Members

Manage organization members and roles

OpenAPIapi.spice.ai/openapi.json

List organization members

GET/v1/members

Returns all members of the authenticated organization.

Header parameters

Name	Type	Required	Description
`Authorization`	string	Yes	`Bearer <token>`. Authentication lists the tokens it accepts.
`X-Org-Name`	string	No	The organization to act on, by handle. Omit it to act on the organization the credential is bound to; sending it blank is a 400, not the same as omitting it. A user credential may name any organization its owner belongs to; a machine credential is pinned to its own. A portal session token is bound to none, so it must send this header on every route but `GET /v1/orgs` (400 `org_assertion_required` otherwise). Pattern: `^[A-Za-z0-9._-]{1,255}$`

Example request

curl "https://api.spice.ai/v1/members" \
  -H "Authorization: Bearer <token>"

Responses

200OK
List of organization members
application/json
- membersarray of object
  5 properties
  user_idinteger
  usernamestring
  rolesarray of string
  is_ownerboolean
  created_atstring (date-time)
401Unauthorized
Unauthorized
403Forbidden
Insufficient scope

Add a member

POST/v1/members

Adds a new member to the organization with the specified roles.

Header parameters

Name	Type	Required	Description
`Authorization`	string	Yes	`Bearer <token>`. Authentication lists the tokens it accepts.
`X-Org-Name`	string	No	The organization to act on, by handle. Omit it to act on the organization the credential is bound to; sending it blank is a 400, not the same as omitting it. A user credential may name any organization its owner belongs to; a machine credential is pinned to its own. A portal session token is bound to none, so it must send this header on every route but `GET /v1/orgs` (400 `org_assertion_required` otherwise). Pattern: `^[A-Za-z0-9._-]{1,255}$`

Request body

Required

application/json

usernamestringRequired
The username of the user to add
rolesarray of string
Roles to assign to the new member
- Default: ["member"]

Example request

curl -X POST "https://api.spice.ai/v1/members" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "string"
  }'

Responses

201Created
Member added successfully
application/json
- user_idinteger
- usernamestring
- rolesarray of string
- created_atstring (date-time)
400Bad Request
Invalid request body
401Unauthorized
Unauthorized
403Forbidden
Insufficient scope, not an org admin/owner, or only owners can assign the admin or owner role
404Not Found
User not found
409Conflict
User is already a member of this organization

Get a member

GET/v1/members/{memberId}

Returns details for a specific organization member, including their roles.

Path parameters

Name	Type	Required	Description
`memberId`	integer	Yes	The user ID of the member

Header parameters

Name	Type	Required	Description
`Authorization`	string	Yes	`Bearer <token>`. Authentication lists the tokens it accepts.
`X-Org-Name`	string	No	The organization to act on, by handle. Omit it to act on the organization the credential is bound to; sending it blank is a 400, not the same as omitting it. A user credential may name any organization its owner belongs to; a machine credential is pinned to its own. A portal session token is bound to none, so it must send this header on every route but `GET /v1/orgs` (400 `org_assertion_required` otherwise). Pattern: `^[A-Za-z0-9._-]{1,255}$`

Example request

curl "https://api.spice.ai/v1/members/<memberId>" \
  -H "Authorization: Bearer <token>"

Responses

200OK
Member details
application/json
- user_idinteger
- usernamestring
- rolesarray of string
- is_ownerboolean
- created_atstring (date-time)
401Unauthorized
Unauthorized
403Forbidden
Insufficient scope
404Not Found
Member not found

Update a member's roles

PATCH/v1/members/{memberId}

Updates the roles assigned to a specific organization member. Organization owners cannot have their roles modified.

Path parameters

Name	Type	Required	Description
`memberId`	integer	Yes	The user ID of the member

Header parameters

Name	Type	Required	Description
`Authorization`	string	Yes	`Bearer <token>`. Authentication lists the tokens it accepts.
`X-Org-Name`	string	No	The organization to act on, by handle. Omit it to act on the organization the credential is bound to; sending it blank is a 400, not the same as omitting it. A user credential may name any organization its owner belongs to; a machine credential is pinned to its own. A portal session token is bound to none, so it must send this header on every route but `GET /v1/orgs` (400 `org_assertion_required` otherwise). Pattern: `^[A-Za-z0-9._-]{1,255}$`

Request body

Required

application/json

rolesarray of stringRequired
New roles to assign to the member

Example request

curl -X PATCH "https://api.spice.ai/v1/members/<memberId>" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "roles": [
      "string"
    ]
  }'

Responses

200OK
Member roles updated successfully
application/json
- user_idinteger
- usernamestring
- rolesarray of string
- created_atstring (date-time)
400Bad Request
Invalid request body
401Unauthorized
Unauthorized
403Forbidden
Insufficient scope, not an org admin/owner, cannot modify owner, only owners can modify/assign admin or owner roles
404Not Found
Member not found, or the membership was removed before the role change was written
413Content Too Large
Request body too large
500Internal Server Error
The organization could not be read, or the role change failed

Remove a member

DELETE/v1/members/{memberId}

Removes a member from the organization. Organization owners cannot be removed.

Path parameters

Name	Type	Required	Description
`memberId`	integer	Yes	The user ID of the member

Header parameters

Name	Type	Required	Description
`Authorization`	string	Yes	`Bearer <token>`. Authentication lists the tokens it accepts.
`X-Org-Name`	string	No	The organization to act on, by handle. Omit it to act on the organization the credential is bound to; sending it blank is a 400, not the same as omitting it. A user credential may name any organization its owner belongs to; a machine credential is pinned to its own. A portal session token is bound to none, so it must send this header on every route but `GET /v1/orgs` (400 `org_assertion_required` otherwise). Pattern: `^[A-Za-z0-9._-]{1,255}$`

Example request

curl -X DELETE "https://api.spice.ai/v1/members/<memberId>" \
  -H "Authorization: Bearer <token>"

Responses

204No Content
Member removed successfully
400Bad Request
Invalid member ID
401Unauthorized
Unauthorized
403Forbidden
Insufficient scope, not an org admin/owner, cannot remove owner, or only owners can remove admins or owners
404Not Found
Member not found
500Internal Server Error
The removal could not be completed, or could not be confirmed

List organization members

GET/v1/orgs/{orgId}/members

The org is orgId in the path. Returns all members of the authenticated organization.

Path parameters

Name	Type	Required	Description
`orgId`	integer	Yes	The org id from GET /v1/orgs Minimum: `1`

Header parameters

Name	Type	Required	Description
`Authorization`	string	Yes	`Bearer <token>`. Authentication lists the tokens it accepts.
`X-Org-Name`	string	No	When present, X-Org-Name must name the same org as orgId. Otherwise the request returns org_path_mismatch (400). Pattern: `^[A-Za-z0-9._-]{1,255}$`

Example request

curl "https://api.spice.ai/v1/orgs/<orgId>/members" \
  -H "Authorization: Bearer <token>"

Responses

200OK
List of organization members
application/json
- membersarray of object
  5 properties
  user_idinteger
  usernamestring
  rolesarray of string
  is_ownerboolean
  created_atstring (date-time)
400Bad Request
orgId is not a valid org id (invalid_org_id), or X-Org-Name does not name that org (org_path_mismatch).
401Unauthorized
Unauthorized
403Forbidden
Insufficient scope. The caller is not a member of the org (org_forbidden). A machine credential named a different org (org_assertion_mismatch). The org is deleted (org_deleted).

Add a member

POST/v1/orgs/{orgId}/members

The org is orgId in the path. Adds a new member to the organization with the specified roles.

Path parameters

Name	Type	Required	Description
`orgId`	integer	Yes	The org id from GET /v1/orgs Minimum: `1`

Header parameters

Name	Type	Required	Description
`Authorization`	string	Yes	`Bearer <token>`. Authentication lists the tokens it accepts.
`X-Org-Name`	string	No	When present, X-Org-Name must name the same org as orgId. Otherwise the request returns org_path_mismatch (400). Pattern: `^[A-Za-z0-9._-]{1,255}$`

Request body

Required

application/json

usernamestringRequired
The username of the user to add
rolesarray of string
Roles to assign to the new member
- Default: ["member"]

Example request

curl -X POST "https://api.spice.ai/v1/orgs/<orgId>/members" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "string"
  }'

Responses

201Created
Member added successfully
application/json
- user_idinteger
- usernamestring
- rolesarray of string
- created_atstring (date-time)
400Bad Request
Invalid request body. orgId is not a valid org id (invalid_org_id), or X-Org-Name does not name that org (org_path_mismatch).
401Unauthorized
Unauthorized
403Forbidden
Insufficient scope, not an org admin/owner, or only owners can assign the admin or owner role. The caller is not a member of the org (org_forbidden). A machine credential named a different org (org_assertion_mismatch). The org is deleted (org_deleted).
404Not Found
User not found
409Conflict
User is already a member of this organization

Get a member

GET/v1/orgs/{orgId}/members/{memberId}

The org is orgId in the path. Returns details for a specific organization member, including their roles.

Path parameters

Name	Type	Required	Description
`orgId`	integer	Yes	The org id from GET /v1/orgs Minimum: `1`
`memberId`	integer	Yes	The user ID of the member

Header parameters

Name	Type	Required	Description
`Authorization`	string	Yes	`Bearer <token>`. Authentication lists the tokens it accepts.
`X-Org-Name`	string	No	When present, X-Org-Name must name the same org as orgId. Otherwise the request returns org_path_mismatch (400). Pattern: `^[A-Za-z0-9._-]{1,255}$`

Example request

curl "https://api.spice.ai/v1/orgs/<orgId>/members/<memberId>" \
  -H "Authorization: Bearer <token>"

Responses

200OK
Member details
application/json
- user_idinteger
- usernamestring
- rolesarray of string
- is_ownerboolean
- created_atstring (date-time)
400Bad Request
orgId is not a valid org id (invalid_org_id), or X-Org-Name does not name that org (org_path_mismatch).
401Unauthorized
Unauthorized
403Forbidden
Insufficient scope. The caller is not a member of the org (org_forbidden). A machine credential named a different org (org_assertion_mismatch). The org is deleted (org_deleted).
404Not Found
Member not found

Update a member's roles

PATCH/v1/orgs/{orgId}/members/{memberId}

The org is orgId in the path. Updates the roles assigned to a specific organization member. Organization owners cannot have their roles modified.

Path parameters

Name	Type	Required	Description
`orgId`	integer	Yes	The org id from GET /v1/orgs Minimum: `1`
`memberId`	integer	Yes	The user ID of the member

Header parameters

Name	Type	Required	Description
`Authorization`	string	Yes	`Bearer <token>`. Authentication lists the tokens it accepts.
`X-Org-Name`	string	No	When present, X-Org-Name must name the same org as orgId. Otherwise the request returns org_path_mismatch (400). Pattern: `^[A-Za-z0-9._-]{1,255}$`

Request body

Required

application/json

rolesarray of stringRequired
New roles to assign to the member

Example request

curl -X PATCH "https://api.spice.ai/v1/orgs/<orgId>/members/<memberId>" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "roles": [
      "string"
    ]
  }'

Responses

200OK
Member roles updated successfully
application/json
- user_idinteger
- usernamestring
- rolesarray of string
- created_atstring (date-time)
400Bad Request
Invalid request body. orgId is not a valid org id (invalid_org_id), or X-Org-Name does not name that org (org_path_mismatch).
401Unauthorized
Unauthorized
403Forbidden
Insufficient scope, not an org admin/owner, cannot modify owner, only owners can modify/assign admin or owner roles. The caller is not a member of the org (org_forbidden). A machine credential named a different org (org_assertion_mismatch). The org is deleted (org_deleted).
404Not Found
Member not found, or the membership was removed before the role change was written
413Content Too Large
Request body too large
500Internal Server Error
The organization could not be read, or the role change failed

Remove a member

DELETE/v1/orgs/{orgId}/members/{memberId}

The org is orgId in the path. Removes a member from the organization. Organization owners cannot be removed.

Path parameters

Name	Type	Required	Description
`orgId`	integer	Yes	The org id from GET /v1/orgs Minimum: `1`
`memberId`	integer	Yes	The user ID of the member

Header parameters

Name	Type	Required	Description
`Authorization`	string	Yes	`Bearer <token>`. Authentication lists the tokens it accepts.
`X-Org-Name`	string	No	When present, X-Org-Name must name the same org as orgId. Otherwise the request returns org_path_mismatch (400). Pattern: `^[A-Za-z0-9._-]{1,255}$`

Example request

curl -X DELETE "https://api.spice.ai/v1/orgs/<orgId>/members/<memberId>" \
  -H "Authorization: Bearer <token>"

Responses

204No Content
Member removed successfully
400Bad Request
Invalid member ID. orgId is not a valid org id (invalid_org_id), or X-Org-Name does not name that org (org_path_mismatch).
401Unauthorized
Unauthorized
403Forbidden
Insufficient scope, not an org admin/owner, cannot remove owner, or only owners can remove admins or owners. The caller is not a member of the org (org_forbidden). A machine credential named a different org (org_assertion_mismatch). The org is deleted (org_deleted).
404Not Found
Member not found
500Internal Server Error
The removal could not be completed, or could not be confirmed