Platform
57 endpoints
Admins
6 endpoints
/api/v1/platform/adminsList platform admins
List all users with platform access and their group assignments. Requires ``platform.admins.list`` permission.
Parameters
Query Parameters
searchstringFilter by email or name (case-insensitive).
pageintegerPage number (1-based).
Default: 1
page_sizeintegerItems per page (max 100).
Default: 25
Responses
itemsobject[]requiredList of platform admin users.
totalintegerrequiredTotal number of platform admins matching the query.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/admins" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/admins" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/admins/{admin_uuid}Get platform admin detail
Get detailed info for a platform admin including groups, org access, and effective permissions. Requires ``platform.admins.read`` permission. Raises 404 if the user is not found or does not have platform access.
Parameters
Path Parameters
admin_uuidstringrequiredResponses
created_atstring (date-time)requiredAccount creation timestamp.
display_namestringrequiredDisplay name.
effective_permissionsstring[]Flat list of all effective permission keys.
emailstringrequiredEmail address.
groupsobject[]Permission groups with system flag.
idstring (uuid)requiredPublic UUID of the user.
is_global_accessbooleanrequiredWhether the user has global org access.
last_login_atstring (date-time)org_accessobject[]Explicit org access grants.
statusstringrequiredUser account status. One of: active, suspended, deactivated.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/admins/{admin_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/admins/{admin_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/orgsList organizations
List all organizations in the platform. Requires ``platform.orgs.list`` permission.
Parameters
Query Parameters
searchstringFilter by org name or slug (case-insensitive).
statusstringFilter by org status (active, migrating, suspended).
pageintegerPage number (1-based).
Default: 1
page_sizeintegerItems per page.
Default: 50
Responses
itemsobject[]requiredList of organizations.
totalintegerrequiredTotal number of organizations matching the query.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/orgs" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/orgs" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/adminsCreate platform admin
Grant platform access to a user and assign an initial permission group. Creates the user if one with the given email does not already exist. Requires ``platform.admins.create`` permission. Raises 409 if the user already has platform access.
Request Body
display_namestringrequiredDisplay name for the user.
emailstringrequiredEmail address of the user to grant platform access.
group_uuidstring (uuid)requiredPublic UUID of the permission group to assign as the initial group.
Responses
created_atstring (date-time)requiredAccount creation timestamp.
display_namestringrequiredDisplay name.
emailstringrequiredEmail address.
groupsobject[]Permission groups assigned to this user.
idstring (uuid)requiredPublic UUID of the user.
is_global_accessbooleanrequiredWhether the user has global org access.
last_login_atstring (date-time)org_access_countintegerNumber of explicit org access grants.
statusstringrequiredUser account status. One of: active, suspended, deactivated.
detailobject[]curl -X POST "https://api.example.com/api/v1/platform/admins" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"display_name": "string",
"email": "string",
"group_uuid": "00000000-0000-0000-0000-000000000000"
}'curl -X POST "https://api.example.com/api/v1/platform/admins" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"display_name": "string",
"email": "string",
"group_uuid": "00000000-0000-0000-0000-000000000000"
}'/api/v1/platform/admins/{admin_uuid}Update platform admin
Update a platform admin's profile fields (display_name, email). Requires ``platform.admins.update`` permission. Raises 404 if the user is not found or does not have platform access.
Parameters
Path Parameters
admin_uuidstringrequiredRequest Body
display_namestringemailstringResponses
created_atstring (date-time)requiredAccount creation timestamp.
display_namestringrequiredDisplay name.
emailstringrequiredEmail address.
groupsobject[]Permission groups assigned to this user.
idstring (uuid)requiredPublic UUID of the user.
is_global_accessbooleanrequiredWhether the user has global org access.
last_login_atstring (date-time)org_access_countintegerNumber of explicit org access grants.
statusstringrequiredUser account status. One of: active, suspended, deactivated.
detailobject[]curl -X PATCH "https://api.example.com/api/v1/platform/admins/{admin_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"display_name": "string",
"email": "string"
}'curl -X PATCH "https://api.example.com/api/v1/platform/admins/{admin_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"display_name": "string",
"email": "string"
}'/api/v1/platform/admins/{admin_uuid}Revoke platform admin
Remove all platform access from a user. Deletes all group assignments and org access entries. Sets ``has_platform_access = False`` and ``is_global_access = False``. Requires ``platform.admins.revoke`` permission. Raises 404 if user not found or not a platform admin. Raises 400 if this would leave no users with the ``platform.admins.create`` permission.
Parameters
Path Parameters
admin_uuidstringrequiredResponses
detailobject[]curl -X DELETE "https://api.example.com/api/v1/platform/admins/{admin_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X DELETE "https://api.example.com/api/v1/platform/admins/{admin_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"Assignments
3 endpoints
/api/v1/platform/admins/{admin_uuid}/assignmentsList a platform admin's group assignments
List all group assignments for a platform admin. Requires ``platform.admins.read`` permission. Raises 404 if the admin user is not found.
Parameters
Path Parameters
admin_uuidstringrequiredResponses
itemsobject[]requiredList of group assignments for the platform admin.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/admins/{admin_uuid}/assignments" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/admins/{admin_uuid}/assignments" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/admins/{admin_uuid}/assignmentsAssign a group to a platform admin
Assign a permission group to a platform admin. Requires ``platform.admins.update`` permission. Anti-escalation: the caller cannot assign groups containing permissions they do not hold. Raises 404 if the admin user or group is not found. Raises 409 if the user already has this group assigned. Raises 403 if anti-escalation check fails.
Parameters
Path Parameters
admin_uuidstringrequiredRequest Body
expires_atstring (date-time)group_uuidstring (uuid)requiredPublic UUID of the permission group to assign.
Responses
assigned_atstring (date-time)requiredTimestamp when the assignment was created.
assigned_byobjectrequiredReference to the user who created this assignment (id + display_name).
expires_atstring (date-time)groupobjectrequiredReference to the assigned permission group (id + name).
idstring (uuid)requiredPublic UUID of the assignment.
is_activebooleanrequiredWhether this assignment is currently active.
detailobject[]curl -X POST "https://api.example.com/api/v1/platform/admins/{admin_uuid}/assignments" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"expires_at": "string",
"group_uuid": "00000000-0000-0000-0000-000000000000"
}'curl -X POST "https://api.example.com/api/v1/platform/admins/{admin_uuid}/assignments" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"expires_at": "string",
"group_uuid": "00000000-0000-0000-0000-000000000000"
}'/api/v1/platform/admins/{admin_uuid}/assignments/{assignment_uuid}Remove a group assignment
Remove a group assignment from a platform admin. Requires ``platform.admins.update`` permission. Raises 404 if the admin user or assignment is not found. Raises 400 if removing this assignment would leave no users with the ``platform.admins.create`` permission.
Parameters
Path Parameters
admin_uuidstringrequiredassignment_uuidstringrequiredResponses
detailobject[]curl -X DELETE "https://api.example.com/api/v1/platform/admins/{admin_uuid}/assignments/{assignment_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X DELETE "https://api.example.com/api/v1/platform/admins/{admin_uuid}/assignments/{assignment_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"Audit
5 endpoints
/api/v1/platform/auditList audit log entries
Return a paginated list of audit log entries across all organizations. Queries the ``platform_audit_log`` control-plane table. Supports filtering by org, actor, action(s), resource type, date range, and free-text search. Results are sortable and paginated. Requires ``platform.audit.read`` permission.
Parameters
Query Parameters
org_uuidstringFilter by organization UUID.
actor_idstringFilter by actor identifier.
actionstring[]Filter by action types (supports multiple values).
resource_typestringFilter by resource type (e.g., 'patient', 'appointment').
searchstringFree-text search across actor, resource type, and resource ID.
start_datestringStart of date range filter (inclusive, ISO 8601).
end_datestringEnd of date range filter (inclusive, ISO 8601).
sort_bystringColumn to sort by. One of: created_at, action, resource_type, actor_id.
Default: "created_at"
sort_orderstringSort direction. One of: asc, desc.
Default: "desc"
pageintegerPage number (1-based).
Default: 1
page_sizeintegerItems per page (max 100).
Default: 25
Responses
itemsobject[]requiredList of audit log entries.
totalintegerrequiredTotal number of entries matching the query filters.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/audit" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/audit" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/audit/{entry_uuid}Get audit entry detail
Fetch a single audit entry with full before/after snapshots. The summary data comes from the control-plane ``platform_audit_log``. Before/after JSON snapshots are fetched from the originating tenant schema. If the tenant data is unavailable, before/after will be null. Requires ``platform.audit.read`` permission. Raises 404 if the entry UUID is not found.
Parameters
Path Parameters
entry_uuidstringrequiredResponses
actionstringrequiredAction performed (e.g., 'create', 'update', 'delete').
actor_display_namestringactor_idstringrequiredIdentifier of the actor who performed the action.
actor_typestringrequiredType of actor. One of: user, system, api_key.
afterobjectbeforeobjectcreated_atstring (date-time)requiredTimestamp when the audit entry was created.
idstring (uuid)requiredPublic UUID of the audit log entry.
ip_addressstringorg_idstring (uuid)org_namestringresource_display_idstringrequiredHuman-readable identifier of the affected resource.
resource_typestringrequiredType of resource affected (e.g., 'patient', 'appointment').
trace_idstringdetailobject[]curl -X GET "https://api.example.com/api/v1/platform/audit/{entry_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/audit/{entry_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/audit/exportExport audit logs as CSV
Stream audit log entries as a CSV file download. Applies the same filters as the list endpoint. Returns a streaming CSV response suitable for direct download. Requires ``platform.audit.export`` permission.
Parameters
Query Parameters
org_uuidstringFilter by organization UUID.
actor_idstringFilter by actor identifier.
actionstring[]Filter by action types.
resource_typestringFilter by resource type.
searchstringFree-text search.
start_datestringStart of date range.
end_datestringEnd of date range.
Responses
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/audit/export" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/audit/export" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/audit/resource-typesList distinct resource types
Return distinct ``resource_type`` values across all audit entries. Useful for populating a filter dropdown in the UI. Requires ``platform.audit.read`` permission.
Responses
curl -X GET "https://api.example.com/api/v1/platform/audit/resource-types" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/audit/resource-types" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/audit/statsGet audit statistics
Return aggregate audit statistics: totals, by-action, by-resource-type, today's count, and active actors today. Requires ``platform.audit.read`` permission.
Parameters
Query Parameters
org_uuidstringFilter stats to a specific organization.
start_datestringStart of date range filter (inclusive, ISO 8601).
end_datestringEnd of date range filter (inclusive, ISO 8601).
Responses
active_actors_todayintegerrequiredNumber of distinct actors who performed actions today.
by_actionobjectrequiredCount of entries grouped by action (e.g., {'create': 42, 'update': 100}).
by_resource_typeobject[]requiredTop resource types by entry count.
today_countintegerrequiredNumber of audit entries created today.
total_entriesintegerrequiredTotal audit entries matching filters.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/audit/stats" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/audit/stats" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"Billing
2 endpoints
/api/v1/platform/orgs/{org_uuid}/billingGet org billing info
Return billing information for an organization. Reads ``account_type``, ``max_locations``, and ``billing_email`` from the OrgRegistry record. Requires ``platform.billing.read`` permission and org access. Raises 404 if the organization does not exist.
Parameters
Path Parameters
org_uuidstringrequiredResponses
account_typestringrequiredAccount tier. One of: starter, professional, enterprise.
billing_emailstringmax_locationsintegerrequiredMaximum number of locations allowed for the org.
org_idstring (uuid)requiredPublic UUID of the organization.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/orgs/{org_uuid}/billing" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/orgs/{org_uuid}/billing" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/orgs/{org_uuid}/billingUpdate org billing info
Update billing fields for an organization. Only provided (non-None) fields are applied. Updates are applied via the existing org update path which handles version bumping. Requires ``platform.billing.update`` permission and org access. Raises 404 if the organization does not exist. Raises 422 if validation fails (invalid account_type, max_locations < 1, bad email).
Parameters
Path Parameters
org_uuidstringrequiredRequest Body
account_typestringbilling_emailstringmax_locationsintegerResponses
account_typestringrequiredAccount tier. One of: starter, professional, enterprise.
billing_emailstringmax_locationsintegerrequiredMaximum number of locations allowed for the org.
org_idstring (uuid)requiredPublic UUID of the organization.
detailobject[]curl -X PATCH "https://api.example.com/api/v1/platform/orgs/{org_uuid}/billing" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"account_type": "string",
"billing_email": "string",
"max_locations": 1
}'curl -X PATCH "https://api.example.com/api/v1/platform/orgs/{org_uuid}/billing" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"account_type": "string",
"billing_email": "string",
"max_locations": 1
}'Groups
6 endpoints
/api/v1/platform/groupsList platform permission groups
List all platform permission groups with user and permission counts. Requires ``platform.groups.list`` permission.
Responses
itemsobject[]requiredList of platform permission groups.
curl -X GET "https://api.example.com/api/v1/platform/groups" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/groups" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/groups/{group_uuid}View platform group detail
View a platform permission group's detail including permissions and assigned users. Requires ``platform.groups.read`` permission. Raises 404 if the group is not found.
Parameters
Path Parameters
group_uuidstringrequiredResponses
assigned_usersobject[]Users currently assigned to this group.
descriptionstringrequiredGroup description.
idstring (uuid)requiredPublic UUID of the permission group.
is_systembooleanrequiredWhether this is a system-defined group.
namestringrequiredGroup display name.
permissionsobject[]Permissions included in this group.
statusstringrequiredGroup status. One of: active, archived.
versionintegerrequiredCurrent version for optimistic concurrency.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/groups/{group_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/groups/{group_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/permissionsList all platform permissions
List all registered platform permissions. Used by the group editor UI to display available permissions. Requires ``platform.groups.read`` permission.
Responses
domainsstring[]requiredSorted list of distinct permission domains.
itemsobject[]requiredAll registered platform permissions.
curl -X GET "https://api.example.com/api/v1/platform/permissions" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/permissions" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/groupsCreate platform permission group
Create a new custom platform permission group. Requires ``platform.groups.create`` permission. Anti-escalation: cannot include permissions the caller does not hold. Raises 409 if a group with the same name already exists. Raises 403 if any requested permission exceeds the caller's own.
Request Body
descriptionstringDescription of what this group grants access to.
namestringrequiredDisplay name for the group (must be unique).
permission_keysstring[]List of permission key strings to include in the group.
Responses
assigned_usersobject[]Users currently assigned to this group.
descriptionstringrequiredGroup description.
idstring (uuid)requiredPublic UUID of the permission group.
is_systembooleanrequiredWhether this is a system-defined group.
namestringrequiredGroup display name.
permissionsobject[]Permissions included in this group.
statusstringrequiredGroup status. One of: active, archived.
versionintegerrequiredCurrent version for optimistic concurrency.
detailobject[]curl -X POST "https://api.example.com/api/v1/platform/groups" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"description": "",
"name": "string",
"permission_keys": []
}'curl -X POST "https://api.example.com/api/v1/platform/groups" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"description": "",
"name": "string",
"permission_keys": []
}'/api/v1/platform/groups/{group_uuid}Update platform permission group
Update a custom platform permission group. Requires ``platform.groups.update`` permission. Uses optimistic concurrency via ``base_version``. Anti-escalation: cannot add permissions the caller does not hold. Raises 404 if the group is not found. Raises 422 if the group is a system group. Raises 409 if the version does not match.
Parameters
Path Parameters
group_uuidstringrequiredRequest Body
add_permissionsstring[]Permission keys to add to the group.
base_versionintegerrequiredCurrent version for optimistic concurrency — rejected with 409 if stale.
descriptionstringnamestringremove_permissionsstring[]Permission keys to remove from the group.
Responses
assigned_usersobject[]Users currently assigned to this group.
descriptionstringrequiredGroup description.
idstring (uuid)requiredPublic UUID of the permission group.
is_systembooleanrequiredWhether this is a system-defined group.
namestringrequiredGroup display name.
permissionsobject[]Permissions included in this group.
statusstringrequiredGroup status. One of: active, archived.
versionintegerrequiredCurrent version for optimistic concurrency.
detailobject[]curl -X PATCH "https://api.example.com/api/v1/platform/groups/{group_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"add_permissions": [],
"base_version": 1,
"description": "string",
"name": "string",
"remove_permissions": []
}'curl -X PATCH "https://api.example.com/api/v1/platform/groups/{group_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"add_permissions": [],
"base_version": 1,
"description": "string",
"name": "string",
"remove_permissions": []
}'/api/v1/platform/groups/{group_uuid}Delete platform permission group
Delete (archive) a custom platform permission group. Requires ``platform.groups.delete`` permission. Raises 404 if the group is not found. Raises 422 if the group is a system group. Raises 422 if the group still has active user assignments.
Parameters
Path Parameters
group_uuidstringrequiredResponses
detailobject[]curl -X DELETE "https://api.example.com/api/v1/platform/groups/{group_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X DELETE "https://api.example.com/api/v1/platform/groups/{group_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"Impersonation
3 endpoints
/api/v1/platform/impersonation/sessionsList impersonation sessions
List impersonation session history with optional filters. Requires ``platform.impersonation.read`` permission. Supports filtering by admin user, target user, and active status. Results are ordered by ``started_at`` descending (most recent first).
Parameters
Query Parameters
admin_user_uuidstringFilter by admin user UUID.
target_user_uuidstringFilter by target (impersonated) user UUID.
active_onlybooleanIf true, return only active (non-ended, non-expired) sessions.
Default: false
pageintegerPage number (1-based).
Default: 1
page_sizeintegerItems per page (max 100).
Default: 25
Responses
itemsobject[]requiredList of impersonation sessions.
totalintegerrequiredTotal number of sessions matching the query.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/impersonation/sessions" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/impersonation/sessions" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/impersonation/endEnd impersonation session
End the caller's active impersonation session. Finds the most recent active (non-expired, non-ended) impersonation session for the caller and sets ``ended_at`` to the current timestamp. Requires ``platform.impersonation.start`` permission. Raises 404 if no active impersonation session exists for the caller.
Responses
curl -X POST "https://api.example.com/api/v1/platform/impersonation/end" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X POST "https://api.example.com/api/v1/platform/impersonation/end" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/impersonation/startStart impersonation session
Start an impersonation session for a platform admin. Creates a time-limited impersonation token that allows the admin to act as the target user within the target organization. Validations: - Caller has ``platform.impersonation.start`` permission (enforced by dependency). - Caller has org access to the target organization. - Target user is active (not deactivated). - Target user has an active membership in the target organization. - Caller cannot impersonate themselves. - Caller does not already have an active impersonation session. Raises 403 if caller lacks org access to the target organization. Raises 404 if the target user or organization is not found. Raises 422 if the target user is deactivated, has no org membership, or the caller is trying to self-impersonate.
Request Body
org_uuidstring (uuid)requiredPublic UUID of the target organization context.
reasonstringrequiredReason for the impersonation session. Must be at least 10 characters.
user_uuidstring (uuid)requiredPublic UUID of the target user to impersonate.
Responses
expires_atstring (date-time)requiredUTC timestamp when the impersonation token expires.
session_idstring (uuid)requiredPublic UUID of the impersonation session.
target_orgobjectrequiredReference to the target organization (id + name).
target_userobjectrequiredReference to the impersonated user (id + display_name).
tokenstringrequiredImpersonation token prefixed with 'imp_'. Use in Authorization header.
detailobject[]curl -X POST "https://api.example.com/api/v1/platform/impersonation/start" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"org_uuid": "00000000-0000-0000-0000-000000000000",
"reason": "string",
"user_uuid": "00000000-0000-0000-0000-000000000000"
}'curl -X POST "https://api.example.com/api/v1/platform/impersonation/start" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"org_uuid": "00000000-0000-0000-0000-000000000000",
"reason": "string",
"user_uuid": "00000000-0000-0000-0000-000000000000"
}'Me
2 endpoints
/api/v1/platform/meGet current platform user profile
Get current platform user profile with groups and effective permissions. Returns the user's profile, assigned permission groups, and a flat list of all effective permission keys from those groups. Raises 403 when no actor identity is resolved. Raises 404 when the user record is not found.
Responses
display_namestringrequiredDisplay name.
effective_permissionsstring[]List of all effective permission keys.
emailstringrequiredEmail address.
groupsobject[]Permission groups assigned to this user.
has_platform_accessbooleanrequiredWhether the user has platform access.
idstring (uuid)requiredPublic UUID of the user.
is_global_accessbooleanrequiredWhether the user has global org access.
last_login_atstring (date-time)statusstringrequiredUser account status.
curl -X GET "https://api.example.com/api/v1/platform/me" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/me" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/my-orgsGet accessible organizations
Get minimal org list for navigation, filtered by org access. If user has global access, returns all orgs (paginated) with is_global=true. Otherwise returns only the orgs explicitly granted access to. Raises 403 when no actor identity is resolved.
Parameters
Query Parameters
pageintegerPage number (1-based).
Default: 1
page_sizeintegerItems per page.
Default: 50
Responses
is_globalbooleanrequiredWhether the user has global org access.
itemsobject[]List of accessible organizations.
totalintegerrequiredTotal number of accessible organizations.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/my-orgs" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/my-orgs" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"Org Access
4 endpoints
/api/v1/platform/admins/{admin_uuid}/org-accessList a platform admin's org access entries
List all org access entries for a platform admin. Requires ``platform.org_access.read`` permission. Raises 404 if the admin user is not found.
Parameters
Path Parameters
admin_uuidstringrequiredResponses
itemsobject[]requiredList of org access entries for the platform admin.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/admins/{admin_uuid}/org-access" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/admins/{admin_uuid}/org-access" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/admins/{admin_uuid}/org-accessGrant org access to a platform admin
Grant a platform admin access to a specific organization. Requires ``platform.org_access.grant`` permission. Raises 404 if the admin user or organization is not found. Raises 409 if the user already has access to this organization.
Parameters
Path Parameters
admin_uuidstringrequiredRequest Body
notestringorg_uuidstring (uuid)requiredPublic UUID of the organization to grant access to.
Responses
granted_atstring (date-time)requiredTimestamp when the access was granted.
granted_byobjectrequiredReference to the user who granted this access (id + display_name).
idstring (uuid)requiredPublic UUID of the org access entry.
notestringorgobjectrequiredReference to the organization (id + name).
detailobject[]curl -X POST "https://api.example.com/api/v1/platform/admins/{admin_uuid}/org-access" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"note": "string",
"org_uuid": "00000000-0000-0000-0000-000000000000"
}'curl -X POST "https://api.example.com/api/v1/platform/admins/{admin_uuid}/org-access" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"note": "string",
"org_uuid": "00000000-0000-0000-0000-000000000000"
}'/api/v1/platform/admins/{admin_uuid}/org-access/globalToggle global org access for a platform admin
Toggle a platform admin's global org access. When enabled, the user can access all organizations without explicit per-org grants. Requires ``platform.org_access.grant`` permission. Raises 404 if the admin user is not found or is not a platform admin.
Parameters
Path Parameters
admin_uuidstringrequiredRequest Body
is_globalbooleanrequiredWhether the user should have global access to all organizations.
Responses
idstring (uuid)requiredPublic UUID of the user.
is_global_accessbooleanrequiredUpdated global access status.
detailobject[]curl -X PUT "https://api.example.com/api/v1/platform/admins/{admin_uuid}/org-access/global" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"is_global": false
}'curl -X PUT "https://api.example.com/api/v1/platform/admins/{admin_uuid}/org-access/global" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"is_global": false
}'/api/v1/platform/admins/{admin_uuid}/org-access/{org_uuid}Revoke org access from a platform admin
Revoke a platform admin's access to a specific organization. Requires ``platform.org_access.revoke`` permission. Raises 404 if the admin user is not found or the org access entry does not exist.
Parameters
Path Parameters
admin_uuidstringrequiredorg_uuidstringrequiredResponses
detailobject[]curl -X DELETE "https://api.example.com/api/v1/platform/admins/{admin_uuid}/org-access/{org_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X DELETE "https://api.example.com/api/v1/platform/admins/{admin_uuid}/org-access/{org_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"Orgs
7 endpoints
/api/v1/platform/orgs/{org_uuid}Get organization detail
Return full details for a single organization. Requires ``platform.orgs.read`` permission. Raises 404 if the organization does not exist.
Parameters
Path Parameters
org_uuidstringrequiredResponses
account_typestringrequiredAccount tier. One of: starter, professional, enterprise.
billing_emailstringcontact_emailstringcontact_namestringcontact_phonestringcreated_atstring (date-time)requiredOrganization creation timestamp.
hq_address_line1stringhq_address_line2stringhq_citystringhq_countrystringhq_postal_codestringhq_statestringidstring (uuid)requiredPublic UUID of the organization.
internal_notesstringmax_locationsintegerrequiredMaximum number of locations allowed.
namestringrequiredOrganization display name.
onboarding_statusstringrequiredOnboarding status. One of: pending, in_progress, completed.
schema_namestringrequiredTenant database schema name.
slugstringrequiredURL-safe slug (unique).
statusstringrequiredOrg status. One of: active, migrating, suspended.
tax_idstringupdated_atstring (date-time)requiredLast update timestamp.
versionintegerrequiredCurrent version for optimistic concurrency -- rejected with 409 if stale.
websitestringdetailobject[]curl -X GET "https://api.example.com/api/v1/platform/orgs/{org_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/orgs/{org_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/orgs/{org_uuid}/membersList organization members
List members of an organization with search, filtering, and pagination. Returns user details alongside membership status and role hint. Requires ``platform.users.read`` permission.
Parameters
Path Parameters
org_uuidstringrequiredQuery Parameters
searchstringFilter by email or display name (case-insensitive).
statusstringFilter by membership status (invited, active, suspended, removed).
sort_bystringSort column. One of: display_name, email, joined_at.
Default: "display_name"
sort_orderstringSort direction. One of: asc, desc.
Default: "asc"
pageintegerPage number (1-based).
Default: 1
page_sizeintegerItems per page (max 200).
Default: 50
Responses
itemsobject[]requiredList of org members.
totalintegerrequiredTotal number of members matching the query.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/orgs/{org_uuid}/members" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/orgs/{org_uuid}/members" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/orgsCreate organization
Provision a new organization with its tenant schema. Creates the org record, provisions the database schema on an available shard, seeds default coverage categories, and optionally bootstraps an admin user. Requires ``platform.orgs.create`` permission. Raises 409 if the slug is already taken. Raises 503 if no shard capacity is available.
Request Body
account_typestringadmin_user_uuidstring (uuid)billing_emailstringcontact_emailstringcontact_namestringcontact_phonestringhq_address_line1stringhq_address_line2stringhq_citystringhq_countrystringhq_postal_codestringhq_statestringinternal_notesstringmax_locationsintegernamestringrequiredOrganization display name.
slugstringrequiredURL-safe slug (lowercase kebab-case, max 100 chars, must be unique).
tax_idstringwebsitestringResponses
account_typestringrequiredAccount tier. One of: starter, professional, enterprise.
billing_emailstringcontact_emailstringcontact_namestringcontact_phonestringcreated_atstring (date-time)requiredOrganization creation timestamp.
hq_address_line1stringhq_address_line2stringhq_citystringhq_countrystringhq_postal_codestringhq_statestringidstring (uuid)requiredPublic UUID of the organization.
internal_notesstringmax_locationsintegerrequiredMaximum number of locations allowed.
namestringrequiredOrganization display name.
onboarding_statusstringrequiredOnboarding status. One of: pending, in_progress, completed.
schema_namestringrequiredTenant database schema name.
slugstringrequiredURL-safe slug (unique).
statusstringrequiredOrg status. One of: active, migrating, suspended.
tax_idstringupdated_atstring (date-time)requiredLast update timestamp.
versionintegerrequiredCurrent version for optimistic concurrency -- rejected with 409 if stale.
websitestringdetailobject[]curl -X POST "https://api.example.com/api/v1/platform/orgs" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"account_type": "string",
"admin_user_uuid": "string",
"billing_email": "string",
"contact_email": "string",
"contact_name": "string",
"name": "string",
"slug": "string"
}'curl -X POST "https://api.example.com/api/v1/platform/orgs" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"account_type": "string",
"admin_user_uuid": "string",
"billing_email": "string",
"contact_email": "string",
"contact_name": "string",
"name": "string",
"slug": "string"
}'/api/v1/platform/orgs/{org_uuid}/seedSeed demo data
Queue realistic demo data seeding for an organization. Populates the org schema with definitions, locations, codes, providers, patients, and appointments. The operation is idempotent -- existing data is skipped, not replaced. Requires ``platform.orgs.seed`` permission.
Parameters
Path Parameters
org_uuidstringrequiredResponses
cancel_requested_atstring (date-time)completed_atstring (date-time)created_atstring (date-time)requiredcurrent_messagestringcurrent_stagestringerrorsstring[]events_urlstringrequiredheartbeat_atstring (date-time)job_uuidstring (uuid)requiredorg_idstring (uuid)requiredprogress_currentintegerprogress_totalintegerrequest_payloadobjectrequested_atstring (date-time)requiredrequested_byintegerseed_typestringrequiredstarted_atstring (date-time)statisticsobjectstatusstringrequiredstatus_urlstringrequiredupdated_atstring (date-time)requiredworker_idstringdetailobject[]curl -X POST "https://api.example.com/api/v1/platform/orgs/{org_uuid}/seed" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X POST "https://api.example.com/api/v1/platform/orgs/{org_uuid}/seed" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/orgs/{org_uuid}/suspendSuspend organization
Suspend an organization (soft-disable). Sets the org status to ``suspended``. A suspended org cannot be accessed by its members. The org can later be hard-deleted. Requires ``platform.orgs.suspend`` permission. Raises 404 if the organization does not exist.
Parameters
Path Parameters
org_uuidstringrequiredResponses
account_typestringrequiredAccount tier. One of: starter, professional, enterprise.
billing_emailstringcontact_emailstringcontact_namestringcontact_phonestringcreated_atstring (date-time)requiredOrganization creation timestamp.
hq_address_line1stringhq_address_line2stringhq_citystringhq_countrystringhq_postal_codestringhq_statestringidstring (uuid)requiredPublic UUID of the organization.
internal_notesstringmax_locationsintegerrequiredMaximum number of locations allowed.
namestringrequiredOrganization display name.
onboarding_statusstringrequiredOnboarding status. One of: pending, in_progress, completed.
schema_namestringrequiredTenant database schema name.
slugstringrequiredURL-safe slug (unique).
statusstringrequiredOrg status. One of: active, migrating, suspended.
tax_idstringupdated_atstring (date-time)requiredLast update timestamp.
versionintegerrequiredCurrent version for optimistic concurrency -- rejected with 409 if stale.
websitestringdetailobject[]curl -X POST "https://api.example.com/api/v1/platform/orgs/{org_uuid}/suspend" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X POST "https://api.example.com/api/v1/platform/orgs/{org_uuid}/suspend" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/orgs/{org_uuid}Update organization
Update an organization's details. Only provided (non-None) fields are applied. Uses optimistic concurrency via ``base_version`` -- returns 409 if the version is stale. Requires ``platform.orgs.update`` permission. Raises 404 if the organization does not exist. Raises 409 on slug conflict or version mismatch.
Parameters
Path Parameters
org_uuidstringrequiredRequest Body
account_typestringbase_versionintegerrequiredCurrent version for optimistic concurrency -- rejected with 409 if stale.
billing_emailstringcontact_emailstringcontact_namestringcontact_phonestringhq_address_line1stringhq_address_line2stringhq_citystringhq_countrystringhq_postal_codestringhq_statestringinternal_notesstringmax_locationsintegernamestringonboarding_statusstringslugstringtax_idstringwebsitestringResponses
account_typestringrequiredAccount tier. One of: starter, professional, enterprise.
billing_emailstringcontact_emailstringcontact_namestringcontact_phonestringcreated_atstring (date-time)requiredOrganization creation timestamp.
hq_address_line1stringhq_address_line2stringhq_citystringhq_countrystringhq_postal_codestringhq_statestringidstring (uuid)requiredPublic UUID of the organization.
internal_notesstringmax_locationsintegerrequiredMaximum number of locations allowed.
namestringrequiredOrganization display name.
onboarding_statusstringrequiredOnboarding status. One of: pending, in_progress, completed.
schema_namestringrequiredTenant database schema name.
slugstringrequiredURL-safe slug (unique).
statusstringrequiredOrg status. One of: active, migrating, suspended.
tax_idstringupdated_atstring (date-time)requiredLast update timestamp.
versionintegerrequiredCurrent version for optimistic concurrency -- rejected with 409 if stale.
websitestringdetailobject[]curl -X PATCH "https://api.example.com/api/v1/platform/orgs/{org_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"account_type": "string",
"base_version": 1,
"billing_email": "string",
"contact_email": "string",
"contact_name": "string"
}'curl -X PATCH "https://api.example.com/api/v1/platform/orgs/{org_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"account_type": "string",
"base_version": 1,
"billing_email": "string",
"contact_email": "string",
"contact_name": "string"
}'/api/v1/platform/orgs/{org_uuid}Delete organization
Hard-delete an organization. The org must be in ``suspended`` status before it can be deleted. This is an irreversible operation. Requires ``platform.orgs.delete`` permission. Raises 404 if the organization does not exist. Raises 409 if the organization is not suspended.
Parameters
Path Parameters
org_uuidstringrequiredResponses
detailobject[]curl -X DELETE "https://api.example.com/api/v1/platform/orgs/{org_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X DELETE "https://api.example.com/api/v1/platform/orgs/{org_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"Settings
2 endpoints
/api/v1/platform/settingsGet platform settings
Return the current global platform configuration. Settings are stored in-memory with sensible defaults. Persistence is not yet implemented -- values reset on server restart. Requires ``platform.settings.read`` permission.
Responses
default_account_typestringrequiredDefault account tier for newly created organizations. One of: starter, professional, enterprise.
impersonation_enabledbooleanrequiredWhether platform admin impersonation is allowed globally.
impersonation_ttl_secondsintegerrequiredMaximum duration of an impersonation session in seconds.
max_orgs_per_shardintegerrequiredMaximum number of organizations allowed per database shard.
permission_enforcementstringrequiredPermission enforcement mode. One of: enabled, audit, disabled. 'enabled' enforces all checks; 'audit' logs violations without blocking; 'disabled' skips all permission checks.
curl -X GET "https://api.example.com/api/v1/platform/settings" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/settings" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/settingsUpdate platform settings
Update one or more global platform settings. Only provided (non-None) fields are applied. Returns the full settings object after the update. Settings are stored in-memory -- changes are **not persisted** across server restarts. Persistence will be added when a PlatformSettings control-plane model is created. Requires ``platform.settings.update`` permission. Raises 422 if validation fails (invalid enforcement mode, TTL < 60, etc.).
Request Body
default_account_typestringimpersonation_enabledbooleanimpersonation_ttl_secondsintegermax_orgs_per_shardintegerpermission_enforcementstringResponses
default_account_typestringrequiredDefault account tier for newly created organizations. One of: starter, professional, enterprise.
impersonation_enabledbooleanrequiredWhether platform admin impersonation is allowed globally.
impersonation_ttl_secondsintegerrequiredMaximum duration of an impersonation session in seconds.
max_orgs_per_shardintegerrequiredMaximum number of organizations allowed per database shard.
permission_enforcementstringrequiredPermission enforcement mode. One of: enabled, audit, disabled. 'enabled' enforces all checks; 'audit' logs violations without blocking; 'disabled' skips all permission checks.
detailobject[]curl -X PATCH "https://api.example.com/api/v1/platform/settings" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"default_account_type": "string",
"impersonation_enabled": null,
"impersonation_ttl_seconds": 1,
"max_orgs_per_shard": 1,
"permission_enforcement": "string"
}'curl -X PATCH "https://api.example.com/api/v1/platform/settings" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"default_account_type": "string",
"impersonation_enabled": null,
"impersonation_ttl_seconds": 1,
"max_orgs_per_shard": 1,
"permission_enforcement": "string"
}'User Management
5 endpoints
/api/v1/platform/usersSearch all users
Search all users in the platform with optional filters. Returns a paginated list of users with basic profile info and active/invited org membership count. Requires ``platform.users.list`` permission.
Parameters
Query Parameters
searchstringFilter by email or display name (case-insensitive substring match).
statusstringFilter by user status. One of: active, suspended, deactivated.
pageintegerPage number (1-based).
Default: 1
page_sizeintegerItems per page (max 100).
Default: 25
Responses
itemsobject[]requiredList of user items.
totalintegerrequiredTotal number of users matching the query.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/users" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/users" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/users/{user_uuid}Get user detail with org memberships
Get detailed info for a user including all org memberships. Requires ``platform.users.read`` permission. Raises 404 if the user is not found.
Parameters
Path Parameters
user_uuidstringrequiredResponses
created_atstring (date-time)requiredAccount creation timestamp.
display_namestringrequiredDisplay name.
emailstringrequiredEmail address.
has_platform_accessbooleanrequiredWhether the user has platform admin access.
idstring (uuid)requiredPublic UUID of the user.
last_login_atstring (date-time)org_membershipsobject[]List of org memberships for this user.
statusstringrequiredUser account status. One of: active, suspended, deactivated.
detailobject[]curl -X GET "https://api.example.com/api/v1/platform/users/{user_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/users/{user_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/users/{user_uuid}/deactivateDeactivate a user globally
Globally deactivate a user. Suspends all org memberships, suspends assignments, blocks the user in the auth provider, adds them to the session blocklist, and invalidates permission caches. Requires ``platform.users.deactivate`` permission. Raises 404 if the user is not found. Raises 422 if the user is already deactivated.
Parameters
Path Parameters
user_uuidstringrequiredResponses
detailobject[]curl -X POST "https://api.example.com/api/v1/platform/users/{user_uuid}/deactivate" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X POST "https://api.example.com/api/v1/platform/users/{user_uuid}/deactivate" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/users/{user_uuid}/reactivateReactivate a deactivated or suspended user
Reactivate a previously deactivated or suspended user. Restores all suspended org memberships, restores assignments, unblocks the user in the auth provider, removes them from the session blocklist, and invalidates permission caches. Requires ``platform.users.reactivate`` permission. Raises 404 if the user is not found. Raises 422 if the user is already active.
Parameters
Path Parameters
user_uuidstringrequiredResponses
detailobject[]curl -X POST "https://api.example.com/api/v1/platform/users/{user_uuid}/reactivate" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X POST "https://api.example.com/api/v1/platform/users/{user_uuid}/reactivate" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/users/{user_uuid}Edit user profile
Update a user's profile fields (display_name, email). Only provided fields are updated. Requires ``platform.users.update`` permission. Raises 404 if the user is not found.
Parameters
Path Parameters
user_uuidstringrequiredRequest Body
display_namestringemailstringResponses
created_atstring (date-time)requiredAccount creation timestamp.
display_namestringrequiredDisplay name.
emailstringrequiredEmail address.
has_platform_accessbooleanrequiredWhether the user has platform admin access.
idstring (uuid)requiredPublic UUID of the user.
last_login_atstring (date-time)statusstringrequiredUser account status. One of: active, suspended, deactivated.
detailobject[]curl -X PATCH "https://api.example.com/api/v1/platform/users/{user_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"display_name": "string",
"email": "string"
}'curl -X PATCH "https://api.example.com/api/v1/platform/users/{user_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"display_name": "string",
"email": "string"
}'Shards
6 endpoints
/api/v1/platform/shardsList shards
Return a paginated list of shards, optionally filtered by active status.
Parameters
Query Parameters
pageintegerPage number (1-based).
Default: 1
page_sizeintegerItems per page.
Default: 20
is_activebooleanFilter by active status.
Responses
itemsobject[]requiredpageintegerrequiredpage_sizeintegerrequiredtotalintegerrequireddetailobject[]curl -X GET "https://api.example.com/api/v1/platform/shards" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/shards" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/shards/{shard_uuid}Get shard
Return details for a single shard. Raises 404 if the shard does not exist.
Parameters
Path Parameters
shard_uuidstringrequiredResponses
created_atstring (date-time)requiredidstring (uuid)requiredis_activebooleanrequiredmax_orgsintegerrequirednamestringrequiredregionstringrequiredversionintegerrequireddetailobject[]curl -X GET "https://api.example.com/api/v1/platform/shards/{shard_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/shards/{shard_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/shards/{shard_uuid}/capacityGet shard capacity
Return capacity metrics for a shard (current org count, max orgs, utilization). Raises 404 if the shard does not exist.
Parameters
Path Parameters
shard_uuidstringrequiredResponses
available_slotsintegerrequiredcurrent_orgsintegerrequiredmax_orgsintegerrequiredshard_idstringrequiredutilization_percentnumberrequireddetailobject[]curl -X GET "https://api.example.com/api/v1/platform/shards/{shard_uuid}/capacity" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/shards/{shard_uuid}/capacity" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/shardsCreate shard
Provision a new database shard. Raises 422 if validation fails (e.g. invalid max_orgs).
Request Body
dsnstringrequiredis_activebooleanmax_orgsintegernamestringrequiredregionstringResponses
created_atstring (date-time)requiredidstring (uuid)requiredis_activebooleanrequiredmax_orgsintegerrequirednamestringrequiredregionstringrequiredversionintegerrequireddetailobject[]curl -X POST "https://api.example.com/api/v1/platform/shards" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"dsn": "string",
"is_active": true,
"max_orgs": 100,
"name": "string",
"region": ""
}'curl -X POST "https://api.example.com/api/v1/platform/shards" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"dsn": "string",
"is_active": true,
"max_orgs": 100,
"name": "string",
"region": ""
}'/api/v1/platform/shards/{shard_uuid}/archiveArchive shard
Soft-delete a shard by marking it as archived. Raises 404 if the shard does not exist.
Parameters
Path Parameters
shard_uuidstringrequiredResponses
created_atstring (date-time)requiredidstring (uuid)requiredis_activebooleanrequiredmax_orgsintegerrequirednamestringrequiredregionstringrequiredversionintegerrequireddetailobject[]curl -X POST "https://api.example.com/api/v1/platform/shards/{shard_uuid}/archive" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X POST "https://api.example.com/api/v1/platform/shards/{shard_uuid}/archive" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/shards/{shard_uuid}Update shard
Update a shard's configuration. Raises 404 if the shard does not exist. Raises 409 if ``base_version`` is stale. Raises 422 if validation fails.
Parameters
Path Parameters
shard_uuidstringrequiredRequest Body
base_versionintegerrequireddsnstringis_activebooleanmax_orgsintegernamestringregionstringResponses
created_atstring (date-time)requiredidstring (uuid)requiredis_activebooleanrequiredmax_orgsintegerrequirednamestringrequiredregionstringrequiredversionintegerrequireddetailobject[]curl -X PATCH "https://api.example.com/api/v1/platform/shards/{shard_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"base_version": 1,
"dsn": "string",
"is_active": null,
"max_orgs": 1,
"name": "string"
}'curl -X PATCH "https://api.example.com/api/v1/platform/shards/{shard_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"base_version": 1,
"dsn": "string",
"is_active": null,
"max_orgs": 1,
"name": "string"
}'Partners
5 endpoints
/api/v1/platform/partnersList partners
Return a paginated list of partners, optionally filtered by status or type.
Parameters
Query Parameters
pageintegerPage number (1-based).
Default: 1
page_sizeintegerItems per page.
Default: 20
statusstringFilter by partner status.
partner_typestringFilter by partner type.
Responses
itemsobject[]requiredpageintegerrequiredpage_sizeintegerrequiredtotalintegerrequireddetailobject[]curl -X GET "https://api.example.com/api/v1/platform/partners" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/partners" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/partners/{partner_uuid}Get partner
Return details for a single partner. Raises 404 if the partner does not exist.
Parameters
Path Parameters
partner_uuidstringrequiredResponses
contact_emailstringcontact_namestringcontact_phonestringcreated_atstring (date-time)requireddescriptionstringdisplay_namestringextra_dataobjectrequiredidstring (uuid)requiredlogo_urlstringnamestringrequiredpartner_typestringrequiredslugstringrequiredstatusstringrequiredupdated_atstring (date-time)requiredversionintegerrequiredwebsitestringdetailobject[]curl -X GET "https://api.example.com/api/v1/platform/partners/{partner_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X GET "https://api.example.com/api/v1/platform/partners/{partner_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/partnersCreate partner
Register a new partner integration. Raises 422 if validation fails (e.g. invalid slug or partner_type).
Request Body
contact_emailstringcontact_namestringcontact_phonestringdescriptionstringdisplay_namestringextra_dataobjectinternal_notesstringlogo_urlstringnamestringrequiredpartner_typestringslugstringrequiredwebsitestringResponses
contact_emailstringcontact_namestringcontact_phonestringcreated_atstring (date-time)requireddescriptionstringdisplay_namestringextra_dataobjectrequiredidstring (uuid)requiredlogo_urlstringnamestringrequiredpartner_typestringrequiredslugstringrequiredstatusstringrequiredupdated_atstring (date-time)requiredversionintegerrequiredwebsitestringdetailobject[]curl -X POST "https://api.example.com/api/v1/platform/partners" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"contact_email": "string",
"contact_name": "string",
"contact_phone": "string",
"description": "string",
"display_name": "string",
"name": "string",
"slug": "string"
}'curl -X POST "https://api.example.com/api/v1/platform/partners" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"contact_email": "string",
"contact_name": "string",
"contact_phone": "string",
"description": "string",
"display_name": "string",
"name": "string",
"slug": "string"
}'/api/v1/platform/partners/{partner_uuid}/archiveArchive partner
Soft-delete a partner by marking it as archived. Raises 404 if the partner does not exist.
Parameters
Path Parameters
partner_uuidstringrequiredResponses
contact_emailstringcontact_namestringcontact_phonestringcreated_atstring (date-time)requireddescriptionstringdisplay_namestringextra_dataobjectrequiredidstring (uuid)requiredlogo_urlstringnamestringrequiredpartner_typestringrequiredslugstringrequiredstatusstringrequiredupdated_atstring (date-time)requiredversionintegerrequiredwebsitestringdetailobject[]curl -X POST "https://api.example.com/api/v1/platform/partners/{partner_uuid}/archive" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X POST "https://api.example.com/api/v1/platform/partners/{partner_uuid}/archive" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"/api/v1/platform/partners/{partner_uuid}Update partner
Update a partner's attributes. Raises 404 if the partner does not exist. Raises 409 if ``base_version`` is stale. Raises 422 if validation fails.
Parameters
Path Parameters
partner_uuidstringrequiredRequest Body
base_versionintegerrequiredcontact_emailstringcontact_namestringcontact_phonestringdescriptionstringdisplay_namestringextra_dataobjectinternal_notesstringlogo_urlstringnamestringpartner_typestringslugstringstatusstringwebsitestringResponses
contact_emailstringcontact_namestringcontact_phonestringcreated_atstring (date-time)requireddescriptionstringdisplay_namestringextra_dataobjectrequiredidstring (uuid)requiredlogo_urlstringnamestringrequiredpartner_typestringrequiredslugstringrequiredstatusstringrequiredupdated_atstring (date-time)requiredversionintegerrequiredwebsitestringdetailobject[]curl -X PATCH "https://api.example.com/api/v1/platform/partners/{partner_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"base_version": 1,
"contact_email": "string",
"contact_name": "string",
"contact_phone": "string",
"description": "string"
}'curl -X PATCH "https://api.example.com/api/v1/platform/partners/{partner_uuid}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"base_version": 1,
"contact_email": "string",
"contact_name": "string",
"contact_phone": "string",
"description": "string"
}'Users
1 endpoint
/api/v1/platform/users/{user_id}Globally Deactivate User
Globally deactivate a user across all organizations.
Parameters
Path Parameters
user_idstringrequiredResponses
detailobject[]curl -X DELETE "https://api.example.com/api/v1/platform/users/{user_id}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"curl -X DELETE "https://api.example.com/api/v1/platform/users/{user_id}" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json"