Toegang: leden, rollen, sleutels

Wie er mag inloggen, wat diegene daarna mag, welke klanten diegene ziet, en de sleutels waarmee een script namens hen handelt.

61 endpoints, verdeeld over 8 groepen. Een recht geschreven als module.resource.action:own heeft een bereik: :own dekt rijen die van jou zijn, :any die van iedereen, en :any voldoet aan een controle op :own.

members

Endpoint	Recht
GET /members	members.member.read
PATCH /members/{membership_id}	members.member.write
DELETE /members/{membership_id}	members.member.write
GET /members/{membership_id}/permissions	members.member.read
PUT /members/{membership_id}/roles	settings.roles.manage
DELETE /members/{membership_id}/two-factor	members.member.write
POST /members/invite	members.member.write
GET /members/lookup	Bewust open

Parameters en schema’s per endpoint

GET /api/v1/members

List Members — The team, for Instellingen → Gebruikers — staff only.

Recht: members.member.read

Antwoord: 200 · MemberRead[]

PATCH /api/v1/members/{membership_id}

Update Member Role — Swap this membership’s system role; any custom roles it also holds are untouched.

Recht: members.member.write

Padparameters: membership_id

Request body: MemberRoleUpdate

Antwoord: 200 · MemberRead

DELETE /api/v1/members/{membership_id}

Revoke Member

Recht: members.member.write

Padparameters: membership_id

Antwoord: 204

GET /api/v1/members/{membership_id}/permissions

Member Permissions — A member’s effective permissions — the union over every role they hold.

Recht: members.member.read

Padparameters: membership_id

Antwoord: 200 · EffectivePermissions

PUT /api/v1/members/{membership_id}/roles

Set Member Roles — Replace a membership’s whole role set in one save. A user may hold several roles.

Recht: settings.roles.manage

Padparameters: membership_id

Request body: MembershipRolesUpdate

Antwoord: 200 · EffectivePermissions

DELETE /api/v1/members/{membership_id}/two-factor

Reset Member Two Factor — Reset a member’s 2FA — the lost-phone escape hatch (docs/TWOFACTOR.md).

Recht: members.member.write

Padparameters: membership_id

Antwoord: 204

POST /api/v1/members/invite

Invite Member

Recht: members.member.write

Request body: MemberInvite

Antwoord: 201 · MemberRead

GET /api/v1/members/lookup

Lookup Members — Name/email of org staff, for assignee/approver pickers. Open to every member.

Recht: Bewust open

Queryparameters:

Naam	Type	Betekenis
permission	string	Only members who hold this permission at some scope — e.g. tasks.task.write for an assignee picker, leave.request.approve for an approver picker. Omit for everyone in the org.
include_clients	boolean	Also return client-role memberships (portal users). Off by default: every picker built on this endpoint means staff. (default false)

Antwoord: 200 · MemberLookup[]

roles

Endpoint	Recht
GET /permissions/catalog	Bewust open
GET /roles	settings.roles.manage
POST /roles	settings.roles.manage
PATCH /roles/{role_id}	settings.roles.manage
DELETE /roles/{role_id}	settings.roles.manage

Parameters en schema’s per endpoint

GET /api/v1/permissions/catalog

Permission Catalog

Recht: Bewust open

Antwoord: 200 · PermissionCatalog

GET /api/v1/roles

List Roles

Recht: settings.roles.manage

Antwoord: 200 · RoleRead[]

POST /api/v1/roles

Create Role — Create a custom role, optionally seeded from an existing one.

Recht: settings.roles.manage

Queryparameters:

Naam	Type	Betekenis
from	string	Duplicate this role’s permissions into the new one.

Request body: RoleCreate

Antwoord: 201 · RoleRead

PATCH /api/v1/roles/{role_id}

Update Role — Rename, reposition, or replace the whole permission set in one save.

Recht: settings.roles.manage

Padparameters: role_id

Request body: RoleUpdate

Antwoord: 200 · RoleRead

DELETE /api/v1/roles/{role_id}

Delete Role — System roles are not deletable — they are what memberships.role still collapses to.

Recht: settings.roles.manage

Padparameters: role_id

Antwoord: 204

users

Endpoint	Recht
GET /users/{id}	Bewust open
PATCH /users/{id}	Bewust open
DELETE /users/{id}	Bewust open
GET /users/me	Bewust open
PATCH /users/me	Bewust open
POST /users/me/email	Bewust open

Parameters en schema’s per endpoint

GET /api/v1/users/{id}

Users:User

Recht: Bewust open

Padparameters: id

Antwoord: 200 · UserRead

PATCH /api/v1/users/{id}

Users:Patch User

Recht: Bewust open

Padparameters: id

Request body: UserUpdate

Antwoord: 200 · UserRead

DELETE /api/v1/users/{id}

Users:Delete User

Recht: Bewust open

Padparameters: id

Antwoord: 204

GET /api/v1/users/me

Users:Current User

Recht: Bewust open

Antwoord: 200 · UserRead

PATCH /api/v1/users/me

Users:Patch Current User

Recht: Bewust open

Request body: UserUpdate

Antwoord: 200 · UserRead

POST /api/v1/users/me/email

Users:Change Email — Change the caller’s own sign-in address. Costs the current password; the new address must be free (emails are unique case-insensitively and stored lowercase, like invites). Verification state resets — the new address has never been proven.

Recht: Bewust open

Request body: EmailChange

Antwoord: 200 · UserRead

api-keys

Endpoint	Recht
GET /api-keys	apikeys.personal.manage
POST /api-keys	apikeys.personal.manage
POST /api-keys/{key_id}/revoke	apikeys.personal.manage
GET /service-accounts	apikeys.service_account.manage
POST /service-accounts	apikeys.service_account.manage
DELETE /service-accounts/{account_id}	apikeys.service_account.manage
GET /service-accounts/{account_id}/keys	apikeys.service_account.manage
POST /service-accounts/{account_id}/keys	apikeys.service_account.manage

Parameters en schema’s per endpoint

GET /api/v1/api-keys

List Personal Keys

Recht: apikeys.personal.manage

Antwoord: 200 · ApiKeyRead[]

POST /api/v1/api-keys

Create Personal Key

Recht: apikeys.personal.manage

Request body: ApiKeyCreate

Antwoord: 201 · ApiKeyCreated

POST /api/v1/api-keys/{key_id}/revoke

Revoke Key — Revoke a key. Own personal keys need apikeys.personal.manage; the service refines to apikeys.service_account.manage for a service-account key.

Recht: apikeys.personal.manage

Padparameters: key_id

Antwoord: 200 · ApiKeyRead

GET /api/v1/service-accounts

List Service Accounts — Each account with its keys — one grouped read, not one request per account (#290).

Recht: apikeys.service_account.manage

Antwoord: 200 · ServiceAccountRead[]

POST /api/v1/service-accounts

Create Service Account

Recht: apikeys.service_account.manage

Request body: ServiceAccountCreate

Antwoord: 201 · ServiceAccountRead

DELETE /api/v1/service-accounts/{account_id}

Delete Service Account

Recht: apikeys.service_account.manage

Padparameters: account_id

Antwoord: 204

GET /api/v1/service-accounts/{account_id}/keys

List Service Account Keys

Recht: apikeys.service_account.manage

Padparameters: account_id

Antwoord: 200 · ApiKeyRead[]

POST /api/v1/service-accounts/{account_id}/keys

Create Service Account Key

Recht: apikeys.service_account.manage

Padparameters: account_id

Request body: ApiKeyCreate

Antwoord: 201 · ApiKeyCreated

oauth

Endpoint	Recht
GET /oauth/connections	apikeys.personal.manage
DELETE /oauth/connections/{client_pk}	apikeys.personal.manage
GET /oauth/consent	Bewust open
POST /oauth/consent	apikeys.personal.manage
GET /oauth/metadata/authorization-server	Bewust open
GET /oauth/metadata/protected-resource	Bewust open
POST /oauth/register	Bewust open
POST /oauth/revoke	Bewust open
POST /oauth/token	Bewust open

Parameters en schema’s per endpoint

GET /api/v1/oauth/connections

List Connections — The clients this user has connected. Counted in one grouped read, not one query per row.

Recht: apikeys.personal.manage

Antwoord: 200 · app__core__oauth__router__ConnectionRead[]

DELETE /api/v1/oauth/connections/{client_pk}

Disconnect — Disconnect a client: revoke it, and every key it ever issued goes with it.

Recht: apikeys.personal.manage

Padparameters: client_pk

Antwoord: 204

GET /api/v1/oauth/consent

Consent Request — Validate an authorization request and describe it, without writing anything.

Recht: Bewust open

Queryparameters:

Naam	Type	Betekenis
client_id	string · verplicht
redirect_uri	string · verplicht
scope	string	(default “)
resource	string

Antwoord: 200 · ConsentRequest

POST /api/v1/oauth/consent

Approve Consent — Approve, and get the URL to send the browser back to.

Recht: apikeys.personal.manage

Request body: ConsentApproval

Antwoord: 200 · ConsentResult

GET /api/v1/oauth/metadata/authorization-server

Authorization Server Metadata — Served here and proxied by the web app at /.well-known/oauth-authorization-server.

Recht: Bewust open

Antwoord: 200 · object

GET /api/v1/oauth/metadata/protected-resource

Protected Resource Metadata — One document per /mcp URL, section segment included.

Recht: Bewust open

Queryparameters:

Naam	Type	Betekenis
resource_path	string	(default /mcp)

Antwoord: 200 · object

POST /api/v1/oauth/register

Register Client — Register a client. Registering grants nothing — it names a thing a person may later consent to, and until somebody does, the row can read no byte of tenant data.

Recht: Bewust open

Request body: ClientRegistration

Antwoord: 201

POST /api/v1/oauth/revoke

Revoke — Always 200. A revocation endpoint that distinguishes “revoked” from “no such token” is a token oracle, and the caller can do nothing with the difference anyway (RFC 7009 §2.2).

Recht: Bewust open

Antwoord: 200

POST /api/v1/oauth/token

Token — authorization_code and refresh_token. Form-encoded, per the RFC.

Recht: Bewust open

Antwoord: 200

auth

Endpoint	Recht
GET /auth/2fa	Bewust open
POST /auth/2fa/backup-codes	Bewust open
POST /auth/2fa/challenge/sms	Bewust open
POST /auth/2fa/confirm	Bewust open
POST /auth/2fa/disable	Bewust open
POST /auth/2fa/setup	Bewust open
DELETE /auth/2fa/sms	Bewust open
POST /auth/2fa/sms/confirm	Bewust open
POST /auth/2fa/sms/setup	Bewust open
POST /auth/2fa/verify	Bewust open
POST /auth/forgot-password	Bewust open
POST /auth/login	Bewust open
POST /auth/logout	Bewust open
GET /auth/oidc/callback	Bewust open
GET /auth/oidc/login	Bewust open
POST /auth/register	Bewust open
POST /auth/request-verify-token	Bewust open
POST /auth/reset-password	Bewust open
POST /auth/verify	Bewust open

Parameters en schema’s per endpoint

GET /api/v1/auth/2fa

Auth:Twofactor.Status

Recht: Bewust open

Antwoord: 200 · TwoFactorStatus

POST /api/v1/auth/2fa/backup-codes

Auth:Twofactor.Backup Codes — A fresh set (shown once), invalidating every previous code. Costs a current TOTP code — a stolen session alone must not be able to mint recovery codes.

Recht: Bewust open

Request body: CodeIn

Antwoord: 200 · BackupCodesOut

POST /api/v1/auth/2fa/challenge/sms

Auth:Twofactor.Challenge Sms — Text a login code to the enrolled number — only for accounts that confirmed one.

Recht: Bewust open

Request body: ChallengeSms

Antwoord: 200 · SmsSendOut

POST /api/v1/auth/2fa/confirm

Auth:Twofactor.Confirm — A valid code from the freshly-scanned app is what turns 2FA on — and mints the backup codes, returned exactly once.

Recht: Bewust open

Request body: CodeIn

Antwoord: 200 · BackupCodesOut

POST /api/v1/auth/2fa/disable

Auth:Twofactor.Disable — Turn 2FA off for the caller’s own account. A confirmed setup costs the password (a stolen session must not be able to strip the second factor); abandoning an unconfirmed setup is free. Lost everything? That is what the org admin’s reset is for (members.py).

Recht: Bewust open

Request body: DisableIn

Antwoord: 204

POST /api/v1/auth/2fa/setup

Auth:Twofactor.Setup — Start (or restart) enrollment: mint a secret, return it as QR + manual key.

Recht: Bewust open

Antwoord: 200 · TwoFactorSetupOut

DELETE /api/v1/auth/2fa/sms

Auth:Twofactor.Sms Disable — Drop the SMS factor (TOTP + backup codes remain — never leaves the account factor-less).

Recht: Bewust open

Antwoord: 204

POST /api/v1/auth/2fa/sms/confirm

Auth:Twofactor.Sms Confirm

Recht: Bewust open

Request body: CodeIn

Antwoord: 204

POST /api/v1/auth/2fa/sms/setup

Auth:Twofactor.Sms Setup — Register a number for SMS codes: it becomes usable only after echoing a code sent to it. SMS is an additional factor on a confirmed TOTP setup, never the only one — a number can be re-registered, but 2FA cannot start out SMS-only.

Recht: Bewust open

Request body: SmsSetupIn

Antwoord: 200 · SmsSendOut

POST /api/v1/auth/2fa/verify

Auth:Twofactor.Verify — Redeem a login challenge with a code from any enrolled factor → session cookie.

Recht: Bewust open

Request body: ChallengeVerify

Antwoord: 200

POST /api/v1/auth/forgot-password

Reset:Forgot Password

Recht: Bewust open

Request body: Body_reset_forgot_password_api_v1_auth_forgot_password_post

Antwoord: 202

POST /api/v1/auth/login

Auth:Cookie.Login — Password login, for the org this hostname resolves to.

Recht: Bewust open

Antwoord: 200 · LoginChallenge

POST /api/v1/auth/logout

Auth:Cookie.Logout

Recht: Bewust open

Antwoord: 200

GET /api/v1/auth/oidc/callback

Oidc Callback

Recht: Bewust open

Antwoord: 200

GET /api/v1/auth/oidc/login

Oidc Login

Recht: Bewust open

Antwoord: 200

POST /api/v1/auth/register

Register:Register

Recht: Bewust open

Request body: UserCreate

Antwoord: 201 · UserRead

POST /api/v1/auth/request-verify-token

Verify:Request-Token

Recht: Bewust open

Request body: Body_verify_request_token_api_v1_auth_request_verify_token_post

Antwoord: 202

POST /api/v1/auth/reset-password

Reset:Reset Password

Recht: Bewust open

Request body: Body_reset_reset_password_api_v1_auth_reset_password_post

Antwoord: 200

POST /api/v1/auth/verify

Verify:Verify

Recht: Bewust open

Request body: Body_verify_verify_api_v1_auth_verify_post

Antwoord: 200 · UserRead

sso-settings

Endpoint	Recht
GET /settings/sso	settings.auth.manage
PUT /settings/sso	settings.auth.manage
POST /settings/sso/test	settings.auth.manage

Parameters en schema’s per endpoint

GET /api/v1/settings/sso

Get Sso Settings

Recht: settings.auth.manage

Antwoord: 200 · SsoSettingsRead

PUT /api/v1/settings/sso

Save Sso Settings

Recht: settings.auth.manage

Request body: SsoSettingsWrite

Antwoord: 200 · SsoSettingsRead

POST /api/v1/settings/sso/test

Test Sso Settings

Recht: settings.auth.manage

Antwoord: 200 · SsoTestResult

service-access

Endpoint	Recht
GET /settings/service-access	settings.service_access.manage
POST /settings/service-access	settings.service_access.manage
DELETE /settings/service-access	settings.service_access.manage

Parameters en schema’s per endpoint

GET /api/v1/settings/service-access

Service Access Status

Recht: settings.service_access.manage

Antwoord: 200 · ServiceAccessStatus

POST /api/v1/settings/service-access

Issue Service Pin

Recht: settings.service_access.manage

Antwoord: 201 · ServiceAccessIssued

DELETE /api/v1/settings/service-access

Revoke Service Pin

Recht: settings.service_access.manage

Antwoord: 200 · ServiceAccessStatus