# Organization API: Org Staff Team

> Every Organization API operation tagged Org Staff Team.

Source: https://www.coritan.com/docs/api/reference/organizations/org-staff-team/

Base URL: `https://api.coritan.com/api/v1`. Paths below are complete.

To try these requests in the browser, open the [interactive Organization API reference](https://api.coritan.com/docs/org).

## Operations

| Method | Path | Summary |
| --- | --- | --- |
| POST | [`/api/v1/orgs/{org_slug}/staff/team`](#op-post-api-v1-orgs-org-slug-staff-team) | Staff invite member |
| GET | [`/api/v1/orgs/{org_slug}/staff/team/detail`](#op-get-api-v1-orgs-org-slug-staff-team-detail) | Everyone on the brand, with role, last sign-in and whether they can sign in at all |
| GET | [`/api/v1/orgs/{org_slug}/staff/team/policy`](#op-get-api-v1-orgs-org-slug-staff-team-policy) | Staff team policy |
| PATCH | [`/api/v1/orgs/{org_slug}/staff/team/policy`](#op-patch-api-v1-orgs-org-slug-staff-team-policy) | Require a second factor of everyone on the brand |
| PATCH | [`/api/v1/orgs/{org_slug}/staff/team/{member_id}`](#op-patch-api-v1-orgs-org-slug-staff-team-member-id) | Staff change role |
| DELETE | [`/api/v1/orgs/{org_slug}/staff/team/{member_id}`](#op-delete-api-v1-orgs-org-slug-staff-team-member-id) | Staff remove member |
| GET | [`/api/v1/orgs/{org_slug}/staff/team/{member_id}/customer-link`](#op-get-api-v1-orgs-org-slug-staff-team-member-id-customer-link) | Which storefront customer account a teammate is, if any |
| PUT | [`/api/v1/orgs/{org_slug}/staff/team/{member_id}/customer-link`](#op-put-api-v1-orgs-org-slug-staff-team-member-id-customer-link) | Attach a teammate to an existing customer account, or make them one with their email |
| DELETE | [`/api/v1/orgs/{org_slug}/staff/team/{member_id}/customer-link`](#op-delete-api-v1-orgs-org-slug-staff-team-member-id-customer-link) | Make a teammate console-only |
| POST | [`/api/v1/orgs/{org_slug}/staff/team/{member_id}/reset-mfa`](#op-post-api-v1-orgs-org-slug-staff-team-member-id-reset-mfa) | For a teammate who lost their phone: remove their second factor and end their sessions |
| POST | [`/api/v1/orgs/{org_slug}/staff/team/{member_id}/reset-password`](#op-post-api-v1-orgs-org-slug-staff-team-member-id-reset-password) | Staff reset member password |
| POST | [`/api/v1/orgs/{org_slug}/staff/team/{member_id}/revoke-sessions`](#op-post-api-v1-orgs-org-slug-staff-team-member-id-revoke-sessions) | Staff revoke member sessions |

### Staff invite member {#op-post-api-v1-orgs-org-slug-staff-team}

`POST /api/v1/orgs/{org_slug}/staff/team`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `email` | string (email) | yes |
| `name` | string or null | no |
| `role` | string | no |
| `send_invite_email` | boolean | no |
| `password` | string or null | no |
| `customer_link` | string | no |
| `customer_id` | integer or null | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `201` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Everyone on the brand, with role, last sign-in and whether they can sign in at all {#op-get-api-v1-orgs-org-slug-staff-team-detail}

`GET /api/v1/orgs/{org_slug}/staff/team/detail`

Everyone on the brand, with role, last sign-in and whether they can
sign in at all. The picker route (``/staff/team``) stays small; this is
the team page.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff team policy {#op-get-api-v1-orgs-org-slug-staff-team-policy}

`GET /api/v1/orgs/{org_slug}/staff/team/policy`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Require a second factor of everyone on the brand {#op-patch-api-v1-orgs-org-slug-staff-team-policy}

`PATCH /api/v1/orgs/{org_slug}/staff/team/policy`

Require a second factor of everyone on the brand. From the next sign-in
a member without one can only enrol until they have. The admin turning
it on must already have theirs, or they would be the first one locked
into enrolment.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `require_mfa` | boolean | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff change role {#op-patch-api-v1-orgs-org-slug-staff-team-member-id}

`PATCH /api/v1/orgs/{org_slug}/staff/team/{member_id}`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `member_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `role` | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff remove member {#op-delete-api-v1-orgs-org-slug-staff-team-member-id}

`DELETE /api/v1/orgs/{org_slug}/staff/team/{member_id}`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `member_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Which storefront customer account a teammate is, if any {#op-get-api-v1-orgs-org-slug-staff-team-member-id-customer-link}

`GET /api/v1/orgs/{org_slug}/staff/team/{member_id}/customer-link`

Which storefront customer account a teammate is, if any.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `member_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Attach a teammate to an existing customer account, or make them one with their email {#op-put-api-v1-orgs-org-slug-staff-team-member-id-customer-link}

`PUT /api/v1/orgs/{org_slug}/staff/team/{member_id}/customer-link`

Attach a teammate to an existing customer account, or make them one
with their email. Whoever holds the account holds its servers and its
money, so this is a step-up action, and any storefront sessions the
console opened on a previous account end.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `member_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `mode` | string | no |
| `customer_id` | integer or null | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Make a teammate console-only {#op-delete-api-v1-orgs-org-slug-staff-team-member-id-customer-link}

`DELETE /api/v1/orgs/{org_slug}/staff/team/{member_id}/customer-link`

Make a teammate console-only. The customer account stays as it is,
with its servers and invoices; only the tie to this teammate goes.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `member_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### For a teammate who lost their phone: remove their second factor and end their sessions {#op-post-api-v1-orgs-org-slug-staff-team-member-id-reset-mfa}

`POST /api/v1/orgs/{org_slug}/staff/team/{member_id}/reset-mfa`

For a teammate who lost their phone: remove their second factor and end
their sessions. They sign in with the password and, if the brand requires
it, enrol again straight away. Never for yourself (disable your own with
a code), and never for the owner from here.

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `member_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff reset member password {#op-post-api-v1-orgs-org-slug-staff-team-member-id-reset-password}

`POST /api/v1/orgs/{org_slug}/staff/team/{member_id}/reset-password`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `member_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Request body

`application/json` (required)

| Field | Type | Required |
| --- | --- | --- |
| `send_email` | boolean | no |
| `password` | string or null | no |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |

### Staff revoke member sessions {#op-post-api-v1-orgs-org-slug-staff-team-member-id-revoke-sessions}

`POST /api/v1/orgs/{org_slug}/staff/team/{member_id}/revoke-sessions`

#### Parameters

| Name | In | Type | Required |
| --- | --- | --- | --- |
| `member_id` | path | integer | yes |
| `org_slug` | path | string | yes |

#### Responses

| Status | Meaning |
| --- | --- |
| `200` | Success. |
| `422` | The request is not valid. `detail` lists each problem. |