Members and invitations

Every path below is relative to /v1/management/organizations/{organizationId}, except for accepting an invitation.

Members

Endpoint	What it does
GET .../members	Lists the organization's active and suspended members.
PATCH .../members/{memberUserId}	owner only. Changes role (admin/auditor) and/or status (active/suspended) of a non-owner member.
DELETE .../members/{memberUserId}	owner only. Revokes the member (terminal state — there's no "re-adding", you have to invite again).

The owner is protected throughout: it can never be the target of PATCH or DELETE, not even by itself.

Listing: sorting and pagination

This endpoint had no pagination at all until recently — it returned every member at once. It now accepts the same parameters as the operator listing:

limit=<1-100, default 50>
cursor=<opaque, comes from nextCursor>
sortBy=name|email|role|status
sortDirection=asc|desc

• Without sortBy: active → pending → suspended → other final states, then owner → admin → auditor, then name (or email if there's no name) alphabetically, id as a tie-break.
• With sortBy=name or sortBy=email: these are independent columns — unlike the default criterion, here each one sorts only by its own column (rows without a value go last, they don't fall back to the other one).

The same warning from PDV and cashier about the cursor being tied to the sort applies here too — the equivalent error is 400 ORGANIZATION_MEMBER_CURSOR_SORT_MISMATCH.

Invitations

Endpoint	What it does
GET .../invitations	Lists pending, unexpired invitations.
POST .../invitations	owner only. Creates an invitation (admin or auditor), queues an email. Expires in 72h by default (expiresInHours, 1–168).
DELETE .../invitations/{invitationId}	owner only. Cancels a pending invitation.
POST /v1/management/invitations/accept	The invitee accepts using the token received by email — must be authenticated with the email that received the invitation.

An invitation is single-use: accepting it creates the app.organization_members link with the role set on the invitation; a token that's already used, expired, or for a different email than the authenticated one returns a generic 409 (it deliberately doesn't reveal which of those reasons applies).

Audit

Endpoint	What it does
GET .../audit-logs	Log of administrative actions (workspace creation, password rotation, member change, etc.), cursor-paginated (limit, cursor). Read-only — management never edits ledger or balance directly; any financial correction has to produce an auditable adjustment transaction in the region.