All routes need a signed-in session.
| Method · Route | Purpose |
|---|
POST /create | Create an organization |
GET /my-organizations | The organizations you belong to |
POST /{slug}/upgrade-type | Upgrade org type (sole proprietorship → corporation). Owner only |
PUT /{slug}/region | Change the organization’s country. Owner only |
POST /representative | Set/update the representative director |
POST /otp/send · /otp/verify | Phone OTP |
POST /otp/email/send · /otp/email/verify | Email OTP |
POST /{slug}/delete · /{slug}/restore | Delete an organization (Owner only, personal-seal confirmation; purged after a 7-day grace period) or restore it within that period |
POST /{slug}/transfer-ownership (+ /cancel) | Offer ownership to another person. Owner only, with a personal-seal confirmation; needs the Ownership Transfer add-on (402 ADDON_REQUIRED without it). It takes effect when the recipient accepts |
GET /transfer-ownership/{code} · POST /transfer-ownership/{code}/accept · /decline | The recipient’s side of an ownership transfer |
| Method · Route | Purpose | Required scope |
|---|
PUT /general · /security · /domains · /api-key-scope · /member-policies | Org config | org.setting.update |
POST /domains/verify · /domains/auto-configure | Verify a domain | org.org.verify_domain |
PUT /onboarding | Save the onboarding wizard | org.setting.update |
PUT /notifications · POST /notifications/test | Notification config | org.setting.update |
| Method · Route | Purpose | Required scope |
|---|
POST /keys/api-keys | Issue an API key. Body: name, description, connectedIdId, allowedScopes, expiresAt, maxTokenLifetimeSeconds | org.api_key.issue |
POST /keys/api-keys/{keyId}/self-test | Check that a key works right now, without its secret | org.api_key.issue |
DELETE /keys/api-keys/{keyId} | Revoke an API key | org.api_key.revoke |
POST /keys/signing-key/rotate | Rotate the RSA signing key. The previous key stays valid for verification during the grace period — see Key rotation | org.setting.rotate_signing_key |
POST /keys/webhook-secret/regenerate | Rotate webhook secret | org.setting.regenerate_webhook_secret |
POST · DELETE /keys/plugin-tokens[/{tokenId}] | Plugin tokens | org.api_key.issue · org.api_key.revoke |
POST · DELETE /scim/tokens[/{tokenId}] (+ /hard) | SCIM tokens | org.setting.update |
POST · DELETE /federation[/{providerId}] (+ /test) | IdP federation | org.idp_connection.update |
maxTokenLifetimeSeconds sets how long tokens minted with the key live: 60 seconds to 7 days,
default 300. A value above 300 needs the organization owner and a personal-seal confirmation in
assertionResponseJson. Errors: 400 LIFETIME_TOO_LONG (over 7 days), 403 OWNER_REQUIRED,
401 SEAL_REQUIRED.
| Method · Route | Purpose | Required scope |
|---|
GET / | List sub-orgs | — |
POST / | Create sub-org | org.org.create |
DELETE /{subSlug} | Delete sub-org | org.org.delete |
GET /api/org/{slug}/parent returns the parent organization.