Identity & Access

Manage identity and access. Assign access through account and project roles. Private resources may require additional permissions. Inspect usage by account, project, member, or API key. Use budgets to cap monthly AI spend. Users · Accounts · Invitations · Permissions · API keys · Authentication · Authorization

Users

Read the authenticated user’s profile. List, update, or remove account members. List pending invitations and active members across projects you own. List, read, remove, or update project members.

Endpoint	Methods	Description
`/account/invites`	GET	List account invites
`/accounts/{account_id}/members`	GET	List account members
`/account/users`	GET	List people on projects you own
`/account/users/{user_id}/analytics/ai-usage`	GET	Get account member AI usage analytics
`/accounts/{account_id}/members/{user_id}`	PATCH, DELETE	Update account member; Delete account member
`/projects/{project_reference}/users`	GET	List users
`/projects/{project_reference}/users/{user_id}`	GET, DELETE	Get user; Delete user
`/projects/{project_reference}/users/{user_id}/role`	PATCH	Update user role
`/me`	GET	Get current user

Accounts

List, create, or read accounts.

Endpoint	Methods	Description
`/accounts`	GET, POST	List accounts; Create account
`/accounts/{account_id}`	GET, PATCH	Get account; Update account

Invitations

Invite people to a project by email, list, resend or revoke project invitations, list invitations across your projects, and create, list, revoke or accept account invitations.

Endpoint	Methods	Description
`/accounts/{account_id}/invitations`	GET, POST	List account invitations; Create account invitation
`/accounts/-/invitations/preview`	POST	Preview account invitation
`/projects/{project_reference}/invitations`	GET, POST	List invitations; Create invitation
`/invitations`	GET	List invitations across projects
`/projects/{project_reference}/invitations/{invitation_id}`	GET, DELETE	Get invitation; Delete invitation
`/accounts/{account_id}/invitations/{invitation_id}`	DELETE	Delete account invitation
`/accounts/-/invitations/accept`	POST	Accept account invitation
`/projects/{project_reference}/invitations/{invitation_id}/resend`	POST	Resend invitation

Permissions

Transfer project ownership. Check access to a named plan or feature gate. Individual endpoints still enforce their resource permissions.

Endpoint	Methods	Description
`/gates/{gate}`	GET	Check gate access
`/projects/{project_reference}/users/{user_id}/transfer-ownership`	POST	Transfer ownership

API keys

Create, inspect, update, and revoke API keys. View API key usage in the Billing and Usage API.

Endpoint	Methods	Description
`/api-keys`	GET, POST	List API keys; Create API key
`/api-keys/{api_key_id}`	GET, PATCH, DELETE	Get API key; Update API key; Delete API key

Authentication

Sign in through an identity provider or a magic link, and sign out. Create access tokens and environment access tokens. Retrieve public verification keys from the JWKS endpoint.

Endpoint	Methods	Description
`/auth/{provider}`	GET	Start sign-in with an identity provider
`/auth/magic-links`	POST	Email a one-time sign-in link
`/auth/magiclink`	GET	Verify a magic link
`/auth/logout`	POST	Sign out the current session
`/projects/{project_reference}/environments/{environment_name}/access-tokens`	POST	Create environment access token
`/auth/token`	POST	Create access token from client credentials
`/.well-known/jwks.json`	GET	Get JSON Web Key Set

Authorization

Discover OAuth authorization and protected-resource metadata. Register public OAuth clients. Start, read, or decide MCP authorization requests. Exchange, rotate, or revoke OAuth tokens. List or revoke authorized MCP app grants.

Endpoint	Methods	Description
`/oauth/grants`	GET	List authorized apps
`/oauth/grants/{id}`	DELETE	Revoke an authorized app
`/.well-known/oauth-authorization-server`	GET	Discover OAuth authorization endpoints
`/oauth/token`	POST	Exchange an authorization code or refresh an access token
`/oauth/register`	POST	Register a public OAuth client
`/oauth/revoke`	POST	Revoke an OAuth token
`/oauth/authorize`	GET	Start OAuth authorization with PKCE
`/oauth/authorization-requests/{id}`	GET	Read an OAuth authorization request
`/oauth/authorization-requests/{id}/decision`	POST	Approve or deny OAuth access

Back to REST API reference

Get started

APIs

REST API

GraphQL API

MCP API

Users

Accounts

Invitations

Permissions

API keys

Authentication

Authorization

​Users

​Accounts

​Invitations

​Permissions

​API keys

​Authentication

​Authorization

Users

Accounts

Invitations

Permissions

API keys

Authentication

Authorization