Organization API: Organizations & Members: Settings

Part of Organizations & Members.

GET /api/v1/orgs/{org_slug}/settings

The organization's settings. domain_pointing says whether the platform serves the storefront on custom_domain: only a hostname the brand registry lists for the organization's brand is served, so no DNS record of the organization's points one here.

Fields of a 200 response:

PATCH /api/v1/orgs/{org_slug}/settings

Change the settings sent, and answer them as GET /settings does.

A new custom_domain is saved as its bare hostname and starts unverified, with the TXT record to publish in domain_verification; 409 when another organization has it. smtp_pass is write-only: smtp_pass_set says whether one is stored. mail_outbound is merged into features.mail.outbound, and whatever the stored block ends up as must name one of the organization's relay tenants and a domain on it unless its transport is smtp (422). google_analytics (enabled, measurement_id) is merged into features.google_analytics and into the Google Analytics 4 entry of features.tags, which PUT /{org_slug}/tags sets with every other platform: 422 for a measurement ID that is not a GA4 one, or for turning it on without one. 422 for null on a setting the row requires. Audited with the names of the keys sent, never their values.

application/json (required)

Fields of a 200 response:

POST /api/v1/orgs/{org_slug}/settings/custom-domain/verify

Check the custom domain's DNS now, and answer the settings row as GET /settings does: custom_domain_verified says whether it passed.

It passes once the record in domain_verification (TXT _coritan-org.<domain>, the row's token) is published. A verified domain is answered as it is, and changing the domain unverifies it. Admins and the owner; 422 without a custom domain; 409 when the domain changed during the check; 429 past twelve checks an hour.

Fields of a 200 response:

GET /api/v1/orgs/{org_slug}/settings/mail-outbound

The outbound transport block plus whether the in-house side can send now.

GET /api/v1/orgs/{org_slug}/settings/support-mailbox

Show the organization's own support mailbox.

Needs an owner or admin. Answers whether a mailbox is connected, the providers you can choose from, and for a connected mailbox its status, the IMAP login (without the password), when Coritan last read it, the last error, whether it is confirmed and what its messages became in the last 24 hours. A mailbox you removed answers as not configured.

Fields of a 200 response:

PUT /api/v1/orgs/{org_slug}/settings/support-mailbox

Connect or change the organization's own support mailbox.

Needs an owner or admin who confirmed their password in the last ten minutes. Saving does not sign in to the mailbox: use Test, then Send confirmation. A new mailbox, or a change to its address, reply name, host, username or password, makes it pending again and starts it afresh, so mail already in the Inbox is never imported. Leave the password out to keep the saved one. Refuses a value that is not usable with 422 and the name of the field, a host that is not a public mail server, an organization that already has a Coritan ticket address, and a login another organization already uses with 409.

application/json (required)

Fields of a 200 response:

DELETE /api/v1/orgs/{org_slug}/settings/support-mailbox

Disconnect the organization's own support mailbox.

Needs an owner or admin who confirmed their password in the last ten minutes. Coritan stops reading the mailbox at once, deletes the saved password and forgets where it stopped. Messages already turned into ticket replies stay. Ticket emails then no longer ask for replies at this mailbox. Removing a mailbox that is not connected is not an error.

Fields of a 200 response:

POST /api/v1/orgs/{org_slug}/settings/support-mailbox/test

Check that Coritan can sign in to the mailbox.

Needs an owner or admin who confirmed their password in the last ten minutes. Tests the saved login, or the login in the request when you send one (anything you leave out comes from the saved mailbox). It signs in, opens the Inbox read-only and counts its messages. It sends no email, changes no message and saves nothing. The answer says whether it worked and, when it did not, why. Refuses a host that is not a public mail server with 422. Ten tests an hour are allowed.

application/json

Fields of a 200 response:

POST /api/v1/orgs/{org_slug}/settings/support-mailbox/verify

Send the confirmation message that makes the mailbox active.

Needs an owner or admin who confirmed their password in the last ten minutes, and a saved mailbox that Coritan can sign in to. Coritan sends a short email to the mailbox's reply address with the organization's normal outgoing email. When Coritan reads it from the Inbox, the mailbox turns active and ticket emails start asking for replies there. Refuses with 409 when the mailbox is already active (add resend=1 to send it again), when its sign-in was refused, when it cannot be signed in to, or when the outgoing email did not accept the message. Ten confirmations an hour are allowed.

Fields of a 200 response: