
default_languageDefault document language; null clears it back to inherit, omitted leaves it.
default_localedefault_number_format"1,234.56", "1.234,56" or "1 234,56"; null clears it back to inherit, omitted leaves it.
default_timezonelegal_namemain_emailnamephonesales_audienceb2b, b2c or both; null clears it, omitted leaves it.
signup_emailsupport_emailtax_inclusivevat_id_collectionhidden, optional or required; null clears it, omitted leaves it.
Update the current organization › Responses
OK
Close an organization below yours
Ends an organization for good: nobody signs in, nothing is sold, billed, collected or emailed, its API keys stop working and the access it granted elsewhere is withdrawn. Its records are kept. Returns 409 when an organization anywhere below it is still open — pass cascade to close them with it, which is the only way to close a group in one act. Closing one that is already closed succeeds and changes nothing. Only a signed-in person can close: an API key or a service account gets 403.
Required scope: org.children.manage (Manage the organization's subtree).
path Parameters
idThe organization below yours to close.
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Close an organization below yours › Request Body
cascadeClose every organization below this one too. Without it, an open organization anywhere below refuses the close.
Close an organization below yours › Responses
OK
List the restrictions on an organization below yours
Everything currently restricting one of the organizations below you: what you placed on them, and what an organization above them placed that reaches them. Each entry says whether you may lift it yourself. Returns 403 when the organization is not below yours. Small and bounded, so the whole list is returned and it is not paginated.
Required scope: org.children.read (Read the organization's subtree).
path Parameters
idThe organization below yours whose restrictions to read.
query Parameters
includeExtra data to add to the response: actions. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. actions is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List the restrictions on an organization below yours › Responses
OK
Restrict an organization below yours
Stops one of the organizations below you doing something, until you lift it. Choose what the restriction is for: arrears stops them selling but keeps their existing customers billed and collected; compliance stops their people signing in; freeze stops everything they do and reaches every organization below them too. Returns 403 when the organization is not below yours, or when you are not the parent that holds their customer record and the restriction is for arrears. Placing a second restriction of the same kind is allowed — two tickets are two facts.
Required scope: org.holds.manage (Restrict the organizations below this one).
path Parameters
idThe organization below yours that the hold restricts.
query Parameters
includeExtra data to add to the response: actions. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. actions is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Restrict an organization below yours › Request Body
kindarrears stops the organization selling; compliance stops its people signing in; freeze stops everything and reaches the whole subtree below it.
ends_atWhen it stops on its own. Omit for a hold that stops only when you release it.
reasonYour own note about why. Visible to you and to the organizations above you.
starts_atWhen the restriction begins. Defaults to now.
Restrict an organization below yours › Responses
Created
Lift a restriction you placed
Deprecated: use POST /organization/children/{id}/holds/{hold_id}/release instead. Removed on 2026-11-30.
Lifts the restriction from now on. Whatever it was deferring resumes on its own: bills that came due while it stood are raised on the next run with their own dates, and collection carries on from the step it had reached. The record of the restriction is kept. Idempotent — lifting one that is already lifted succeeds. Returns 403 when it was placed by an organization above you, which is theirs to lift. It does not delete anything: use POST /organization/children/{id}/holds/{hold_id}/release.
Required scope: org.holds.manage (Restrict the organizations below this one).
path Parameters
idThe organization the hold restricts.
holdIdThe hold to release.
query Parameters
includeExtra data to add to the response: actions. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. actions is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Lift a restriction you placed › Responses
OK
Lift a restriction you placed
Lifts the restriction from now on. Whatever it was deferring resumes on its own: bills that came due while it stood are raised on the next run with their own dates, and collection carries on from the step it had reached. The record of the restriction is kept. Idempotent — lifting one that is already lifted succeeds. Returns 403 when it was placed by an organization above you, which is theirs to lift. Returns the lifted restriction.
Required scope: org.holds.manage (Restrict the organizations below this one).
path Parameters
idThe organization the hold restricts.
hold_idThe hold to lift.
query Parameters
includeExtra data to add to the response: actions. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. actions is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Lift a restriction you placed › Responses
OK
Save the organization's company profile
Deprecated: use PATCH /organization/company-profile instead. Removed on 2026-11-30.
Writes every fact of the Company profile form (names and contact, the registered address, whose country is the organization's country, the tax regime and small-business scheme, the VAT id and tax number, the commercial register and representatives, and the invoice language, timezone and currency with their policies for the organizations below) in one transaction: all of it or none. Every field is optional and an absent field is left alone. Every refusal comes back at once as a field error keyed to the form field it concerns. Answers only {saved: true}; PATCH answers the organization.
Required scope: org.update (Update organization profile).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Save the organization's company profile › Request Body
default_currencydefault_localedefault_timezonein_liquidationThe registered address, replaced whole: line1, city, postal_code and country are required whenever it is present. Its country is the organisation's country.
legal_formThe legal form; null clears it.
legal_nameThe registered name; null clears it, and every document then falls back to the name.
main_emailWhere organisation mail lands when no recipient list answers. Required; cannot be cleared.
nameThe name the organisation trades under.
phoneThe organisation's public number; null clears it.
Per default key: what the organizations below may do with it. An omitted entry keeps the key's policy.
register_courtThe court that keeps the register; null clears it.
register_numberThe commercial-register number (EN 16931 BT-30); null clears it.
registered_office_addressThe registered seat, only where it differs from the registered address; null removes it.
When present, REPLACES the whole list: the statutes that require directors to be named are all-or-nothing.
share_capital_currencyISO 4217 currency of share_capital_minor.
share_capital_minorThe share capital in minor units of share_capital_currency; null clears the capital and its currency together.
small_business_schemeThe declared small-business scheme; null withdraws the declaration; omit the field to leave it as it is.
support_emailThe support address; null clears it.
tax_numberThe seller's tax registration number (EN 16931 BT-32); null clears it.
tax_regimeRequests also accept the new spelling: each value in lower case (kleinunternehmer for KLEINUNTERNEHMER). The listed spelling is deprecated in requests and accepted until 2026-11-30.
vat_idThe seller's VAT identification number (EN 16931 BT-31); null clears it.
Save the organization's company profile › Responses
OK
Update the organization's company profile
Writes every fact of the Company profile form (names and contact, the registered address, whose country is the organization's country, the tax regime and small-business scheme, the VAT id and tax number, the commercial register and representatives, and the invoice language, timezone and currency with their policies for the organizations below) in one transaction: all of it or none. Every field is optional and an absent field is left alone. Every refusal comes back at once as a field error keyed to the form field it concerns. Returns the organization.
Required scope: org.update (Update organization profile).
query Parameters
includeExtra data to add to the response: provenance. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. provenance is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Update the organization's company profile › Request Body
default_currencydefault_localedefault_timezonein_liquidationThe registered address, replaced whole: line1, city, postal_code and country are required whenever it is present. Its country is the organisation's country.
legal_formThe legal form; null clears it.
legal_nameThe registered name; null clears it, and every document then falls back to the name.
main_emailWhere organisation mail lands when no recipient list answers. Required; cannot be cleared.
nameThe name the organisation trades under.
phoneThe organisation's public number; null clears it.
Per default key: what the organizations below may do with it. An omitted entry keeps the key's policy.
register_courtThe court that keeps the register; null clears it.
register_numberThe commercial-register number (EN 16931 BT-30); null clears it.
registered_office_addressThe registered seat, only where it differs from the registered address; null removes it.
When present, REPLACES the whole list: the statutes that require directors to be named are all-or-nothing.
share_capital_currencyISO 4217 currency of share_capital_minor.
share_capital_minorThe share capital in minor units of share_capital_currency; null clears the capital and its currency together.
small_business_schemeThe declared small-business scheme; null withdraws the declaration; omit the field to leave it as it is.
support_emailThe support address; null clears it.
tax_numberThe seller's tax registration number (EN 16931 BT-32); null clears it.
tax_regimeRequests also accept the new spelling: each value in lower case (kleinunternehmer for KLEINUNTERNEHMER). The listed spelling is deprecated in requests and accepted until 2026-11-30.
vat_idThe seller's VAT identification number (EN 16931 BT-31); null clears it.
Update the organization's company profile › Responses
OK
List the organization's recipient lists
Who on your own side receives each kind of mail: quotes & contracts, approvals, finance, operations and reports. Each list holds one address that receives the mail plus up to two copied on it, and an entry can be a shared mailbox, a named person, or a role — a role reaches everyone who holds it, so the list stays correct when someone joins. The lists are per workspace, so a sandbox alert never reaches your live desk. Small and bounded by design, so the whole list is returned and it is not paginated.
Required scope: org.read (Read organization profile).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List the organization's recipient lists › Responses
OK
Add someone to one of the organization's recipient lists
Adds a shared mailbox, a named person, or a role to one list. Omit is_primary to let the first entry in a list become the one that receives the mail; pass true to move it there from whichever entry holds it. Returns 409 when that recipient is already on the list and 422 when the list already holds three.
Required scope: org.update (Update organization profile).
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Add someone to one of the organization's recipient lists › Request Body
categoryWhat this contact receives. Required.
kindWhich arm this row carries. Required.
emailRequired when kind is email; must be absent otherwise.
is_primaryWhether mail for this category is addressed here. Omit to let the first row in a category become its primary.
nameOptional label.
roleRequired when kind is role; must be absent otherwise.
user_idRequired when kind is user; must be absent otherwise.
Add someone to one of the organization's recipient lists › Responses
Created
Remove an organization recipient
Removes the entry. Idempotent - removing one that is already gone succeeds. If it was the entry receiving the mail, that list falls back to the operations list and then to the organization's main address.
Required scope: org.update (Update organization profile).
path Parameters
contactIdContact UUID
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Remove an organization recipient › Responses
No Content
Update an organization recipient
Changes which list an entry is on, who it names, its label, or whether it is the entry that receives the mail. Setting is_primary moves it there from whichever entry holds it, in one transaction. Clearing it leaves the list with nobody receiving directly, and its mail falls back to the operations list and then to the organization's main address.
Required scope: org.update (Update organization profile).
path Parameters
contactIdContact UUID
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Update an organization recipient › Request Body
categoryMove this row to a different category. It keeps is_primary, so moving a primary into an occupied category takes that category over.
emailThe mailbox, when the resulting kind is email.
is_primarytrue addresses this category here, demoting whichever row held it. false leaves the category with no primary at all, so it falls back to the operations list and then to the organisation's main address.
kindChange which arm this row carries. Supply the matching arm field with it.
nameSet the label; null clears it; omitted leaves it.
roleThe organisation role, when the resulting kind is role.
user_idThe member, when the resulting kind is user.
Update an organization recipient › Responses
OK
List the access your organization has given out
Everyone your organization has let into an organization below it: who they are, where they can work, what they can do there and until when. Withdrawn access is listed too, because what you took back is part of the record. Small and bounded, so the whole list is returned and it is not paginated.
Required scope: org.delegation.read (See who can reach which organization).
query Parameters
includeExtra data to add to the response: display. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. display is sent without being asked until 2026-11-30; after that date it is sent only when named here. names is deprecated: it is the old name of display, accepted until 2026-11-30.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List the access your organization has given out › Responses
OK
Let people work inside an organization below yours
Gives everyone holding a role you name the right to work inside an organization below yours, with a role you choose there. They keep their own account and their own sign-in; every action they take there is recorded as theirs, and as having been taken through your organization. Returns 422 when the organization is not below yours, when the people you named are not on the path between you and it, or when either role does not exist where it is held — the last of these names the field to change, grantee_role or target_role. Returns 404 for an organization you are not above, which is the same answer as one that does not exist. Set an end date to have it stop on its own.
Required scope: org.delegation.manage (Give access to organizations below this one).
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Let people work inside an organization below yours › Request Body
grantee_roleThe role somebody must hold in that organization to receive the access.
target_org_idThe organization to give access to. It must be below yours.
target_roleThe role the people you name will hold there. It must be a role that organization has: admin, member, no_access, or one it defined itself.
expires_atWhen the access should end on its own. Omit to keep it until you withdraw it.
grantee_org_idWhose people receive the access. Defaults to your own organization. If you name another, it must be yours or one between yours and the target.
reasonWhy you are giving it. The organization you are giving access to can see this.
Let people work inside an organization below yours › Responses
Created
List who can reach into your organization
Every way into your organization from an organization above it. Some were written down by whoever gave them; others follow from where your organization sits — an administrator of an organization above yours can work in yours without anybody writing anything, and those are listed here too so the page is never emptier than the truth. Each entry says whether you can withdraw it: the written ones you can, the ones that follow from the structure you cannot.
Required scope: org.delegation.read (See who can reach which organization).
query Parameters
includeExtra data to add to the response: display. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. display is sent without being asked until 2026-11-30; after that date it is sent only when named here. names is deprecated: it is the old name of display, accepted until 2026-11-30.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List who can reach into your organization › Responses
OK
Withdraw access
Deprecated: use POST /organization/delegations/{id}/revoke instead. Removed on 2026-11-30.
Takes the access away immediately — the next thing the affected people do lands outside the organization, not inside it. Either side may do this: whoever gave it, and the organization it was given into. The record of the access, and of the withdrawal, is kept. Returns 404 when the access was already withdrawn or belongs to neither you nor an organization below you. It does not delete anything: use POST /organization/delegations/{id}/revoke.
Required scope: org.delegation.manage (Give access to organizations below this one).
path Parameters
idThe grant to withdraw.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Withdraw access › Request Body
reasonWhy you are withdrawing it. Kept with the record.
Withdraw access › Responses
OK
Withdraw access
Takes the access away immediately — the next thing the affected people do lands outside the organization, not inside it. Either side may do this: whoever gave it, and the organization it was given into. The record of the access, and of the withdrawal, is kept. Returns 404 when the access was already withdrawn or belongs to neither you nor an organization below you. Returns the withdrawn access.
Required scope: org.delegation.manage (Give access to organizations below this one).
path Parameters
idThe grant to withdraw.
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Withdraw access › Request Body
reasonWhy you are withdrawing it. Kept with the record.
Withdraw access › Responses
OK
List the restrictions on your organization
Everything currently restricting your organization: what you have been asked to fix and what it stops you doing. A restriction placed by an organization above you is shown here and can only be removed by them — the list says which. It stays readable while a restriction is in force, which is the one thing it exists for; a closed organization is refused like everything else. Small and bounded, so the whole list is returned and it is not paginated.
Required scope: org.read (Read organization profile).
query Parameters
includeExtra data to add to the response: actions. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. actions is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List the restrictions on your organization › Responses
OK
Where each kind of organization mail is sent
One row per list, showing the address that receives it, the addresses copied on it, and where that answer came from - the list itself, the operations fallback, the organization's main address, or nobody. It is the same lookup the sending path performs, so what it shows is what happens.
Required scope: org.read (Read organization profile).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Where each kind of organization mail is sent › Responses
OK