> ## Documentation Index
> Fetch the complete documentation index at: https://veryfront.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity & Access

> Manage identity and access.

Manage identity and access.

Assign access through account and project roles. Private resources may require additional permissions.

Inspect usage by account, project, member, or API key. Use [budgets](/docs/cloud/rest/apis/billing-usage#budgets) to cap monthly AI spend.

[Users](#users) · [Accounts](#accounts) · [Invitations](#invitations) · [Permissions](#permissions) · [API keys](#api-keys) · [Authentication](#authentication) · [Authorization](#authorization)

## Users

Read the authenticated user’s profile.

List, update, or remove account members.

List pending invitations and active members across projects you own.

List, read, remove, or update project members.

| Endpoint | Methods | Description |
| - | - | - |
| `/account/invites` | [GET](/docs/cloud/rest/api-reference/identity-access-users-account-users/list-account-invites) | List account invites |
| `/accounts/{account_id}/members` | [GET](/docs/cloud/rest/api-reference/identity-access-users-account-users/list-account-members) | List account members |
| `/account/users` | [GET](/docs/cloud/rest/api-reference/identity-access-users-account-users/list-people-on-projects-you-own) | List people on projects you own |
| `/account/users/{user_id}/analytics/ai-usage` | [GET](/docs/cloud/rest/api-reference/identity-access-users-account-users/get-account-member-ai-usage-analytics) | Get account member AI usage analytics |
| `/accounts/{account_id}/members/{user_id}` | [PATCH](/docs/cloud/rest/api-reference/identity-access-users-account-users/update-account-member), [DELETE](/docs/cloud/rest/api-reference/identity-access-users-account-users/delete-account-member) | Update account member; Delete account member |
| `/projects/{project_reference}/users` | [GET](/docs/cloud/rest/api-reference/identity-access-users-project-users/list-users) | List users |
| `/projects/{project_reference}/users/{user_id}` | [GET](/docs/cloud/rest/api-reference/identity-access-users-project-users/get-user), [DELETE](/docs/cloud/rest/api-reference/identity-access-users-project-users/delete-user) | Get user; Delete user |
| `/projects/{project_reference}/users/{user_id}/role` | [PATCH](/docs/cloud/rest/api-reference/identity-access-users-project-users/update-user-role) | Update user role |
| `/me` | [GET](/docs/cloud/rest/api-reference/identity-access-users-current-user/get-current-user) | Get current user |

## Accounts

List, create, or read accounts.

| Endpoint | Methods | Description |
| - | - | - |
| `/accounts` | [GET](/docs/cloud/rest/api-reference/identity-access-accounts-accounts/list-accounts), [POST](/docs/cloud/rest/api-reference/identity-access-accounts-accounts/create-account) | List accounts; Create account |
| `/accounts/{account_id}` | [GET](/docs/cloud/rest/api-reference/identity-access-accounts-accounts/get-account), [PATCH](/docs/cloud/rest/api-reference/identity-access-accounts-accounts/update-account) | Get account; Update account |

## Invitations

Invite people to a project by email, list, resend or revoke project invitations, list invitations across your projects, and create, list, revoke or accept account invitations.

| Endpoint | Methods | Description |
| - | - | - |
| `/accounts/{account_id}/invitations` | [GET](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/list-account-invitations), [POST](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/create-account-invitation) | List account invitations; Create account invitation |
| `/accounts/-/invitations/preview` | [POST](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/preview-account-invitation) | Preview account invitation |
| `/projects/{project_reference}/invitations` | [GET](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/list-invitations), [POST](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/create-invitation) | List invitations; Create invitation |
| `/invitations` | [GET](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/list-invitations-across-projects) | List invitations across projects |
| `/projects/{project_reference}/invitations/{invitation_id}` | [GET](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/get-invitation), [DELETE](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/delete-invitation) | Get invitation; Delete invitation |
| `/accounts/{account_id}/invitations/{invitation_id}` | [DELETE](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/delete-account-invitation) | Delete account invitation |
| `/accounts/-/invitations/accept` | [POST](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/accept-account-invitation) | Accept account invitation |
| `/projects/{project_reference}/invitations/{invitation_id}/resend` | [POST](/docs/cloud/rest/api-reference/identity-access-invitations-invitations/resend-invitation) | Resend invitation |

## Permissions

Transfer project ownership.

Check access to a named plan or feature gate. Individual endpoints still enforce their resource permissions.

| Endpoint | Methods | Description |
| - | - | - |
| `/gates/{gate}` | [GET](/docs/cloud/rest/api-reference/identity-access-permissions-feature-gates/check-gate-access) | Check gate access |
| `/projects/{project_reference}/users/{user_id}/transfer-ownership` | [POST](/docs/cloud/rest/api-reference/identity-access-permissions-project-ownership/transfer-ownership) | Transfer ownership |

## API keys

Create, inspect, update, and revoke API keys. View [API key usage](/docs/cloud/rest/apis/billing-usage#usage) in the Billing and Usage API.

| Endpoint | Methods | Description |
| - | - | - |
| `/api-keys` | [GET](/docs/cloud/rest/api-reference/identity-access-api-keys-api-keys/list-api-keys), [POST](/docs/cloud/rest/api-reference/identity-access-api-keys-api-keys/create-api-key) | List API keys; Create API key |
| `/api-keys/{api_key_id}` | [GET](/docs/cloud/rest/api-reference/identity-access-api-keys-api-keys/get-api-key), [PATCH](/docs/cloud/rest/api-reference/identity-access-api-keys-api-keys/update-api-key), [DELETE](/docs/cloud/rest/api-reference/identity-access-api-keys-api-keys/delete-api-key) | Get API key; Update API key; Delete API key |

## Authentication

Sign in through an identity provider or a magic link, and sign out.

Create access tokens and environment access tokens. Retrieve public verification keys from [the JWKS endpoint](/docs/cloud/rest/api-reference/identity-access-authentication-tokens/get-json-web-key-set).

| Endpoint | Methods | Description |
| - | - | - |
| `/auth/{provider}` | [GET](/docs/cloud/rest/api-reference/identity-access-authentication-sign-in/start-sign-in-with-an-identity-provider) | Start sign-in with an identity provider |
| `/auth/magic-links` | [POST](/docs/cloud/rest/api-reference/identity-access-authentication-sign-in/email-a-one-time-sign-in-link) | Email a one-time sign-in link |
| `/auth/magiclink` | [GET](/docs/cloud/rest/api-reference/identity-access-authentication-sign-in/verify-a-magic-link) | Verify a magic link |
| `/auth/logout` | [POST](/docs/cloud/rest/api-reference/identity-access-authentication-sign-in/sign-out-the-current-session) | Sign out the current session |
| `/projects/{project_reference}/environments/{environment_name}/access-tokens` | [POST](/docs/cloud/rest/api-reference/identity-access-authentication-tokens/create-environment-access-token) | Create environment access token |
| `/auth/token` | [POST](/docs/cloud/rest/api-reference/identity-access-authentication-tokens/create-access-token-from-client-credentials) | Create access token from client credentials |
| `/.well-known/jwks.json` | [GET](/docs/cloud/rest/api-reference/identity-access-authentication-tokens/get-json-web-key-set) | Get JSON Web Key Set |

## Authorization

Discover OAuth authorization and protected-resource metadata.

Register public OAuth clients.

Start, read, or decide MCP authorization requests.

Exchange, rotate, or revoke OAuth tokens.

List or revoke authorized MCP app grants.

| Endpoint | Methods | Description |
| - | - | - |
| `/oauth/grants` | [GET](/docs/cloud/rest/api-reference/identity-access-authorization-authorized-apps/list-authorized-apps) | List authorized apps |
| `/oauth/grants/{id}` | [DELETE](/docs/cloud/rest/api-reference/identity-access-authorization-authorized-apps/revoke-an-authorized-app) | Revoke an authorized app |
| `/.well-known/oauth-authorization-server` | [GET](/docs/cloud/rest/api-reference/identity-access-authorization-general-oauth/discover-oauth-authorization-endpoints) | Discover OAuth authorization endpoints |
| `/oauth/token` | [POST](/docs/cloud/rest/api-reference/identity-access-authorization-general-oauth/exchange-an-authorization-code-or-refresh-an-access-token) | Exchange an authorization code or refresh an access token |
| `/oauth/register` | [POST](/docs/cloud/rest/api-reference/identity-access-authorization-general-oauth/register-a-public-oauth-client) | Register a public OAuth client |
| `/oauth/revoke` | [POST](/docs/cloud/rest/api-reference/identity-access-authorization-general-oauth/revoke-an-oauth-token) | Revoke an OAuth token |
| `/oauth/authorize` | [GET](/docs/cloud/rest/api-reference/identity-access-authorization-general-oauth/start-oauth-authorization-with-pkce) | Start OAuth authorization with PKCE |
| `/oauth/authorization-requests/{id}` | [GET](/docs/cloud/rest/api-reference/identity-access-authorization-consent/read-an-oauth-authorization-request) | Read an OAuth authorization request |
| `/oauth/authorization-requests/{id}/decision` | [POST](/docs/cloud/rest/api-reference/identity-access-authorization-consent/approve-or-deny-oauth-access) | Approve or deny OAuth access |

[Back to REST API reference](/docs/cloud/rest)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.