GET /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations

List or search organizations, with member counts and the O4 orphaned flag.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations

Create an organization in this instance. Starts adminless until its first invite.

GET /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId

One organization with its members and its full invitation history.

DELETE /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId

Delete an organization. The O4 remedy; requires owner or admin.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/clone

Clone an org's config (name, slug, policy, email domains, groups + role grants — not members) into the application's other environment (prod↔test).

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/members

Add an existing user of this instance to an organization (O5 enforced).

PATCH /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/members/:userId

Change a member's role. Demoting the last admin is 409 LAST_ADMIN (O1).

DELETE /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/members/:userId

Remove a member. Removing the last admin is 409 LAST_ADMIN (O1).

GET /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/groups

List the organization directory groups, so a role grant can pick one.

GET /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/policy

Read the org security policy (requireMfa, ssoRequired, sessionIdleOverrideMs).

PATCH /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/policy

Update the org security policy (requireMfa, ssoRequired, sessionIdleOverrideMs).

GET /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/groups/:groupId/roles

List the org roles granted to a directory group.

PUT /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/groups/:groupId/roles/:roleId

Grant an org role to a directory group; members inherit its permissions.

DELETE /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/groups/:groupId/roles/:roleId

Revoke a role from a directory group.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/invitations

Issue an invitation with no member behind it; the audit row names the operator.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/invitations/:invitationId/revoke

Revoke a pending invitation. Already-accepted ones are 409.

GET /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/domains

List an organization email domains and their verification state.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/domains

Claim an email domain for auto-join. Returns the DNS TXT record to publish.

POST /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/domains/:domainId/verify

Check the DNS TXT record now and mark the domain verified.

PATCH /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/domains/:domainId

Update a claimed domain auto-join and default role. The domain and its verification state are immutable.

DELETE /v1/dashboard/accounts/:accountId/instances/:instanceId/organizations/:organizationId/domains/:domainId

Remove a claimed email domain.