GET /v1/organizations

organizations:read

List organizations, cursor-paginated.

POST /v1/organizations

organizations:write

Create an organization and seat its creator as admin.

GET /v1/organizations/:id

organizations:read

Fetch an organization. Never includes private_metadata.

GET /v1/organizations/:id/memberships

organizations:read

List members of an organization with their roles.

PATCH /v1/organizations/:id/memberships/:userId

organizations:write

Change a member's role. Demoting the last admin returns LAST_ADMIN.

DELETE /v1/organizations/:id/memberships/:userId

organizations:write

Remove a member. Removing the last admin returns LAST_ADMIN.

POST /v1/organizations/:id/invitations

organizations:write

Invite an email address to an organization. Expires in 7 days.

POST /v1/organizations/:id/invitations/:invitationId/revoke

organizations:write

Revoke a pending invitation so the address can be re-invited.

PATCH /v1/organizations/:id/policy

organizations:write

Update the org security policy (requireMfa, ssoRequired, sessionIdleOverrideMs).

PUT /v1/organizations/:orgId/groups/:groupId/roles/:roleId

organizations:write

Grant an org role to a directory group; members inherit its permissions (augments only).

DELETE /v1/organizations/:orgId/groups/:groupId/roles/:roleId

organizations:write

Revoke a role from a directory group. Members lose the inherited permissions.

PATCH /v1/organizations/:id

organizations:write

✓

Update an organization name, slug, image, seat cap or metadata. Emits organization.updated.

DELETE /v1/organizations/:id

organizations:write

✓

Delete an organization; its memberships and invitations cascade with it.

PUT /v1/organizations/:id/parent

organizations:write

Set or clear (null) an organization’s parent in the B2B2B hierarchy; refuses a cycle.

GET /v1/organizations/:id/hierarchy

organizations:read

The organization’s ancestor chain and direct children in the B2B2B hierarchy.

GET /v1/organizations/:id/entitlements

organizations:read

The organization’s resolved entitlement plan and feature keys.

PUT /v1/organizations/:id/metadata

organizations:write

✓

Replace the organization public and private metadata bags wholesale.

POST /v1/organizations/:id/memberships

organizations:write

✓

Add an existing instance user to an organization with a role. The seat cap is enforced.

GET /v1/organizations/:id/invitations

organizations:read

List an organization's invitations with their roles and status.

GET /v1/organizations/:id/domains

organizations:read

List an organization's email domains and their verification state.

POST /v1/organizations/:id/domains

organizations:write

✓

Claim an email domain for auto-join. Returns the DNS TXT record to publish.

POST /v1/organizations/:id/domains/:domainId/verify

organizations:write

Check the DNS TXT record now and mark the domain verified.

DELETE /v1/organizations/:id/domains/:domainId

organizations:write

Remove a claimed email domain.