Organization team
Manage who belongs to the organization — list members, invite new ones, change roles, resend or revoke invitations, and remove access.
These endpoints back the organization's team screen: the people who can sign in to the org-level Dashboard and the invitations that bring new ones in. Manage members and their roles, and control pending invites.
A member's role governs what they can do org-wide; an invitation is a pending membership that becomes real once accepted. Removing a member revokes their access immediately.
These endpoints power the Tokeflow Dashboard UI at the organization level. They are session-authenticated (JWT bearer) — the token comes from signing in to the Dashboard, not from an sk_/pk_ API key. Requests also carry the x-organization-id header, and the signed-in user must be a member of that organization.
The invitation object
Returned by the list and retrieve endpoints on this page.
| Field | Type | Description |
|---|---|---|
id | string | Invitation ID. |
organization_id | string | Organization ID. |
organization_name | string | Organization name. |
email | string | Email address of the invitee. |
name | string | null | Display name of the invitee. |
role | string | Role assigned to the invitee. One of owner, admin, viewer. |
status | string | Current status of the invitation. One of pending, accepted, declined, expired, revoked. |
invited_by | object | Details of the user who sent the invitation. |
expires_at | string | Expiry date of the invitation. (ISO 8601 UTC). |
accepted_at | string | null | Date the invitation was accepted. (ISO 8601 UTC). |
declined_at | string | null | Date the invitation was declined. (ISO 8601 UTC). |
created_at | string | Date the invitation was created. (ISO 8601 UTC). |
Endpoints
GET/api/v1/org/team/invitations
Auth: Dashboard session (JWT bearer). Organization membership required.
List team invitations.
Query parameters
| Field | Type | Required | Description |
|---|---|---|---|
status | string | No | Filter invitations by status |
page | number | No | Page number (1-indexed). Default 1, min 1. |
limit | number | No | Number of items per page. Default 20, min 1, max 100. |
Example request
curl -G https://api.tokeflow.com/api/v1/org/team/invitations \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…" \
-H "x-organization-id: org_4b21e7c3" \
--data-urlencode "status=pending" \
--data-urlencode "page=1" \
--data-urlencode "limit=20"Example response — 200
{
"data": [
{
"id": "obj_1a2b3c4d",
"organization_id": "org_4b21e7c3",
"organization_name": "Acme Store",
"email": "jane@example.com",
"name": "Acme Store",
"role": "owner",
"status": "pending",
"invited_by": {
"user_id": "string",
"name": "Acme Store",
"email": "jane@example.com"
},
"expires_at": "2026-01-15T12:30:00.000Z",
"accepted_at": "2026-01-15T12:30:00.000Z",
"declined_at": "2026-01-15T12:30:00.000Z",
"created_at": "2026-01-15T12:30:00.000Z"
}
],
"meta": {
"page": 1,
"limit": 20,
"total": 42,
"total_pages": 3,
"has_next": true,
"has_prev": false
}
}POST/api/v1/org/team/invitations
Auth: Dashboard session (JWT bearer). Organization membership required.
Send team invitation.
Request fields
| Field | Type | Required | Description |
|---|---|---|---|
email | string | Yes | Email address of the invitee. |
role | string | Yes | Role to assign to the invitee. One of owner, admin, viewer. |
name | string | No | Display name of the invitee. |
Example request
curl -X POST https://api.tokeflow.com/api/v1/org/team/invitations \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…" \
-H "x-organization-id: org_4b21e7c3" \
-H "Content-Type: application/json" \
-d '{
"email": "user@company.com",
"role": "admin",
"name": "Jane Doe"
}'Example response — 201
{
"id": "obj_1a2b3c4d",
"organization_id": "org_4b21e7c3",
"organization_name": "Acme Store",
"email": "jane@example.com",
"name": "Acme Store",
"role": "owner",
"status": "pending",
"invited_by": {
"user_id": "string",
"name": "Acme Store",
"email": "jane@example.com"
},
"expires_at": "2026-01-15T12:30:00.000Z",
"accepted_at": "2026-01-15T12:30:00.000Z",
"declined_at": "2026-01-15T12:30:00.000Z",
"created_at": "2026-01-15T12:30:00.000Z"
}DELETE/api/v1/org/team/invitations/:id
Auth: Dashboard session (JWT bearer). Organization membership required.
Revoke team invitation.
Path parameters
| Field | Type | Required | Description |
|---|---|---|---|
id | string | Yes | — |
Example request
curl -X DELETE https://api.tokeflow.com/api/v1/org/team/invitations/obj_1a2b3c4d \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…" \
-H "x-organization-id: org_4b21e7c3"Example response — 204 No Content
An empty body is returned on success.
POST/api/v1/org/team/invitations/:id/resend
Auth: Dashboard session (JWT bearer). Organization membership required.
Resend team invitation.
Path parameters
| Field | Type | Required | Description |
|---|---|---|---|
id | string | Yes | — |
Example request
curl -X POST https://api.tokeflow.com/api/v1/org/team/invitations/obj_1a2b3c4d/resend \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…" \
-H "x-organization-id: org_4b21e7c3"Example response — 200
{
"id": "obj_1a2b3c4d",
"organization_id": "org_4b21e7c3",
"organization_name": "Acme Store",
"email": "jane@example.com",
"name": "Acme Store",
"role": "owner",
"status": "pending",
"invited_by": {
"user_id": "string",
"name": "Acme Store",
"email": "jane@example.com"
},
"expires_at": "2026-01-15T12:30:00.000Z",
"accepted_at": "2026-01-15T12:30:00.000Z",
"declined_at": "2026-01-15T12:30:00.000Z",
"created_at": "2026-01-15T12:30:00.000Z"
}GET/api/v1/org/team/members
Auth: Dashboard session (JWT bearer). Organization membership required.
List organization members.
Query parameters
| Field | Type | Required | Description |
|---|---|---|---|
page | number | No | Page number (1-indexed). Default 1, min 1. |
limit | number | No | Number of items per page. Default 20, min 1, max 100. |
Example request
curl -G https://api.tokeflow.com/api/v1/org/team/members \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…" \
-H "x-organization-id: org_4b21e7c3" \
--data-urlencode "page=1" \
--data-urlencode "limit=20"Example response — 200
{
"data": [
{
"membership_id": "mem_7b2f9c14",
"user_id": "string",
"email": "jane@example.com",
"name": "Acme Store",
"role": "owner",
"joined_at": "2026-01-15T12:30:00.000Z"
}
],
"meta": {
"page": 1,
"limit": 20,
"total": 42,
"total_pages": 3,
"has_next": true,
"has_prev": false
}
}DELETE/api/v1/org/team/members/:id
Auth: Dashboard session (JWT bearer). Organization membership required.
Remove team member.
Path parameters
| Field | Type | Required | Description |
|---|---|---|---|
id | string | Yes | — |
Example request
curl -X DELETE https://api.tokeflow.com/api/v1/org/team/members/obj_1a2b3c4d \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…" \
-H "x-organization-id: org_4b21e7c3"Example response — 204 No Content
An empty body is returned on success.
PATCH/api/v1/org/team/members/:id
Auth: Dashboard session (JWT bearer). Organization membership required.
Update team member role.
Path parameters
| Field | Type | Required | Description |
|---|---|---|---|
id | string | Yes | — |
Request fields
| Field | Type | Required | Description |
|---|---|---|---|
role | string | Yes | New role to assign to the member. One of owner, admin, viewer. |
Example request
curl -X PATCH https://api.tokeflow.com/api/v1/org/team/members/obj_1a2b3c4d \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…" \
-H "x-organization-id: org_4b21e7c3" \
-H "Content-Type: application/json" \
-d '{
"role": "admin"
}'Errors
Errors use the standard envelope. The most common cases here:
| HTTP | Meaning |
|---|---|
400 | Invalid parameters or a state that does not allow this operation. |
401 | Missing, expired, or invalid Dashboard session token. |
403 | Authenticated, but the signed-in user lacks access to this entity. |
404 | The record does not exist or is not visible to this entity. |