Organization API: Org Staff Team

Base URL: https://api.coritan.com/api/v1. Paths below are complete.

To try these requests in the browser, open the interactive Organization API reference.

POST /api/v1/orgs/{org_slug}/staff/team

Add a teammate, as the owner console's POST /members does: a role it does not take is 400 first, then adding an Admin, who may change everything but the owner, takes a fresh step-up (403 reauth_required) before anything is written. Counted against staff.invite (429 past it) and audited as member.invited.

application/json (required)

GET /api/v1/orgs/{org_slug}/staff/team/detail

Everyone on the brand, with role, last sign-in and whether they can sign in at all. The picker route (/staff/team) stays small; this is the team page.

GET /api/v1/orgs/{org_slug}/staff/team/policy

The brand's sign-in policy: require_mfa, and remember_device_days, how long a remembered device skips the code (30 unless an admin changed it, 0 when devices are not remembered).

PATCH /api/v1/orgs/{org_slug}/staff/team/policy

Require a second factor of everyone on the brand (require_mfa), and say how long a device a member remembered at sign-in skips the code (remember_device_days, 0 to 90). Send either or both. From the next sign-in a member without a second factor can only enrol until they have one. The admin requiring it must already have theirs, or they would be the first one locked into enrolment. Fewer days shortens the devices already remembered, and 0 stops them all.

application/json (required)

PATCH /api/v1/orgs/{org_slug}/staff/team/{member_id}

application/json (required)

DELETE /api/v1/orgs/{org_slug}/staff/team/{member_id}

GET /api/v1/orgs/{org_slug}/staff/team/{member_id}/customer-link

Which storefront customer account a teammate is, if any.

PUT /api/v1/orgs/{org_slug}/staff/team/{member_id}/customer-link

Attach a teammate to an existing customer account, or make them one with their email. Whoever holds the account holds its servers and its money, so this is a step-up action, and any storefront sessions the console opened on a previous account end.

application/json (required)

DELETE /api/v1/orgs/{org_slug}/staff/team/{member_id}/customer-link

Make a teammate console-only. The customer account stays as it is, with its servers and invoices; only the tie to this teammate goes.

POST /api/v1/orgs/{org_slug}/staff/team/{member_id}/reset-mfa

For a teammate who lost their phone: remove their second factor and end their sessions. They sign in with the password and, if the brand requires it, enrol again straight away. Never for yourself (disable your own with a code), and never for the owner from here.

POST /api/v1/orgs/{org_slug}/staff/team/{member_id}/reset-password

Set a temporary password (ending the member's sessions), email them a reset link (send_email), or both. Without a body: the link.

application/json

POST /api/v1/orgs/{org_slug}/staff/team/{member_id}/revoke-sessions

End every staff console session a teammate has open. Admins and the owner, after a fresh step-up (403 reauth_required), as for a role change; {"revoked": n}.