Skip to main content
API docs by Redocly

Lexabit API (v1)

Download OpenAPI specification:Download

URL: https://lexabit.com

The Lexabit REST API (v1) for compliance and financial intelligence. Authenticate with a bearer token (Laravel Sanctum). All endpoints are versioned under /{service}/v1.

Environments: https://api.lexabit.com is production — only for applications running against the live environment. For all development, testing, and integration work use https://api.staging.lexabit.com (same API, separate data and credentials).

Access-model fields such as sponsored, delegated, apps, and connectors are named differently in the Lexabit Portal than in this reference. Access Concepts & Portal Terms maps each one to the exact wording your users see.

Sessions

Log in, refresh, and revoke bearer tokens, and inspect the current session.

Authenticate and start a session

Rate-limited. May require a reCAPTCHA token.

Request Body schema: application/json
required
email
required
string <email> <= 255 characters
password
required
string non-empty
entity_type
string <= 50 characters
device_name
string <= 255 characters
recaptcha_token
string
context
string
Enum: "portal" "admin"

Responses

Response Schema: application/json
Any of
required
object
required
object

Request samples

Content type
application/json
{
  • "email": "user@example.com",
  • "password": "string",
  • "entity_type": "string",
  • "device_name": "string",
  • "recaptcha_token": "string",
  • "context": "portal"
}

Response samples

Content type
application/json
"string"

Return the current authenticated user

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
object (UserAuthV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": null,
    • "name": "string",
    • "email": "string",
    • "emailVerified": true,
    • "emailVerifiedAt": "string",
    • "entityType": "user",
    • "isAdmin": true,
    • "avatarUrl": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke the current access token

Authorizations:
http

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Logged out successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke all tokens for the user

Authorizations:
http

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Logged out from all devices."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Issue a new token and revoke the old one

Authorizations:
http

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "token": "string",
    • "tokenType": "Bearer"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Registration

Register new user accounts.

Create a new local account

Rate-limited by IP. May require a reCAPTCHA token.

Request Body schema: application/json
required
email
required
string <email> <= 255 characters
password
required
string >= 8 characters [0-9]
name
string <= 255 characters
entity_type
string <= 50 characters
recaptcha_token
string
password_confirmation
required
string >= 8 characters [0-9]

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "email": "user@example.com",
  • "password": "stringst",
  • "name": "string",
  • "entity_type": "string",
  • "recaptcha_token": "string",
  • "password_confirmation": "stringst"
}

Response samples

Content type
application/json
{
  • "data": {
    • "requiresVerification": "string",
    • "verificationEmailSent": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Check whether an email is available for registration

Request Body schema: application/json
required
email
required
string <email> <= 255 characters
entity_type
string <= 50 characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "email": "user@example.com",
  • "entity_type": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "available": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

List available authentication providers

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "local": "string",
    • "oauth": [
      • null
      ],
    • "recaptcha": {
      • "enabled": true,
      • "siteKey": "string"
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Verify an email address via token

Returns redirect URLs in the response body (consumer drives the redirect).

path Parameters
uuid
required
string

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "verified": true,
    • "redirectUrl": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Resend the verification email

Always returns success to prevent email enumeration.

Request Body schema: application/json
required
email
required
string <email> <= 255 characters
entity_type
string <= 50 characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "email": "user@example.com",
  • "entity_type": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "sent": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Password Reset

Request and complete a password reset by email.

Request a password reset email

Rate-limited by IP. May require a reCAPTCHA token. Always returns success to prevent email enumeration.

Request Body schema: application/json
required
email
required
string <email> <= 255 characters
entity_type
string <= 50 characters
recaptcha_token
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "email": "user@example.com",
  • "entity_type": "string",
  • "recaptcha_token": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "sent": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Validate a password reset token

Returns the email associated with the token so the reset form can pre-fill it.

path Parameters
uuid
required
string

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "valid": true,
    • "email": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Reset the password using a valid token

Rate-limited by token.

Request Body schema: application/json
required
token
required
string <uuid>
password
required
string >= 8 characters
password_confirmation
required
string >= 8 characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "token": "b5507016-7da2-4777-a161-1e8042a6a377",
  • "password": "stringst",
  • "password_confirmation": "stringst"
}

Response samples

Content type
application/json
{
  • "data": {
    • "reset": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Password

Change the authenticated user's password.

Set or bootstrap the local password

Two paths:

  1. User has active local credential: verify current_password then update.
  2. User has no local credential (OAuth-only / invited): bootstrap if allow_bootstrap is enabled and session has a recent-auth marker.
Authorizations:
http
Request Body schema: application/json
required
current_password
string or null
new_password
required
string >= 8 characters
new_password_confirmation
required
string >= 8 characters

Responses

Response Schema: application/json
Any of
required
object
required
object

Request samples

Content type
application/json
{
  • "current_password": "string",
  • "new_password": "stringst",
  • "new_password_confirmation": "stringst"
}

Response samples

Content type
application/json
{
  • "data": {
    • "updated": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Personal Access Tokens

Create and manage long-lived personal access tokens that act as the user.

List the caller's own PATs. Never includes

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": 0,
      • "name": "string",
      • "createdAt": "string",
      • "lastUsedAt": "string",
      • "expiresAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Issue a new PAT. expiresAt defaults to

Authorizations:
http
Request Body schema: application/json
required
name
required
string <= 255 characters
expiresAt
string or null <date-time>

Responses

Response Schema: application/json
required
object (NewAccessToken)
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "expiresAt": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "data": {
    • "property1": "string",
    • "property2": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Mint a new PAT with the

Authorizations:
http
path Parameters
tokenId
required
integer

Responses

Response Schema: application/json
required
object (NewAccessToken)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "property1": "string",
    • "property2": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Rename and/or re-extend a PAT.

Authorizations:
http
path Parameters
tokenId
required
integer
Request Body schema: application/json
name
string <= 255 characters
expiresAt
string <date-time>

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "expiresAt": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "name": "string",
    • "createdAt": "string",
    • "lastUsedAt": "string",
    • "expiresAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a PAT. 204 on success.

Authorizations:
http
path Parameters
tokenId
required
integer

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Apps

Create and manage machine-actor apps that hold scoped API access.

The authenticated actor's identity — works for both User and ApiApp

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "actorType": "user",
    • "actorId": "string",
    • "name": "string",
    • "status": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List all apps parented to the active scope (X-Scope). Supports

No route parameter exists for a collection endpoint, so entity.permission cannot gate it — authorization happens in-controller, exactly like ClientController::index.

Authorizations:
http
query Parameters
filter[origin]
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (AppListResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "description": "string",
      • "status": "string",
      • "createdBy": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "connectorId": "string",
      • "entity": {
        • "type": "string",
        • "id": "string",
        • "name": "string"
        },
      • "hasClientCredentials": true,
      • "delegated": true,
      • "keysCount": "string",
      • "lastUsedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create a new App anchored at the operating scope (X-Scope)

Mirrors ClientController::store: validate -> AppService::create() -> 201 with AppResource + the first key if requested (createKey defaults true).

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
name
required
string <= 255 characters
description
string or null
createKey
boolean
keyName
string <= 255 characters
roles
Array of strings

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "createKey": true,
  • "keyName": "string",
  • "roles": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "description": "string",
    • "status": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "connectorId": "string",
    • "delegated": "string",
    • "entity": {
      • "type": "string",
      • "id": "string",
      • "name": "string"
      },
    • "keysCount": "string",
    • "lastUsedAt": "string",
    • "keys": [
      • {
        • "id": "string",
        • "name": "string",
        • "lastUsedAt": "string",
        • "expiresAt": "string",
        • "createdAt": "string"
        }
      ],
    • "hasClientCredentials": true,
    • "clientCredentialClientId": "string",
    • "clientCredentialLastUsedAt": "string",
    • "clientCredentialType": "confidential",
    • "key": {
      • "property1": "string",
      • "property2": "string"
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Show a single app. Authorization via entity.permission:app,apps.view

Authorizations:
http
path Parameters
app
required
string

The app ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "description": "string",
    • "status": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "connectorId": "string",
    • "delegated": "string",
    • "entity": {
      • "type": "string",
      • "id": "string",
      • "name": "string"
      },
    • "keysCount": "string",
    • "lastUsedAt": "string",
    • "keys": [
      • {
        • "id": "string",
        • "name": "string",
        • "lastUsedAt": "string",
        • "expiresAt": "string",
        • "createdAt": "string"
        }
      ],
    • "hasClientCredentials": true,
    • "clientCredentialClientId": "string",
    • "clientCredentialLastUsedAt": "string",
    • "clientCredentialType": "confidential"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update an app's name/description/status. Authorization via

status transitions delegate to AppService::suspend()/reactivate() (the only lifecycle-transition entry points); name/description are plain column updates, exactly like ClientController::update.

Authorizations:
http
path Parameters
app
required
string

The app ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters
description
string or null
status
string
Enum: "active" "suspended"

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "status": "active"
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "description": "string",
    • "status": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "connectorId": "string",
    • "delegated": "string",
    • "entity": {
      • "type": "string",
      • "id": "string",
      • "name": "string"
      },
    • "keysCount": "string",
    • "lastUsedAt": "string",
    • "keys": [
      • {
        • "id": "string",
        • "name": "string",
        • "lastUsedAt": "string",
        • "expiresAt": "string",
        • "createdAt": "string"
        }
      ],
    • "hasClientCredentials": true,
    • "clientCredentialClientId": "string",
    • "clientCredentialLastUsedAt": "string",
    • "clientCredentialType": "confidential"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Destroy an app: revokes all of its keys, removes its access from every

Authorizations:
http
path Parameters
app
required
string

The app ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

API Keys

Issue, rotate, and revoke an app's API keys (max 2 active).

Issue a new key (max 2 active per app)

Authorizations:
http
path Parameters
app
required
string

The app ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters
expiresAt
string or null <date-time>

Responses

Response Schema: application/json
required
object (NewAccessToken)
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "expiresAt": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "data": {
    • "property1": "string",
    • "property2": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Issue a new key, revoke the old one

Authorizations:
http
path Parameters
app
required
string

The app ID

keyId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string

Responses

Response Schema: application/json
required
object (NewAccessToken)
required
object

Request samples

Content type
application/json
{
  • "name": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "property1": "string",
    • "property2": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a key. 204 on success, 404 if not found

Authorizations:
http
path Parameters
app
required
string

The app ID

keyId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Client Credentials

Manage an app's OAuth2 client-credentials set.

Issue the app's client-credentials

Authorizations:
http
path Parameters
app
required
string

The app ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "clientId": "string",
    • "clientSecret": "string",
    • "name": "string",
    • "createdAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke the app's

Authorizations:
http
path Parameters
app
required
string

The app ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Replace the app's

Authorizations:
http
path Parameters
app
required
string

The app ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "clientId": "string",
    • "clientSecret": "string",
    • "name": "string",
    • "createdAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

App Roles

Grant and revoke an app's roles on a scope.

List the app's active role assignments across

Authorizations:
http
path Parameters
app
required
string

The app ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (AppRoleResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "roleKey": "string",
      • "roleName": "string",
      • "roleType": "string",
      • "entityType": "string",
      • "entityId": "string",
      • "assignedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Grant the app a role on a target entity

Authorizations:
http
path Parameters
app
required
string

The app ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
entityType
required
string
entityId
required
string
roleKey
required
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "entityType": "string",
  • "entityId": "string",
  • "roleKey": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Role assigned to app."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a role. Body carries entityType/entityId/roleKey

Authorizations:
http
path Parameters
app
required
string

The app ID

query Parameters
entityType
string
entityId
string
roleKey
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Role revoked from app.",
    • "revoked": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Authorize

The OAuth authorization-code entry point (browser redirect).

Authorize

query Parameters
client_id
string
redirect_uri
string
state
string
response_type
string
scope
string
code_challenge
string
code_challenge_method
string
entity_type
string

The target entity may not be known yet at authorize time (e.g. an MCP client that lets the user pick it on the consent screen) — passed through opaquely, unvalidated, if present.

entity_id
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
object

Response samples

Content type
application/json
{ }

Consent

The consent screen shown when a user authorizes a connector.

Render everything the consent

Authorizations:
http
path Parameters
authorizationId
required
string

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "clientName": "string",
    • "clientLogoUrl": "string",
    • "homepageUrl": "string",
    • "redirectUri": "string",
    • "requestedRoles": [
      • null
      ],
    • "requestedCapabilities": [
      • {
        • "area": "string",
        • "areaName": "string",
        • "capabilities": [
          • null
          ]
        }
      ],
    • "delegationRequested": true,
    • "scopeEntity": {
      • "type": "string",
      • "id": "string",
      • "name": "string"
      },
    • "availableScopes": [
      • null
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

The user's decision.

Authorizations:
http
path Parameters
authorizationId
required
string
Request Body schema: application/json
required
decision
required
string
Enum: "approve" "deny"
delegate
boolean

Opt in to delegated access ("act on your behalf"). Only valid when the authorization request asked for it.

sponsored
required
boolean

Ownership classification — forced choice, no default (LEX-109).

roles
Array of strings
capabilities
Array of strings

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "decision": "approve",
  • "delegate": true,
  • "sponsored": true,
  • "roles": [
    • "string"
    ],
  • "capabilities": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "redirectUri": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Token

Exchange client-credentials or an authorization code for a bearer token, or refresh an existing one.

Issue an access token

OAuth 2.0 token endpoint (RFC 6749). Dispatches on grant_type: client_credentials (a first-party App authenticating with its own client-credential set), authorization_code (a Connector redeeming a consent-minted one-time code — with PKCE S256 when the authorize request carried a code_challenge, which is mandatory for public clients) or refresh_token (a Connector rotating a refresh token from an earlier redemption for a fresh access token). Client credentials may be sent either as an HTTP Basic Authorization header or as client_id/client_secret body fields — never both, and never in the query string.

Request and response are RFC-flat (application/x-www-form-urlencoded or JSON in, plain JSON out) — NOT the platform {data,meta} envelope — so standard OAuth client libraries work unmodified. The issued bearer token expires after expires_in seconds. The authorization_code and refresh_token grants also return a rotating refresh_token (LEX-130); client_credentials does not.

Request Body schema: application/json
required
grant_type
required
string

One of client_credentials, authorization_code or refresh_token.

client_id
string

The client id (App client credential, or Connector client id). Required here unless sent via HTTP Basic auth.

client_secret
string

The client secret. Required for confidential clients unless sent via HTTP Basic auth; public (PKCE-only) clients have none.

code
string

authorization_code grant only: the one-time authorization code returned to your redirect URI.

redirect_uri
string

authorization_code grant only: must exactly match the redirect_uri used in the authorize request.

code_verifier
string

authorization_code grant only: the PKCE verifier matching the code_challenge sent at authorize time. Required whenever the code was issued with PKCE (always, for public clients).

refresh_token
string

refresh_token grant only: the refresh token returned by a previous authorization_code redemption or refresh. One-use — each refresh returns a new one.

scope
string

client_credentials grant only: accepted but currently ignored (reserved).

Responses

Response Schema: application/json
access_token
required
string
token_type
required
string
expires_in
required
integer
refresh_token
string

Request samples

Content type
application/json
{
  • "grant_type": "authorization_code",
  • "client_id": "string",
  • "client_secret": "string",
  • "code": "string",
  • "redirect_uri": "string",
  • "code_verifier": "string",
  • "refresh_token": "string",
  • "scope": "string"
}

Response samples

Content type
application/json
{
  • "access_token": "1|9x7K2mQpR4vL8nW3zC6hT1sD5fG0aJ2bE9cY4uI7oP",
  • "token_type": "Bearer",
  • "expires_in": 3600,
  • "refresh_token": "rt_4Kf…"
}

Revocation

Revoke an access or refresh token issued through the authorization-code flow (RFC 7009).

Revoke a token

RFC 7009 revocation endpoint. Pass the token to revoke (a refresh token or an access token) with the same client authentication you use at the token endpoint. Revoking a refresh token disconnects the connection it belongs to entirely; revoking an access token invalidates only that bearer. Always returns 200 for an authenticated client, whether or not the token was known.

Request Body schema: application/json
required
token
required
string

The refresh token or access token to revoke.

token_type_hint
string

Optional: refresh_token or access_token. A wrong hint is tolerated — both types are searched.

client_id
string

Your Connector client id. Required here unless sent via HTTP Basic auth.

client_secret
string

Your Connector client secret (confidential clients only) unless sent via HTTP Basic auth.

Responses

Response Schema: application/json
property name*
additional property
any

Request samples

Content type
application/json
{
  • "token": "string",
  • "token_type_hint": "string",
  • "client_id": "string",
  • "client_secret": "string"
}

Response samples

Content type
application/json
{
  • "property1": null,
  • "property2": null
}

Connected Apps

List and revoke the connectors a user has authorized.

The authorizations the current user has

Authorizations:
http
query Parameters
filter[status]
string
Default: "active"
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
Array of objects (OAuthConsentResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "app": {
        • "id": "string",
        • "name": "string",
        • "logoUrl": "string",
        • "homepageUrl": "string"
        },
      • "grantedRoles": [
        • null
        ],
      • "delegated": true,
      • "sponsored": true,
      • "entity": {
        • "type": "string",
        • "id": "string",
        • "name": "string"
        },
      • "grantedAt": "string",
      • "revokedAt": "string",
      • "status": "active"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Revoke one of your connections.

Authorizations:
http
path Parameters
consent
required
string

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Withdraw the app's

Authorizations:
http
path Parameters
consent
required
string

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Entity Connections

List and revoke the connections installed on the operating entity.

Every Connection installed on the operating

Authorizations:
http
query Parameters
filter[status]
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (EntityConnectionResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "app": {
        • "id": "string",
        • "name": "string",
        • "status": "string",
        • "logoUrl": "string",
        • "homepageUrl": "string"
        },
      • "connector": {
        • "id": "string",
        • "name": "string"
        },
      • "grantedRoles": [
        • null
        ],
      • "delegated": true,
      • "sponsored": true,
      • "grantedBy": {
        • "userId": "string",
        • "name": "string",
        • "email": "string"
        },
      • "grantedAt": "string",
      • "revokedAt": "string",
      • "status": "active"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a connection

Authorizations:
http
path Parameters
connection
required
string <uuid>

The connection ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Company Intelligence

Enriched company insights and the intelligence capabilities available to you.

Get the authenticated user's general company data capabilities.

Returns ETag + Cache-Control: private (slow-changing reference data).

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "accessibleSubsets": "string",
    • "accessLevel": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List companies accessible to the authenticated user.

Authorizations:
http
query Parameters
page
integer >= 1
perPage
integer [ 1 .. 100 ]
sort
string
filter[name]
string
filter[countryCode]
string = 2 characters
filter[status]
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
data
required
Array of any
required
object

Response samples

Content type
application/json
{
  • "data": [
    • null
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "page": "string",
      • "perPage": "string",
      • "total": "string",
      • "totalPages": "string"
      }
    }
}

Show a single company (basic info + optional profile).

Returns ETag + Cache-Control: private, max-age=300 for conditional-GET support.

Authorizations:
http
path Parameters
id
required
string
query Parameters
profile
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "orgNo": "string",
    • "name": "string",
    • "countryCode": "string",
    • "status": "string",
    • "legalForm": "string",
    • "source": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Detailed company fetch with profile/subset/priority options.

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
profile
string
priorities
Array of strings
subsets
Array of strings
Items Enum: "information" "addresses" "financials" "metric_snapshots" "rating" "announcements" "events" "roles" "signatories" "shareholders" "exceptions" "activity_classifications" "group_structure"
object

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "profile": "string",
  • "priorities": [
    • "string"
    ],
  • "subsets": [
    • "information"
    ],
  • "options": {
    • "maxAge": "string",
    • "forceRefresh": true,
    • "createAccessGrants": true
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "orgNo": "string",
    • "name": "string",
    • "countryCode": "string",
    • "status": "string",
    • "legalForm": "string",
    • "source": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Import / create company data from external sources.

Returns 201 + Location header on success.

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
source
string
profile
string
createAccessGrants
boolean
subsets
Array of strings

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "source": "string",
  • "profile": "string",
  • "createAccessGrants": true,
  • "subsets": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "orgNo": "string",
    • "name": "string",
    • "countryCode": "string",
    • "status": "string",
    • "legalForm": "string",
    • "source": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Re-fetch company data synchronously from upstream integrations.

Returns a conflict error if a refetch is already in progress for this company.

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
profile
string
priorities
Array of strings
subsets
Array of strings

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "profile": "string",
  • "priorities": [
    • "string"
    ],
  • "subsets": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "orgNo": "string",
    • "name": "string",
    • "countryCode": "string",
    • "status": "string",
    • "legalForm": "string",
    • "source": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get the authenticated user's access details for a specific company.

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "companyId": "string",
    • "accessibleSubsets": [
      • null
      ],
    • "accessLevel": "premium"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Company Search

Search for companies across supported registries.

Free-text company search — cursor paginated.

Uses cursor-based pagination. The cursor is an opaque token — clients should pass it back as received and must not attempt to decode or construct it.

Authorizations:
http
query Parameters
q
required
string [ 2 .. 100 ] characters
country
string = 2 characters
country_code
string = 2 characters
perPage
integer [ 1 .. 100 ]
cursor
string or null
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
data
required
Array of any
required
object

Response samples

Content type
application/json
{
  • "data": [
    • null
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "perPage": { },
      • "nextCursor": "string",
      • "prevCursor": "string"
      },
    • "externalSearchEnabled": true
    }
}

Direct registration-number lookup.

Accepts both registrationNumber (v1 canonical) and the deprecated registration_number alias, via LookupCompanyV1Request.

Returns the internal company identifier as data.internalId (previously returned as a separate company_id field outside the envelope).

Authorizations:
http
query Parameters
country
string = 2 characters
country_code
string = 2 characters
registrationNumber
string <= 64 characters
registration_number
string <= 64 characters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "registrationNumber": "string",
    • "name": "string",
    • "countryCode": "string",
    • "status": "string",
    • "legalForm": "string",
    • "address": "string",
    • "internalId": "string",
    • "registrySource": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Company Data

Detailed company information and data subsets.

Return a company's core information

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Return a company's financial figures

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Return a company's credit rating

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List a company's addresses

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List a company's announcements

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List a company's events

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List a company's roles

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List a company's signatories

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List a company's shareholders

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List a company's exceptions

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List a company's activity classifications

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Return a company's group structure

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List a company's metric snapshots

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "subsetType": "string",
    • "data": "string",
    • "resolvedAt": "string",
    • "source": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Company Jobs

Asynchronous company data-processing jobs and their status.

Get active (running) jobs.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
data
required
Array of any
required
object

Response samples

Content type
application/json
{
  • "data": [
    • null
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Get queued jobs.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
data
required
Array of any
required
object

Response samples

Content type
application/json
{
  • "data": [
    • null
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Get status overview counts.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "queued": 3,
    • "running": 1,
    • "completed": 15,
    • "failed": 2,
    • "cancelled": 1,
    • "total": 22
    },
  • "meta": {
    • "requestId": "string"
    }
}

Create a company import job.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
profile
string
priority
string
Enum: "low" "normal" "high"
companyIds
required
Array of strings non-empty
subsets
Array of strings

Responses

Request samples

Content type
application/json
{
  • "profile": "string",
  • "priority": "low",
  • "companyIds": [
    • "string"
    ],
  • "subsets": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "type": "string",
    • "status": "string",
    • "progress": "string",
    • "totalItems": "string",
    • "userId": "string",
    • "parameters": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "estimatedDuration": "string",
    • "estimatedCompletion": "string",
    • "completedAt": "string",
    • "cancelledAt": "string",
    • "failedAt": "string",
    • "retriedFrom": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Create a bulk refresh job.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
forceRefresh
boolean
companyIds
required
Array of strings [ 1 .. 1000 ] items
subsets
Array of strings

Responses

Request samples

Content type
application/json
{
  • "forceRefresh": true,
  • "companyIds": [
    • "string"
    ],
  • "subsets": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "type": "string",
    • "status": "string",
    • "progress": "string",
    • "totalItems": "string",
    • "userId": "string",
    • "parameters": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "estimatedDuration": "string",
    • "estimatedCompletion": "string",
    • "completedAt": "string",
    • "cancelledAt": "string",
    • "failedAt": "string",
    • "retriedFrom": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Show a specific job.

Authorizations:
http
path Parameters
jobId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "type": "string",
    • "status": "string",
    • "progress": "string",
    • "totalItems": "string",
    • "userId": "string",
    • "parameters": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "estimatedDuration": "string",
    • "estimatedCompletion": "string",
    • "completedAt": "string",
    • "cancelledAt": "string",
    • "failedAt": "string",
    • "retriedFrom": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Cancel a job.

Authorizations:
http
path Parameters
jobId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "type": "string",
    • "status": "string",
    • "progress": "string",
    • "totalItems": "string",
    • "userId": "string",
    • "parameters": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "estimatedDuration": "string",
    • "estimatedCompletion": "string",
    • "completedAt": "string",
    • "cancelledAt": "string",
    • "failedAt": "string",
    • "retriedFrom": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Retry a failed job.

Authorizations:
http
path Parameters
jobId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "type": "string",
    • "status": "string",
    • "progress": "string",
    • "totalItems": "string",
    • "userId": "string",
    • "parameters": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "estimatedDuration": "string",
    • "estimatedCompletion": "string",
    • "completedAt": "string",
    • "cancelledAt": "string",
    • "failedAt": "string",
    • "retriedFrom": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Company Reports

Company reports and their generation.

Generate a PDF company report

Generate a PDF report for a company based on its latest dataset information.

Returns binary application/pdf — not the standard {data,meta} envelope. This endpoint does not support the Idempotency-Key header.

Query parameters:

  • sections (string, optional): comma-separated section identifiers; defaults to 'all'
  • full (bool-ish, optional): whether to include full extended data; defaults to false
  • filename (string, optional): override for the downloaded filename
Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "message": "string"
}

Scoring

Risk and compliance scores for companies.

Bulk delete scoring records by id.

Authorizations:
http
query Parameters
ids[]
Array of integers
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

List scoring records for the current tenant.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (ScoringResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": 0,
      • "companyNumber": "string",
      • "companyName": "string",
      • "approved": true,
      • "grossAmount": "string",
      • "currency": "string",
      • "tenantId": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Run a credit score check via the scoring provider and persist the result.

  • On a successful (200/201) response from the provider: persists a score record and returns the score data with a 201 status.
  • On a 4xx response from the provider: returns a bad_request error envelope containing the provider's error body.
  • If the provider is unreachable or returns an unexpected status: returns a server_error envelope.
Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
organizationNumber
required
string
amount
required
number >= 0

Responses

Response Schema: application/json
string
Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "organizationNumber": "string",
  • "amount": 0
}

Response samples

Content type
application/json
"string"

Delete a single scoring record.

Authorizations:
http
path Parameters
id
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Bank Lookup

Banks and their reference metadata.

List banks with optional filters

Accepts perPage.

query Parameters
country
string = 2 characters
bic
string <= 11 characters
search
string <= 255 characters
provider
string <= 100 characters
active_only
boolean
perPage
integer [ 1 .. 100 ]
per_page
integer [ 1 .. 100 ]
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (BankV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": 0,
      • "bankIdentifier": "string",
      • "countryCode": "string",
      • "bic": "string",
      • "bankName": "string",
      • "slug": "string",
      • "fullIdentifier": "string",
      • "providerBankId": "string",
      • "providerName": "string",
      • "metadata": [
        • null
        ],
      • "providerData": [
        • null
        ],
      • "popularityRank": 0,
      • "isActive": true,
      • "logoUrl": "string",
      • "lastVerifiedAt": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Bank registry statistics

Optional ?country=XX filter.

query Parameters
country
string = 2 characters
bic
string <= 11 characters
search
string <= 255 characters
provider
string <= 100 characters
active_only
boolean
perPage
integer [ 1 .. 100 ]
per_page
integer [ 1 .. 100 ]
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object (BankStatsV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "summary": {
      • "totalBanks": 0,
      • "uniqueBics": 0,
      • "uniqueBankNames": 0,
      • "activeBanks": 0
      },
    • "byCountry": [
      • "string"
      ],
    • "topBanks": [
      • "string"
      ],
    • "byProvider": [
      • "string"
      ],
    • "filter": {
      • "country": null
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get bank(s) by BIC code

Pass ?all_branches=true to return all branch identifiers for the BIC.

path Parameters
bic
required
string
query Parameters
country
string = 2 characters
bic
string <= 11 characters
search
string <= 255 characters
provider
string <= 100 characters
active_only
boolean
perPage
integer [ 1 .. 100 ]
per_page
integer [ 1 .. 100 ]
all_branches
boolean
Default: false
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
BankByBicV1Resource (object) or BankByBicV1Resource (object) (BankByBicV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "banks": [
      • {
        • "id": 0,
        • "bankIdentifier": "string",
        • "countryCode": "string",
        • "bic": "string",
        • "bankName": "string",
        • "slug": "string",
        • "fullIdentifier": "string",
        • "providerBankId": "string",
        • "providerName": "string",
        • "metadata": [
          • null
          ],
        • "providerData": [
          • null
          ],
        • "popularityRank": 0,
        • "isActive": true,
        • "logoUrl": "string",
        • "lastVerifiedAt": "string",
        • "createdAt": "string",
        • "updatedAt": "string"
        }
      ],
    • "count": "string",
    • "bic": "string",
    • "country": null
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get a specific bank by country + identifier

path Parameters
country
required
string
identifier
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object (BankShowV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "bank": {
      • "id": 0,
      • "bankIdentifier": "string",
      • "countryCode": "string",
      • "bic": "string",
      • "bankName": "string",
      • "slug": "string",
      • "fullIdentifier": "string",
      • "providerBankId": "string",
      • "providerName": "string",
      • "metadata": [
        • null
        ],
      • "providerData": [
        • null
        ],
      • "popularityRank": 0,
      • "isActive": true,
      • "logoUrl": "string",
      • "lastVerifiedAt": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      },
    • "branches": [
      • "string"
      ],
    • "branchCount": 0,
    • "hasMultipleBranches": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Bank Identification

Identify the bank behind an account number or identifier.

Identify bank from IBAN or BBAN

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
iban
string
bban
string
country
string = 2 characters

Responses

Response Schema: application/json
required
object (BankIdentifyV1Resource)
required
object

Request samples

Content type
application/json
{
  • "iban": "string",
  • "bban": "string",
  • "country": "st"
}

Response samples

Content type
application/json
{
  • "data": {
    • "bank": {
      • "id": 0,
      • "bankIdentifier": "string",
      • "countryCode": "string",
      • "bic": "string",
      • "bankName": "string",
      • "slug": "string",
      • "fullIdentifier": "string",
      • "providerBankId": "string",
      • "providerName": "string",
      • "metadata": [
        • null
        ],
      • "providerData": [
        • null
        ],
      • "popularityRank": 0,
      • "isActive": true,
      • "logoUrl": "string",
      • "lastVerifiedAt": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      },
    • "bic": "string",
    • "bankName": "string",
    • "bankIdentifier": "string",
    • "countryCode": "string",
    • "parsedIban": null
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get bank record from IBAN or BBAN

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
iban
string
bban
string
country
string = 2 characters

Responses

Response Schema: application/json
required
object (BankGetBankV1Resource)
required
object

Request samples

Content type
application/json
{
  • "iban": "string",
  • "bban": "string",
  • "country": "st"
}

Response samples

Content type
application/json
{
  • "data": {
    • "bank": {
      • "id": 0,
      • "bankIdentifier": "string",
      • "countryCode": "string",
      • "bic": "string",
      • "bankName": "string",
      • "slug": "string",
      • "fullIdentifier": "string",
      • "providerBankId": "string",
      • "providerName": "string",
      • "metadata": [
        • null
        ],
      • "providerData": [
        • null
        ],
      • "popularityRank": 0,
      • "isActive": true,
      • "logoUrl": "string",
      • "lastVerifiedAt": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      },
    • "hasMultipleBranches": true,
    • "branchCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get BIC code from IBAN or BBAN

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
iban
string
bban
string
country
string = 2 characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "iban": "string",
  • "bban": "string",
  • "country": "st"
}

Response samples

Content type
application/json
{
  • "data": {
    • "bic": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Bank Utilities

IBAN and BIC validation and construction helpers.

Construct IBAN from BBAN + country or BIC

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
bban
required
string
country
string = 2 characters
bic
string [ 8 .. 11 ] characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "bban": "string",
  • "country": "st",
  • "bic": "stringst"
}

Response samples

Content type
application/json
{
  • "data": {
    • "iban": "string",
    • "valid": true,
    • "parsed": {
      • "country": "string",
      • "check_digits": "string",
      • "bban": "string",
      • "bank_id": "string",
      • "account": "string"
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Parse IBAN into its structural components

Returns: country, check_digits, bban, bank_id, account.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
iban
required
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "iban": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "country": "string",
    • "checkDigits": "string",
    • "bban": "string",
    • "bankId": "string",
    • "account": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Validate IBAN format and check digits

Returns {iban, valid} and optionally {parsed} when valid.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
iban
required
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "iban": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "iban": "string",
    • "valid": true,
    • "parsed": {
      • "country": "string",
      • "checkDigits": "string",
      • "bban": "string",
      • "bankId": "string",
      • "account": "string"
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Validate BIC format

Returns {bic, valid} and optionally {country} when valid.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
bic
required
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "bic": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "bic": "string",
    • "valid": true,
    • "country": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Extract country from BIC

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
bic
required
string [ 8 .. 11 ] characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "bic": "stringst"
}

Response samples

Content type
application/json
{
  • "data": {
    • "bic": "string",
    • "country": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List IBAN-extraction-supported countries

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "countries": [
      • null
      ],
    • "count": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Accounts

Tracked bank accounts and their connections.

List available banks

Catalog of available banks (slow-changing reference data). Returns a paginated collection. Responses include an ETag for conditional requests.

Authorizations:
http
query Parameters
countryCode
string
accountType
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "countryCode": "string",
      • "bankingGroupName": null,
      • "bankDisplayName": "string",
      • "bankOfficialName": "string",
      • "bic": "string",
      • "status": "AVAILABLE",
      • "logo_url": "string",
      • "requires_psu_id": true,
      • "beta": true,
      • "maximum_consent_validity": "string",
      • "supported_auth_approaches": "string",
      • "supported_services": "string",
      • "psu_types": "string",
      • "popularity_rank": 0
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": 0,
      • "currentPage": 1,
      • "lastPage": 1
      }
    }
}

List supported country codes

List of supported country codes from active integrations. Responses include an ETag for conditional requests.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "countries": {
      • "property1": null,
      • "property2": null
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Check whether the user is active for account tracking

Whether the current user is registered and active for account tracking. Returns 200 whether or not the user is active.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "active": true,
    • "message": "User is registered and active for Account Tracking"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Register the current user for account tracking

Register the current user for account tracking (D11 — pre-activation step).

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

List accounts available for a consent

List accounts available for a specific consent.

Authorizations:
http
path Parameters
consentId
required
integer
query Parameters
scopeEntityId
string
scopeEntityType
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "consent_id": 0,
    • "consent_status": "string",
    • "integration": "string",
    • "owner_entity_id": "string",
    • "owner_entity_type": "string",
    • "accounts": [
      • {
        • "account_id": "string",
        • "account_name": "string",
        • "display_name": "string",
        • "iban": "string",
        • "bban": "string",
        • "account_number": "string",
        • "currency": "string",
        • "account_type": "string",
        • "tracking_status": "tracked"
        }
      ],
    • "summary": {
      • "total_accounts": 0,
      • "tracked_accounts": 0,
      • "new_accounts": 0
      },
    • "consent_info": {
      • "granted_at": "string",
      • "expires_at": "string",
      • "remaining_days": "string",
      • "scope": "string"
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Preview the impact of a purge

Preview the impact of a purge. Available to anyone with accounttracking.delete. can_force_full flag tells the client whether NukeEverything is available.

Authorizations:
http
path Parameters
id
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "physical_account_id": 0,
    • "other_tracker_count": 0,
    • "is_last_tracker": "string",
    • "transaction_count": 0,
    • "linked_counterpart_count": 0,
    • "sync_running": "string",
    • "can_force_full": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Hard-delete a tracked account

Destructively purge (hard delete) a tracked account.

Authorization is per-mode:

  • smart_untrack_unless_last: requires the accounttracking.delete permission, and the account must be within the caller's current scope.
  • nuke_everything: restricted to administrators.
Authorizations:
http
path Parameters
id
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
confirm
required
string
mode
required
string
Enum: "nuke_everything" "smart_untrack_unless_last"
deleteOrphanedCounterparts
boolean

Responses

Response Schema: application/json
required
object or object
required
object

Request samples

Content type
application/json
{
  • "confirm": "string",
  • "mode": "nuke_everything",
  • "deleteOrphanedCounterparts": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "physical_accounts": null,
    • "tracked_accounts": null,
    • "transactions": 0,
    • "counterparts": null,
    • "merged_views": 0,
    • "sessions_scrubbed": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

List tracked accounts for the current scope

List tracked accounts for the current actor/scope. Returns page-paginated ApiCollection + PagePaginationMeta.

Authorizations:
http
query Parameters
page
integer >= 1
perPage
integer [ 1 .. 10000 ]
sort
string
filter[q]
string
filter[status]
string
filter[bankId]
string
filter[countryCode]
string = 2 characters
filter[accountType]
string
Enum: "private" "company" "payment"
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "accountNumber": "string",
      • "bankId": "string",
      • "bankName": "string",
      • "bic": "string",
      • "bban": "string",
      • "currency": "string",
      • "countryCode": "string",
      • "accountType": "string",
      • "ownerName": "string",
      • "grossAmount": 0,
      • "balance": {
        • "amount": 0,
        • "currency": "string",
        • "type": "string",
        • "referenceDate": "string",
        • "fetchedAt": "string"
        },
      • "status": "string",
      • "isActive": true,
      • "partnerAccountStatus": "string",
      • "referenceId": "string",
      • "lastTransactionSync": "string",
      • "physicalAccountId": "string",
      • "scopeEntityType": "string",
      • "scopeEntityId": "string",
      • "scopeName": "string",
      • "autoSyncEnabled": true,
      • "counterpartScanningEnabled": true,
      • "blacklistCheckingEnabled": true,
      • "accountIntelligenceEnabled": true,
      • "scopeOrigin": {
        • "scopeEntityId": "string",
        • "scopeEntityType": "string",
        • "scopeEntityName": "string",
        • "isInherited": true,
        • "physicalAccountId": "string"
        },
      • "latestSyncRun": {
        • "id": "string",
        • "status": "string",
        • "totalTransactions": "string",
        • "transactionsSynced": "string",
        • "detailsFailed": "string",
        • "startedAt": "string",
        • "completedAt": "string"
        },
      • "settings": "string",
      • "availableSettings": "string",
      • "backfillStatus": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": 0,
      • "currentPage": 0,
      • "lastPage": 0
      }
    }
}

Discover and track a bank account

Add (discover + track) a bank account. Returns 201 + Location header.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
bankId
required
string
countryCode
required
string = 2 characters
accountType
required
string
Enum: "private" "company" "payment"
object

Optional visibility configuration (privacy-first — default: self-restricted)

Responses

Response Schema: application/json
data
required
Array of any
required
object

Request samples

Content type
application/json
{
  • "bankId": "string",
  • "countryCode": "st",
  • "accountType": "private",
  • "visibility": {
    • "shared": true,
    • "visibleTo": {
      • "type": "string",
      • "id": "string"
      }
    }
}

Response samples

Content type
application/json
{
  • "data": [
    • null
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Bulk-delete tracked accounts

Bulk delete tracked accounts. Returns { data: { deleted: [...] }, meta: { requestId } }.

Authorizations:
http
query Parameters
ids[]
Array of integers[ items >= 1 ]
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "deleted": {
      • "property1": null,
      • "property2": null
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Fetch a single tracked account

Fetch a single tracked account with settings, availableSettings, backfillStatus. Returns ETag + Cache-Control: private.

Authorizations:
http
path Parameters
id
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "accountNumber": "string",
    • "bankId": "string",
    • "bankName": "string",
    • "bic": "string",
    • "bban": "string",
    • "currency": "string",
    • "countryCode": "string",
    • "accountType": "string",
    • "ownerName": "string",
    • "grossAmount": 0,
    • "balance": {
      • "amount": 0,
      • "currency": "string",
      • "type": "string",
      • "referenceDate": "string",
      • "fetchedAt": "string"
      },
    • "status": "string",
    • "isActive": true,
    • "partnerAccountStatus": "string",
    • "referenceId": "string",
    • "lastTransactionSync": "string",
    • "physicalAccountId": "string",
    • "scopeEntityType": "string",
    • "scopeEntityId": "string",
    • "scopeName": "string",
    • "autoSyncEnabled": true,
    • "counterpartScanningEnabled": true,
    • "blacklistCheckingEnabled": true,
    • "accountIntelligenceEnabled": true,
    • "scopeOrigin": {
      • "scopeEntityId": "string",
      • "scopeEntityType": "string",
      • "scopeEntityName": "string",
      • "isInherited": true,
      • "physicalAccountId": "string"
      },
    • "latestSyncRun": {
      • "id": "string",
      • "status": "string",
      • "totalTransactions": "string",
      • "transactionsSynced": "string",
      • "detailsFailed": "string",
      • "startedAt": "string",
      • "completedAt": "string"
      },
    • "settings": "string",
    • "availableSettings": "string",
    • "backfillStatus": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Account Reports

Reports generated from tracked account activity.

Generate a full PDF account report

Generate a full PDF report for a tracked account.

Returns binary application/pdf — not the standard {data,meta} envelope. This endpoint does not support the Idempotency-Key header.

Authorizations:
http
path Parameters
accountId
required
string
query Parameters
from_date
string or null <date>
to_date
string or null <date>
include_charts
boolean
template
string
Enum: "default" "compliance" "overview"
filename
string <= 255 characters
Array of objects
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Generate a single-transaction PDF slip

Generate a single-transaction PDF slip.

Returns binary application/pdf — not the standard {data,meta} envelope. This endpoint does not support the Idempotency-Key header.

Authorizations:
http
path Parameters
accountId
required
string
transactionId
required
string
query Parameters
filename
string <= 255 characters
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Generate a bulk transaction PDF

Generate a bulk PDF for a user-selected set of transactions on a single account.

Takes the route {accountId} (per-account, not multi-account). Requires transactionIds (array, min 1, max 100, each a string). Restricted to accounts within the caller's current scope. The response includes summary statistics for the included transactions.

SPECIAL SURFACE: binary application/pdf — NOT {data,meta}. Idempotency is not supported for this route.

Authorizations:
http
path Parameters
accountId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
filename
string or null <= 255 characters
transactionIds
required
Array of strings [ 1 .. 100 ] items

Responses

Request samples

Content type
application/json
{
  • "filename": "string",
  • "transactionIds": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Account Settings

Per-account tracking configuration.

Update per-account feature settings

Update per-account feature settings (autoSyncEnabled, counterpartScanningEnabled, etc.). Returns the updated settings, available settings, and backfill status.

Authorizations:
http
path Parameters
id
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
autoSyncEnabled
boolean
counterpartScanningEnabled
boolean
blacklistCheckingEnabled
boolean
accountIntelligenceEnabled
boolean
analysisApproved
boolean

LEX-121: user approval for transaction analysis. Deliberately NOT in mappedSettings(): it targets the shared PhysicalAccount, not a TrackedAccount column — the controller routes it to AccountSettingsService::setAnalysisApproval() with user attribution.

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "autoSyncEnabled": true,
  • "counterpartScanningEnabled": true,
  • "blacklistCheckingEnabled": true,
  • "accountIntelligenceEnabled": true,
  • "analysisApproved": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "settings": "string",
    • "availableSettings": [
      • null
      ],
    • "backfillStatus": {
      • "last_backfill": null,
      • "counterparts_needing_enrichment": "string",
      • "total_counterparts": "string"
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update the tracking start date

Update the scope's visibility floor and trigger backfill if needed.

Authorizations:
http
path Parameters
id
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
trackingStartDate
required
string <date-time>

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "trackingStartDate": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "data": {
    • "tracking_start_date": "string",
    • "previous_tracking_start_date": "string",
    • "earliest_booking": null,
    • "backfill_dispatched": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Trigger a counterpart backfill scan

Trigger a counterpart backfill scan for an account.

Dry-run (dryRun=true): returns stats without dispatching. A live run dispatches a background scan and returns 202.

This endpoint does not support the Idempotency-Key header: re-sending dispatches a new scan.

Authorizations:
http
path Parameters
accountId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
fromDate
string <date>
dryRun
boolean

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "fromDate": "2019-08-24",
  • "dryRun": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "transactionsWithoutEntity": "string",
    • "totalCounterparts": 0,
    • "counterpartsNeedingEnrichment": 0,
    • "counterpartsAlreadyEnriched": "string",
    • "fromDate": "string",
    • "toDate": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Consents

PSD2 account-access consents and their status.

Consent statistics for the current scope

Consent statistics for the current user/scope.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "total": 0,
    • "active": 0,
    • "expired": 0,
    • "revoked": 0,
    • "expiring_soon": 0,
    • "by_integration": {
      • "property1": null,
      • "property2": null
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Batch-revoke expired consents

Batch-revoke expired consents. This endpoint does not support the Idempotency-Key header.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "expiredCount": 0,
    • "processedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List consents by integration

List consents by integration name.

Authorizations:
http
path Parameters
integration
required
string
query Parameters
page
integer >= 1
perPage
integer [ 1 .. 100 ]
sort
string
Enum: "createdAt" "-createdAt" "expiresAt" "-expiresAt"
filter[integration]
string
filter[status]
string
filter[trackedAccountId]
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "integrationName": "string",
      • "purpose": "string",
      • "scope": "string",
      • "status": "string",
      • "isValid": true,
      • "expiresAt": "string",
      • "grantedAt": "string",
      • "revokedAt": "string",
      • "remainingDays": "string",
      • "trackedAccountId": "string",
      • "ownerId": "string",
      • "ownerType": "string",
      • "metadata": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": 0,
      • "currentPage": 0,
      • "lastPage": 0
      }
    }
}

List active consents by integration

List active consents by integration name.

Authorizations:
http
path Parameters
integration
required
string
query Parameters
page
integer >= 1
perPage
integer [ 1 .. 100 ]
sort
string
Enum: "createdAt" "-createdAt" "expiresAt" "-expiresAt"
filter[integration]
string
filter[status]
string
filter[trackedAccountId]
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "integrationName": "string",
      • "purpose": "string",
      • "scope": "string",
      • "status": "string",
      • "isValid": true,
      • "expiresAt": "string",
      • "grantedAt": "string",
      • "revokedAt": "string",
      • "remainingDays": "string",
      • "trackedAccountId": "string",
      • "ownerId": "string",
      • "ownerType": "string",
      • "metadata": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": 0,
      • "currentPage": 0,
      • "lastPage": 0
      }
    }
}

List consents visible to the actor

List consents visible to actor in current context. Returns page-paginated ApiCollection.

Authorizations:
http
query Parameters
page
integer >= 1
perPage
integer [ 1 .. 100 ]
sort
string
Enum: "createdAt" "-createdAt" "expiresAt" "-expiresAt"
filter[integration]
string
filter[status]
string
filter[trackedAccountId]
integer
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "integrationName": "string",
      • "purpose": "string",
      • "scope": "string",
      • "status": "string",
      • "isValid": true,
      • "expiresAt": "string",
      • "grantedAt": "string",
      • "revokedAt": "string",
      • "remainingDays": "string",
      • "trackedAccountId": "string",
      • "ownerId": "string",
      • "ownerType": "string",
      • "metadata": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": 0,
      • "currentPage": 0,
      • "lastPage": 0
      }
    }
}

Create a bank-access consent

Create a new consent. Returns 201 + Location header.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
integrationName
required
string <= 100 characters
Enum: "Neonomics" "CreditSafe" "TestIntegration"
purpose
required
string <= 100 characters
Enum: "account_access" "transaction_history" "balance_inquiry" "credit_check"
expiryDays
integer [ 1 .. 90 ]
trackedAccountId
integer or null
initialScopeType
string or null
initialScopeId
string or null
scope
Array of strings non-empty [ items <= 100 characters ]
Items Enum: "accounts:read" "transactions:read" "balances:read" "statements:read" "profile:read" "companies:read"
metadata
Array of strings or null[ items <= 255 characters ]

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "integrationName": "Neonomics",
  • "purpose": "account_access",
  • "expiryDays": 1,
  • "trackedAccountId": 0,
  • "initialScopeType": "string",
  • "initialScopeId": "string",
  • "scope": [
    • "accounts:read"
    ],
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "integrationName": "string",
    • "purpose": "string",
    • "scope": "string",
    • "status": "string",
    • "isValid": true,
    • "expiresAt": "string",
    • "grantedAt": "string",
    • "revokedAt": "string",
    • "remainingDays": "string",
    • "trackedAccountId": "string",
    • "ownerId": "string",
    • "ownerType": "string",
    • "metadata": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Fetch a single consent

Fetch a single consent.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "integrationName": "string",
    • "purpose": "string",
    • "scope": "string",
    • "status": "string",
    • "isValid": true,
    • "expiresAt": "string",
    • "grantedAt": "string",
    • "revokedAt": "string",
    • "remainingDays": "string",
    • "trackedAccountId": "string",
    • "ownerId": "string",
    • "ownerType": "string",
    • "metadata": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update consent metadata

Update consent metadata.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
metadata
required
Array of strings non-empty [ items <= 255 characters ]

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "integrationName": "string",
    • "purpose": "string",
    • "scope": "string",
    • "status": "string",
    • "isValid": true,
    • "expiresAt": "string",
    • "grantedAt": "string",
    • "revokedAt": "string",
    • "remainingDays": "string",
    • "trackedAccountId": "string",
    • "ownerId": "string",
    • "ownerType": "string",
    • "metadata": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke (soft-delete) a consent

Soft-delete (revoke) a consent. Returns 204 No Content.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Return live consent status fields

Return live consent status fields.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "consentId": 0,
    • "status": "string",
    • "isValid": true,
    • "expiresAt": "string",
    • "remainingDays": 0,
    • "grantedAt": "string",
    • "revokedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Validate consent for an operation

Validate consent for a specific operation.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
operation
required
string <= 100 characters
requiredScopes
Array of strings[ items <= 100 characters ]

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "operation": "string",
  • "requiredScopes": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "consentId": 0,
    • "operation": null,
    • "isValid": true,
    • "consentStatus": "string",
    • "validationTimestamp": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Return remaining validity days

Return remaining validity days for a consent.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "consentId": 0,
    • "remainingDays": 0,
    • "expiresAt": "string",
    • "isExpired": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Explicitly revoke a consent

Explicitly revoke a consent. Returns 204 No Content.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Renew a consent by replacing it

Renew a consent by creating a new one and revoking the old. Returns 201 + new consent resource.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "oldConsentId": 0,
    • "newConsent": {
      • "id": "string",
      • "integrationName": "string",
      • "purpose": "string",
      • "scope": "string",
      • "status": "string",
      • "isValid": true,
      • "expiresAt": "string",
      • "grantedAt": "string",
      • "revokedAt": "string",
      • "remainingDays": "string",
      • "trackedAccountId": "string",
      • "ownerId": "string",
      • "ownerType": "string",
      • "metadata": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      },
    • "requiresRedirect": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Initiate the OAuth consent redirect

Initiate OAuth redirect for consent.

Returns JSON {data:{consentId, redirectUrl, expiresIn}} — not an HTTP 302. The client receives the URL and opens it. This endpoint does not support the Idempotency-Key header.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
bankId
required
string <= 50 characters
redirectUrl
string <uri> <= 255 characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{}

Response samples

Content type
application/json
{
  • "data": {
    • "consentId": 0,
    • "redirectUrl": "string",
    • "expiresIn": 300
    },
  • "meta": {
    • "requestId": "string"
    }
}

List visibility assignments for a consent

List visibility assignments for a consent.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "consentId": 0,
    • "visibilityAssignments": [
      • {
        • "id": "string",
        • "scopeType": "string",
        • "scopeId": "string",
        • "visibilityLevel": "string",
        • "assignmentType": "string",
        • "expiresAt": "string",
        • "grantedBy": "string",
        • "createdAt": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Share a consent with another scope

Share consent with another scope. Returns 201.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
scopeType
required
string
Enum: "user" "tenant" "group" "project"
scopeId
required
string <= 255 characters
visibilityLevel
string
Enum: "full" "limited" "metadata_only"
expiresAt
string <date-time>

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "scopeType": "user",
  • "scopeId": "string",
  • "visibilityLevel": "full",
  • "expiresAt": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "data": {
    • "consentId": 0,
    • "scopeType": null,
    • "scopeId": null,
    • "visibilityLevel": null
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke consent sharing from a scope

Revoke consent sharing from a scope. Returns 204 No Content.

Authorizations:
http
path Parameters
consent
required
integer

The consent ID

query Parameters
scopeType
required
string
Enum: "user" "tenant" "group" "project"
scopeId
required
string <= 255 characters
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Consent Callbacks

Provider callbacks that complete a consent flow.

Process the bank OAuth callback

Process OAuth callback from bank provider.

Returns the raw result from the callback registry — may be a JSON response or an HTTP 302 redirect depending on the integration's callback processor. Never wrapped in {data,meta}.

Authorizations:
http
path Parameters
integration
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
Any of
success
required
boolean
data
required
Array of any

Response samples

Content type
application/json
[ ]

Discovery Sessions

Account-discovery sessions for connecting new accounts.

Start a bank-account discovery session

Initiate a bank-account discovery session with the connected banking integration. Returns an opaque session object.

This endpoint does not support the Idempotency-Key header.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
bankId
required
string
countryCode
required
string = 2 characters
accountType
required
string
Enum: "private" "company" "payment"

Responses

Response Schema: application/json
Any of
string

Request samples

Content type
application/json
{
  • "bankId": "string",
  • "countryCode": "st",
  • "accountType": "private"
}

Response samples

Content type
application/json
{
  • "data": {
    • "session_uuid": "string",
    • "redirect_url": "string",
    • "requires_redirect": true,
    • "bank_name": "string",
    • "status": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

List accounts in a discovery session

List accounts available within a discovery session. Returns the raw session account list from the provider.

Authorizations:
http
path Parameters
sessionUuid
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
Any of
string

Response samples

Content type
application/json
{
  • "data": {
    • "property1": null,
    • "property2": null
    },
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": 0,
      • "currentPage": 1,
      • "lastPage": 1
      }
    }
}

Track selected accounts from a session

Track selected accounts from a discovery session. Returns 201 on success.

Authorizations:
http
path Parameters
sessionUuid
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
accountIds
required
Array of strings non-empty
object

Optional visibility configuration (privacy-first — default: self-restricted)

Responses

Response Schema: application/json
string
Response Schema: application/json
required
object

Don't mark session as completed - keep it active for potential additional tracking

required
object

Request samples

Content type
application/json
{
  • "accountIds": [
    • "string"
    ],
  • "visibility": {
    • "shared": true,
    • "visibleTo": {
      • "type": "string",
      • "id": "string"
      }
    }
}

Response samples

Content type
application/json
"string"

Counterparts

Transaction counterparties linked to accounts.

List counterparts for a tracked account

Get counterparts for a specific account. Also accepts the deprecated flat query parameters.

Authorizations:
http
path Parameters
accountId
required
integer
query Parameters
page
integer >= 1

── v1 standard pagination ────────────────────────────────────

perPage
integer [ 1 .. 10000 ]
per_page
integer [ 1 .. 10000 ]

Deprecated alias of perPage

sort
string
filter[name]
string <= 255 characters
filter[type]
string
filter[parentId]
integer
filter[accessScope]
string
Enum: "private" "user" "group" "tenant" "global"
counterpart_identifier
string <= 255 characters

── Deprecated flat filters — prefer filter[field]=value ────────────

counterpart_type
string
country_code
string = 2 characters
access_scope
string
Enum: "private" "user" "group" "tenant" "global"
creation_source
string <= 50 characters
min_confidence
number [ 0 .. 1 ]
is_manual
boolean
startDate
string or null <date-time>

── Timeframe (both camelCase and snake_case) ─────────────────

start_date
string or null <date-time>
endDate
string or null <date-time>
end_date
string or null <date-time>
rootsOnly
boolean

── Include flags (both camelCase and snake_case) ─────────────

roots_only
boolean
includeParent
boolean
include_parent
boolean
includeChildren
boolean
include_children
boolean
includeRelationships
boolean
include_relationships
boolean
includeBoundEntities
boolean
include_bound_entities
boolean
groupByParent
boolean
group_by_parent
boolean
minConfidence
number [ 0 .. 1 ]

── Min confidence (camelCase alias) ──────────────────────────

accessScope
string
Enum: "private" "user" "group" "tenant" "global"
creationSource
string <= 50 characters
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "counterpartIdentifier": "string",
      • "name": "string",
      • "nameLowercase": "string",
      • "type": "string",
      • "countryCode": "string",
      • "visibleToEntityType": "string",
      • "visibleToEntityId": "string",
      • "accessScope": "string",
      • "confidenceScore": 0,
      • "creationSource": "string",
      • "isActive": true,
      • "isRoot": true,
      • "parentId": "string",
      • "displayName": "string",
      • "userAlias": "string",
      • "userAliasNotes": "string",
      • "effectiveName": "string",
      • "hasUserAlias": "string",
      • "transactionCount": "string",
      • "childCount": "string",
      • "transactionVolumes": "string",
      • "ownership": "string",
      • "relationshipSummary": "string",
      • "boundEntities": "string",
      • "entityMappings": "string",
      • "parent": "string",
      • "metadata": "string",
      • "establishedAt": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "trackedAccountIds": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": { },
      • "currentPage": { },
      • "lastPage": 0
      }
    }
}

List entities available for counterpart binding

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "user": [
      • {
        • "id": "string",
        • "type": "user",
        • "name": "string"
        }
      ],
    • "group": [
      • {
        • "id": "string",
        • "type": "string",
        • "name": "string"
        }
      ],
    • "tenant": [
      • {
        • "id": "string",
        • "type": "string",
        • "name": "string"
        }
      ],
    • "global": [
      • {
        • "id": "system",
        • "type": "system",
        • "name": "Global (System-wide)"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get the current user's counterpart access statistics

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "total_accessible_counterparts": 0,
    • "counterparts_by_scope": "string",
    • "counterparts_by_type": "string",
    • "counterparts_by_source": "string",
    • "own_counterparts": 0,
    • "inherited_counterparts": 0,
    • "high_confidence_counterparts": 0,
    • "manual_counterparts": 0,
    • "auto_created_counterparts": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

List counterparts bound to an entity

Get counterparts for an entity type/id pair. Uses ?entityType=...&entityId=... query params.

Authorizations:
http
query Parameters
page
integer >= 1

── v1 standard pagination ────────────────────────────────────

perPage
integer [ 1 .. 10000 ]
per_page
integer [ 1 .. 10000 ]

Deprecated alias of perPage

sort
string
filter[name]
string <= 255 characters
filter[type]
string
filter[parentId]
integer
filter[accessScope]
string
Enum: "private" "user" "group" "tenant" "global"
counterpart_identifier
string <= 255 characters

── Deprecated flat filters — prefer filter[field]=value ────────────

counterpart_type
string
country_code
string = 2 characters
access_scope
string
Enum: "private" "user" "group" "tenant" "global"
creation_source
string <= 50 characters
min_confidence
number [ 0 .. 1 ]
is_manual
boolean
startDate
string or null <date-time>

── Timeframe (both camelCase and snake_case) ─────────────────

start_date
string or null <date-time>
endDate
string or null <date-time>
end_date
string or null <date-time>
rootsOnly
boolean

── Include flags (both camelCase and snake_case) ─────────────

roots_only
boolean
includeParent
boolean
include_parent
boolean
includeChildren
boolean
include_children
boolean
includeRelationships
boolean
include_relationships
boolean
includeBoundEntities
boolean
include_bound_entities
boolean
groupByParent
boolean
group_by_parent
boolean
minConfidence
number [ 0 .. 1 ]

── Min confidence (camelCase alias) ──────────────────────────

accessScope
string
Enum: "private" "user" "group" "tenant" "global"
creationSource
string <= 50 characters
entityType
string
entityId
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "counterpartIdentifier": "string",
      • "name": "string",
      • "nameLowercase": "string",
      • "type": "string",
      • "countryCode": "string",
      • "visibleToEntityType": "string",
      • "visibleToEntityId": "string",
      • "accessScope": "string",
      • "confidenceScore": 0,
      • "creationSource": "string",
      • "isActive": true,
      • "isRoot": true,
      • "parentId": "string",
      • "displayName": "string",
      • "userAlias": "string",
      • "userAliasNotes": "string",
      • "effectiveName": "string",
      • "hasUserAlias": "string",
      • "transactionCount": "string",
      • "childCount": "string",
      • "transactionVolumes": "string",
      • "ownership": "string",
      • "relationshipSummary": "string",
      • "boundEntities": "string",
      • "entityMappings": "string",
      • "parent": "string",
      • "metadata": "string",
      • "establishedAt": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "trackedAccountIds": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": { },
      • "currentPage": { },
      • "lastPage": 0
      }
    }
}

Auto-bind transactions to counterparts from existing mappings

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "processed": 0,
    • "bound": 0,
    • "errors": [
      • {
        • "counterpart_id": "string",
        • "error": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Merge duplicate counterparts into a primary one

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
primaryId
required
integer
duplicateIds
required
Array of integers non-empty

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "primaryId": 0,
  • "duplicateIds": [
    • 0
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "successful": [
      • "string"
      ],
    • "failed": [
      • {
        • "id": "string",
        • "reason": "Failed to save relationship"
        }
      ],
    • "skipped": [
      • {
        • "id": "string",
        • "reason": "Cannot set counterpart as child of itself"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

List counterparts accessible to the current actor

List counterparts accessible to the current actor. Accepts v1 filter[field]=value and the deprecated flat query parameters.

Authorizations:
http
query Parameters
page
integer >= 1

── v1 standard pagination ────────────────────────────────────

perPage
integer [ 1 .. 10000 ]
per_page
integer [ 1 .. 10000 ]

Deprecated alias of perPage

sort
string
filter[name]
string <= 255 characters
filter[type]
string
filter[parentId]
integer
filter[accessScope]
string
Enum: "private" "user" "group" "tenant" "global"
counterpart_identifier
string <= 255 characters

── Deprecated flat filters — prefer filter[field]=value ────────────

counterpart_type
string
country_code
string = 2 characters
access_scope
string
Enum: "private" "user" "group" "tenant" "global"
creation_source
string <= 50 characters
min_confidence
number [ 0 .. 1 ]
is_manual
boolean
startDate
string or null <date-time>

── Timeframe (both camelCase and snake_case) ─────────────────

start_date
string or null <date-time>
endDate
string or null <date-time>
end_date
string or null <date-time>
rootsOnly
boolean

── Include flags (both camelCase and snake_case) ─────────────

roots_only
boolean
includeParent
boolean
include_parent
boolean
includeChildren
boolean
include_children
boolean
includeRelationships
boolean
include_relationships
boolean
includeBoundEntities
boolean
include_bound_entities
boolean
groupByParent
boolean
group_by_parent
boolean
minConfidence
number [ 0 .. 1 ]

── Min confidence (camelCase alias) ──────────────────────────

accessScope
string
Enum: "private" "user" "group" "tenant" "global"
creationSource
string <= 50 characters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "counterpartIdentifier": "string",
      • "name": "string",
      • "nameLowercase": "string",
      • "type": "string",
      • "countryCode": "string",
      • "visibleToEntityType": "string",
      • "visibleToEntityId": "string",
      • "accessScope": "string",
      • "confidenceScore": 0,
      • "creationSource": "string",
      • "isActive": true,
      • "isRoot": true,
      • "parentId": "string",
      • "displayName": "string",
      • "userAlias": "string",
      • "userAliasNotes": "string",
      • "effectiveName": "string",
      • "hasUserAlias": "string",
      • "transactionCount": "string",
      • "childCount": "string",
      • "transactionVolumes": "string",
      • "ownership": "string",
      • "relationshipSummary": "string",
      • "boundEntities": "string",
      • "entityMappings": "string",
      • "parent": "string",
      • "metadata": "string",
      • "establishedAt": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "trackedAccountIds": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": { },
      • "currentPage": { },
      • "lastPage": 0
      }
    }
}

Create a new counterpart entity

Create a new counterpart entity. Returns 201 + Location header.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
counterpartIdentifier
string <= 255 characters

── Required: identifier (accept both forms) ──────────────────

counterpart_identifier
string <= 255 characters
name
string or null <= 255 characters

── Name ──────────────────────────────────────────────────────

counterpart_name
string or null <= 255 characters
type
string or null
Enum: "company" "person" "bank" "government" "unknown"

── Type ──────────────────────────────────────────────────────

counterpart_type
string or null
Enum: "company" "person" "bank" "government" "unknown"
visibleToEntityType
string or null

── Visibility (camelCase) ─────────────────────────────────────

visibleToEntityId
string or null
visible_to_entity_type
string or null

Deprecated snake_case forms

visible_to_entity_id
string or null
countryCode
string or null = 2 characters

── Rich fields ────────────────────────────────────────────────

country_code
string or null = 2 characters
accessScope
string or null
Enum: "private" "user" "group" "tenant" "global"
access_scope
string or null
Enum: "private" "user" "group" "tenant" "global"
confidenceScore
number or null [ 0 .. 1 ]
confidence_score
number or null [ 0 .. 1 ]
metadata
Array of strings or null

── Metadata (opaque blob) ─────────────────────────────────────

Responses

Response Schema: application/json
data
required
string
required
object

Request samples

Content type
application/json
{
  • "counterpartIdentifier": "string",
  • "counterpart_identifier": "string",
  • "name": "string",
  • "counterpart_name": "string",
  • "type": "company",
  • "counterpart_type": "company",
  • "visibleToEntityType": "string",
  • "visibleToEntityId": "string",
  • "visible_to_entity_type": "string",
  • "visible_to_entity_id": "string",
  • "countryCode": "st",
  • "country_code": "st",
  • "accessScope": "private",
  • "access_scope": "private",
  • "confidenceScore": 1,
  • "confidence_score": 1,
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": "string",
  • "meta": {
    • "requestId": "string"
    }
}

Fetch a single counterpart with full detail

Fetch a single counterpart with full rich shape.

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
data
required
string
required
object

Response samples

Content type
application/json
{
  • "data": "string",
  • "meta": {
    • "requestId": "string"
    }
}

Update a counterpart's attributes

Update a counterpart. Now accepts country_code, confidence_score, metadata.

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string or null <= 255 characters

── Name (camelCase + deprecated snake_case) ──────────────────────────────────

counterpart_name
string or null <= 255 characters
displayName
string or null <= 255 characters

── Display name ──────────────────────────────────────────────

display_name
string or null <= 255 characters
type
string or null
Enum: "company" "person" "bank" "government" "unknown"

── Type ──────────────────────────────────────────────────────

counterpart_type
string or null
Enum: "company" "person" "bank" "government" "unknown"
countryCode
string or null = 2 characters

── Country ───────────────────────────────────────────────────

country_code
string or null = 2 characters
confidenceScore
number or null [ 0 .. 1 ]

── Confidence ────────────────────────────────────────────────

confidence_score
number or null [ 0 .. 1 ]
metadata
Array of strings or null

── Metadata (opaque blob) ─────────────────────────────────────

Responses

Response Schema: application/json
data
required
string
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "counterpart_name": "string",
  • "displayName": "string",
  • "display_name": "string",
  • "type": "company",
  • "counterpart_type": "company",
  • "countryCode": "st",
  • "country_code": "st",
  • "confidenceScore": 1,
  • "confidence_score": 1,
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": "string",
  • "meta": {
    • "requestId": "string"
    }
}

Deactivate a counterpart

Delete a counterpart. Returns 204 No Content.

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Get the current user's alias for a counterpart

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "counterpartId": 0,
    • "alias": null
    },
  • "meta": {
    • "requestId": "string"
    }
}

Set the current user's alias for a counterpart

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
alias
required
string <= 255 characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "alias": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "counterpartId": 0,
    • "alias": null
    },
  • "meta": {
    • "requestId": "string"
    }
}

Remove the current user's alias for a counterpart

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Set a counterpart's display name

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
displayName
required
string <= 255 characters

Responses

Response Schema: application/json
data
required
string
required
object

Request samples

Content type
application/json
{
  • "displayName": "string"
}

Response samples

Content type
application/json
{
  • "data": "string",
  • "meta": {
    • "requestId": "string"
    }
}

Bind a counterpart to an entity

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
entityId
required
string
entityType
required
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "entityId": "string",
  • "entityType": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "counterpartId": 0,
    • "entityId": null,
    • "entityType": null
    },
  • "meta": {
    • "requestId": "string"
    }
}

Unbind a counterpart from an entity

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Bind transactions to a counterpart

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
transactionIds
required
Array of integers non-empty [ items >= 1 ]
transaction_ids
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "transactionIds": [
    • 1
    ],
  • "transaction_ids": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "counterpartId": 0,
    • "boundCount": 0,
    • "results": {
      • "successful": [
        • "string"
        ],
      • "failed": [
        • {
          • "transaction_id": "string",
          • "error": "string"
          }
        ],
      • "already_bound": [
        • "string"
        ]
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

List transactions linked to a counterpart

Cursor-paginated transactions linked to a counterpart.

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

query Parameters
cursor
string
filter[fromDate]
string
filter[toDate]
string
filter[accountId]
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "transactionId": "string",
      • "internalTransactionId": "string",
      • "physicalAccountId": "string",
      • "transactionAmount": 0,
      • "amount": 0,
      • "signedAmount": "string",
      • "currencyCode": "string",
      • "currency": "string",
      • "sourceCurrency": "string",
      • "targetCurrency": "string",
      • "exchangeRate": 0,
      • "bookingDate": "string",
      • "valueDate": "string",
      • "debtorIban": "string",
      • "debtorBban": "string",
      • "debtorName": "string",
      • "debtorBankName": "string",
      • "debtorRemittanceInformation": "string",
      • "creditorIban": "string",
      • "creditorBban": "string",
      • "creditorName": "string",
      • "creditorBankName": "string",
      • "creditorRemittanceInformation": "string",
      • "direction": "string",
      • "counterpartAccountNumber": "string",
      • "counterpartName": "string",
      • "remittanceInformation": "string",
      • "description": "string",
      • "counterpartyBankName": "string",
      • "countryCode": "string",
      • "countryCodeConfidence": 0,
      • "countryCodeMethod": "string",
      • "transactionType": "string",
      • "type": "string",
      • "canonicalType": "string",
      • "canonicalTypeLabel": "string",
      • "canonicalSubtype": "string",
      • "canonicalChannel": "string",
      • "canonicalChannelLabel": "string",
      • "canonicalScheme": "string",
      • "canonicalPurpose": "string",
      • "classificationConfidence": 0,
      • "classificationMethod": "string",
      • "classificationCountry": "string",
      • "classificationProvider": "string",
      • "merchantCategoryCode": "string",
      • "transactionStatus": "string",
      • "status": "string",
      • "transactionMetadata": "string",
      • "mandateId": "string",
      • "referenceNumber": "string",
      • "isReversal": true,
      • "counterpartType": "string",
      • "counterpartTypeLabel": "string",
      • "counterpartTypeConfidence": 0,
      • "counterpartTypeMethod": "string",
      • "companyId": "string",
      • "company": {
        • "id": "string",
        • "name": "string",
        • "organizationNumber": "string"
        },
      • "companyBindingSource": "string",
      • "companyBindingConfidence": 0,
      • "companyBoundAt": "string",
      • "companyBoundBy": "string",
      • "counterpartEntityId": "string",
      • "counterpart": {
        • "id": "string",
        • "counterpartName": "string",
        • "displayName": "string",
        • "effectiveName": "string",
        • "userAlias": "string",
        • "userAliasNotes": "string",
        • "hasUserAlias": true,
        • "type": "string",
        • "countryCode": "string",
        • "isRoot": "string",
        • "directCounterpart": {
          • "id": "string",
          • "counterpartName": "string",
          • "displayName": "string"
          }
        },
      • "isCardTransaction": "string",
      • "isInstantPayment": "string",
      • "isFee": "string",
      • "isTransfer": "string",
      • "hasHighConfidence": "string",
      • "needsReclassification": "string",
      • "hasCounterpartClassification": "string",
      • "hasHighCounterpartConfidence": "string",
      • "needsCounterpartClassification": "string",
      • "boundCompanyId": "string",
      • "boundCompanyName": "string",
      • "raw": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "perPage": { },
      • "nextCursor": "string",
      • "prevCursor": null
      }
    }
}

Get a counterpart's family tree

v1 exception: returns snake_case service output (documented).

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "root": {
      • "id": 0,
      • "counterpart_identifier": "string",
      • "counterpart_name": "string",
      • "display_name": "string",
      • "counterpart_type": "string",
      • "confidence_score": "string",
      • "creation_source": "string",
      • "established_at": "string",
      • "transaction_count": 0,
      • "relationship_summary": {
        • "parent_id": 0,
        • "has_parent": true,
        • "has_children": true,
        • "child_count": 0,
        • "sibling_count": 0,
        • "depth_level": 0,
        • "is_root": true,
        • "is_leaf": true
        }
      },
    • "tree": {
      • "id": 0,
      • "counterpart_identifier": "string",
      • "counterpart_name": "string",
      • "display_name": "string",
      • "counterpart_type": "string",
      • "confidence_score": "string",
      • "creation_source": "string",
      • "established_at": "string",
      • "transaction_count": 0,
      • "relationship_summary": {
        • "parent_id": 0,
        • "has_parent": true,
        • "has_children": true,
        • "child_count": 0,
        • "sibling_count": 0,
        • "depth_level": 0,
        • "is_root": true,
        • "is_leaf": true
        },
      • "children": [
        • [
          • null
          ]
        ]
      },
    • "current_counterpart_id": 0,
    • "tree_stats": {
      • "total_members": "string",
      • "max_depth": 0
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get a counterpart's parent, children, and siblings

v1 exception: returns snake_case service output (documented).

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "parent": {
      • "id": 0,
      • "counterpart_identifier": "string",
      • "counterpart_name": "string",
      • "display_name": "string",
      • "transaction_count": 0
      },
    • "children": [
      • {
        • "id": "string",
        • "counterpart_identifier": "string",
        • "counterpart_name": "string",
        • "display_name": "string",
        • "transaction_count": "string"
        }
      ],
    • "siblings": [
      • {
        • "id": "string",
        • "counterpart_identifier": "string",
        • "counterpart_name": "string",
        • "display_name": "string",
        • "transaction_count": "string"
        }
      ],
    • "summary": {
      • "parent_id": 0,
      • "has_parent": true,
      • "has_children": true,
      • "child_count": 0,
      • "sibling_count": 0,
      • "depth_level": 0,
      • "is_root": true,
      • "is_leaf": true
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Set a counterpart's parent

Authorizations:
http
path Parameters
counterpart
required
integer

The counterpart ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
parentId
required
integer

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "parentId": 0
}

Response samples

Content type
application/json
{
  • "data": {
    • "counterpartId": 0,
    • "parentId": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Transactions

Account transactions and their details.

Force-refresh transactions for an account from the provider

Force-update transactions for an account from the provider. This endpoint does not support the Idempotency-Key header.

Authorizations:
http
path Parameters
id
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "job_dispatched": true,
    • "from_date": "string",
    • "to_date": "string",
    • "force_refresh": true,
    • "backfill_triggered": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

List transactions for an account (cursor-paginated)

Cursor-paginated transaction list, ordered by booking date. Treat the cursor as an opaque string. Responses do not include an ETag.

Authorizations:
http
path Parameters
id
required
integer
query Parameters
perPage
integer [ 1 .. 10000 ]
cursor
string or null
filter[fromDate]
string <date>
filter[toDate]
string <date>
filter[scope]
string
Enum: "organization" "person"
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects or objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "internalTransactionId": "string",
      • "bookingDate": "string",
      • "valueDate": "string",
      • "transactionAmount": 0,
      • "currencyCode": "string",
      • "sourceCurrency": "string",
      • "targetCurrency": "string",
      • "exchangeRate": 0,
      • "debtorIban": "string",
      • "debtorBban": "string",
      • "debtorName": "string",
      • "debtorBankName": "string",
      • "debtorRemittanceInformation": "string",
      • "creditorIban": "string",
      • "creditorBban": "string",
      • "creditorName": "string",
      • "creditorBankName": "string",
      • "creditorRemittanceInformation": "string",
      • "direction": "string",
      • "counterpartAccountNumber": "string",
      • "counterpartName": "string",
      • "remittanceInformation": "string",
      • "counterpartyBankName": "string",
      • "countryCode": "string",
      • "countryCodeConfidence": 0,
      • "countryCodeMethod": "string",
      • "transactionType": "string",
      • "canonicalType": "string",
      • "canonicalTypeLabel": "string",
      • "canonicalSubtype": "string",
      • "canonicalChannel": "string",
      • "canonicalChannelLabel": "string",
      • "canonicalScheme": "string",
      • "canonicalPurpose": "string",
      • "classificationConfidence": 0,
      • "classificationMethod": "string",
      • "classificationCountry": "string",
      • "classificationProvider": "string",
      • "merchantCategoryCode": "string",
      • "transactionStatus": "string",
      • "transactionMetadata": "string",
      • "mandateId": "string",
      • "referenceNumber": "string",
      • "isReversal": true,
      • "counterpartType": "string",
      • "counterpartTypeLabel": "string",
      • "counterpartTypeConfidence": 0,
      • "counterpartTypeMethod": "string",
      • "companyId": "string",
      • "counterpartEntityId": "string",
      • "company_id": "string",
      • "company": {
        • "id": "string",
        • "name": "string",
        • "organization_number": "string"
        },
      • "company_binding_source": "string",
      • "company_binding_confidence": 0,
      • "company_bound_at": "string",
      • "company_bound_by": "string",
      • "isCardTransaction": "string",
      • "isInstantPayment": "string",
      • "isFee": "string",
      • "isTransfer": "string",
      • "hasHighConfidence": "string",
      • "needsReclassification": "string",
      • "hasCounterpartClassification": "string",
      • "hasHighCounterpartConfidence": "string",
      • "needsCounterpartClassification": "string",
      • "counterpart": {
        • "id": "string",
        • "counterpart_name": "string",
        • "display_name": "string",
        • "user_alias": "string",
        • "user_alias_notes": "string",
        • "effective_name": "string",
        • "has_user_alias": true,
        • "type": "string",
        • "country_code": "string",
        • "is_root": "string",
        • "direct_counterpart": {
          • "id": 0,
          • "counterpart_name": "string",
          • "display_name": "string"
          }
        }
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "perPage": { },
      • "nextCursor": "string",
      • "prevCursor": null
      }
    }
}

Fetch a single transaction

Fetch a single transaction.

Authorizations:
http
path Parameters
accountId
required
integer
transactionId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
Any of
required
object or null
required
object

Response samples

Content type
application/json
{ }

Sync transactions for an account from the provider

Sync transactions for an account.

Async (background=true): dispatches a background sync job and returns 202 { "data": { "status": "queued", "accountId": N, "estimatedCompletion": "..." }, "meta": { ... } }

Sync (background=false, default): runs inline and returns 200 { "data": { "syncMode": "immediate", "syncedCount": N }, "meta": { ... } }

This endpoint does not support the Idempotency-Key header.

Authorizations:
http
path Parameters
accountId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
background
boolean
object

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "background": true,
  • "filter": {
    • "fromDate": "2019-08-24",
    • "toDate": "2019-08-24",
    • "scope": "organization"
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "syncMode": "immediate",
    • "syncedCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get the current sync status for an account

Current sync state for an account. Returns null data if no sync run exists. This endpoint does not return an ETag (the data is volatile).

Authorizations:
http
path Parameters
accountId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
Any of
required
object
required
object

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Get transaction statistics for an account

Transaction statistics for an account. Returns an ETag and Cache-Control: private for conditional requests.

Authorizations:
http
path Parameters
accountId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "total_transactions": 0,
    • "incoming_count": 0,
    • "outgoing_count": 0,
    • "bound_to_companies": 0,
    • "unbound_transactions": 0,
    • "total_incoming_amount": null,
    • "total_outgoing_amount": null,
    • "avg_transaction_amount": null,
    • "date_range": {
      • "earliest": null,
      • "latest": null
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Auto-bind transactions by counterpart name matching

Auto-bind transactions by counterpart name matching.

Authorizations:
http
path Parameters
accountId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "boundCount": 0,
    • "message": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Bind a transaction to a company

Bind a transaction to a company.

Authorizations:
http
path Parameters
transactionId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
companyId
required
integer

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "companyId": 0
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Transaction successfully bound to company"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Unbind a transaction from a company

Unbind a transaction from a company.

Authorizations:
http
path Parameters
transactionId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Transaction successfully unbound from company"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Suggest companies for a transaction by counterpart name

Suggest companies for a transaction based on counterpart name.

Authorizations:
http
path Parameters
transactionId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "suggestions": [
      • "string"
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Transaction Counterparts

Counterparties bound to individual transactions.

Bind a transaction to a counterpart entity

Bind a transaction to a counterpart entity. Returns 201 + CounterpartV1Resource.

Authorizations:
http
path Parameters
transaction
required
integer

The transaction ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
counterpartId
required
integer

Responses

Response Schema: application/json
data
required
string
required
object

Request samples

Content type
application/json
{
  • "counterpartId": 0
}

Response samples

Content type
application/json
{
  • "data": "string",
  • "meta": {
    • "requestId": "string"
    }
}

Unbind a transaction from its counterpart

Unbind a transaction from its counterpart. Returns 204 No Content.

Authorizations:
http
path Parameters
transaction
required
integer

The transaction ID

query Parameters
counterpartEntityId
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Get the counterpart linked to a transaction

Get the counterpart entity linked to a transaction.

Authorizations:
http
path Parameters
transaction
required
integer

The transaction ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
Any of
data
required
string
required
object

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Suggest counterparts for a transaction by name/IBAN match

Suggest counterparts for a transaction based on name/IBAN matching.

Authorizations:
http
path Parameters
transaction
required
integer

The transaction ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "suggestions": [
      • null
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Auto-create and optionally bind a counterpart from a transaction

Auto-create a counterpart from a transaction and optionally bind. Returns 201 + CounterpartV1Resource.

Authorizations:
http
path Parameters
transaction
required
integer

The transaction ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
overrideIdentifier
string or null <= 255 characters
autoBind
boolean

Responses

Response Schema: application/json
data
required
string
required
object

Request samples

Content type
application/json
{
  • "overrideIdentifier": "string",
  • "autoBind": true
}

Response samples

Content type
application/json
{
  • "data": "string",
  • "meta": {
    • "requestId": "string"
    }
}

Mappings

Rules that map accounts and transactions to counterparts.

Bind an account identifier to an entity

Bind an account identifier to an entity. Returns 201 + AccountMappingV1Resource.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
accountIdentifier
required
string <= 50 characters
entityId
required
string <= 50 characters
entityType
required
string
ownershipType
string or null
Enum: "owner" "authorized_signatory" "joint_owner"
confidenceScore
number or null [ 0 .. 1 ]
accessScope
string or null
Enum: "private" "user" "group" "tenant" "global"
countryCode
string or null = 2 characters
metadata
Array of strings or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "accountIdentifier": "string",
  • "entityId": "string",
  • "entityType": "string",
  • "ownershipType": "owner",
  • "confidenceScore": 1,
  • "accessScope": "private",
  • "countryCode": "st",
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "accountIdentifier": "string",
    • "entityId": "string",
    • "entityType": "string",
    • "ownershipType": "string",
    • "confidenceScore": "string",
    • "accessScope": "string",
    • "countryCode": "string",
    • "metadata": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Auto-generate account-entity mappings from transaction history

Auto-generate mappings based on transaction history.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
min_confidence
number or null [ 0.5 .. 1 ]
access_scope
string or null
Enum: "private" "user" "group" "tenant" "global"
dry_run
boolean or null
account_identifiers
Array of strings or null <= 100 items [ items <= 50 characters ]

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "min_confidence": 0.5,
  • "access_scope": "private",
  • "dry_run": true,
  • "account_identifiers": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Auto-generation dry run completed",
    • "generated": 0,
    • "skipped": 0,
    • "suggestions": [
      • {
        • "accountIdentifier": "string",
        • "entityId": "string",
        • "entityType": "string",
        • "confidence": "string",
        • "reason": "string"
        }
      ],
    • "errors": [
      • {
        • "accountIdentifier": "string",
        • "error": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Bulk import account-entity mappings

Bulk import mappings.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
mappings
required
Array of strings non-empty [ items ]

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "mappings": [
    • [
      • "string"
      ]
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "imported": 0,
    • "updated": 0,
    • "errors": [
      • {
        • "index": "string",
        • "data": "string",
        • "error": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get mapping statistics for the current user

Get mapping statistics for the current user.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "total_accessible_mappings": 0,
    • "active_accessible_mappings": 0,
    • "mappings_by_ownership_type": "string",
    • "mappings_by_source": "string",
    • "mappings_by_scope": "string",
    • "high_confidence_mappings": 0,
    • "manual_mappings": 0,
    • "auto_generated_mappings": 0,
    • "own_mappings": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

List accounts mapped to an entity

Get accounts mapped to an entity.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
query Parameters
ownership_type
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "entityId": "string",
    • "entityType": "string",
    • "accounts": [
      • {
        • "id": 0,
        • "accountIdentifier": "string",
        • "accountType": "string",
        • "countryCode": "string",
        • "ownershipType": "string",
        • "confidenceScore": "string",
        • "mappingSource": "string",
        • "establishedAt": "2019-08-24T14:15:22Z"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Suggest entities for an account identifier

Get entity suggestions for an account.

Authorizations:
http
path Parameters
accountIdentifier
required
string
query Parameters
accountName
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "accountIdentifier": "string",
    • "suggestions": [
      • {
        • "entityId": "string",
        • "entityType": "string",
        • "entityName": "string",
        • "confidence": "string",
        • "reason": "string",
        • "source": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Remove all entity bindings for an account identifier

Remove all entity bindings for an account identifier.

Authorizations:
http
path Parameters
accountIdentifier
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "message": "string",
    • "accountIdentifier": "string",
    • "deactivatedCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Bind a transaction to an entity

Bind a transaction to an entity.

Authorizations:
http
path Parameters
transactionId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
entityId
required
string
entityType
required
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "entityId": "string",
  • "entityType": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Transaction successfully bound to entity",
    • "transactionId": "string",
    • "entity": {
      • "id": "string",
      • "type": "string",
      • "name": "string"
      },
    • "mappingCreated": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Unbind a transaction from its entity

Unbind a transaction from its entity. Returns 204 No Content.

Authorizations:
http
path Parameters
transactionId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Suggest entities for a transaction

Get entity suggestions for a transaction.

Authorizations:
http
path Parameters
transactionId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "transactionId": 0,
    • "counterpartyAccount": "string",
    • "counterpartyName": "string",
    • "suggestions": [
      • {
        • "entityId": "string",
        • "entityType": "string",
        • "entityName": "string",
        • "confidence": "string",
        • "reason": "string",
        • "source": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

List account-entity mappings accessible to the current user

List mappings accessible to the current user.

Authorizations:
http
query Parameters
accountIdentifier
string
entityType
string
ownershipType
string
accessScope
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "accountIdentifier": "string",
      • "entityId": "string",
      • "entityType": "string",
      • "ownershipType": "string",
      • "confidenceScore": "string",
      • "accessScope": "string",
      • "countryCode": "string",
      • "metadata": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": { },
      • "currentPage": { },
      • "lastPage": 0
      }
    }
}

Get a specific account-entity mapping

Get a specific mapping.

Authorizations:
http
path Parameters
id
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "accountIdentifier": "string",
    • "entityId": "string",
    • "entityType": "string",
    • "ownershipType": "string",
    • "confidenceScore": "string",
    • "accessScope": "string",
    • "countryCode": "string",
    • "metadata": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update an account-entity mapping

Update a mapping.

Authorizations:
http
path Parameters
id
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
ownershipType
string or null
Enum: "owner" "authorized_signatory" "joint_owner"
confidenceScore
number or null [ 0 .. 1 ]
accessScope
string or null
Enum: "private" "user" "group" "tenant" "global"
metadata
Array of strings or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "ownershipType": "owner",
  • "confidenceScore": 1,
  • "accessScope": "private",
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "accountIdentifier": "string",
    • "entityId": "string",
    • "entityType": "string",
    • "ownershipType": "string",
    • "confidenceScore": "string",
    • "accessScope": "string",
    • "countryCode": "string",
    • "metadata": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Delete/deactivate an account-entity mapping

Delete/deactivate a mapping. Returns 204 No Content.

Authorizations:
http
path Parameters
id
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Merged Views

Consolidated, cross-account transaction views.

Ad-hoc merged transactions for given accounts

Ad-hoc merged transactions, cursor-paginated. Requires ?accountIds[]= query parameter.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Ad-hoc merged aggregates for given accounts

Ad-hoc merged aggregates.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Ad-hoc merged counterparts for given accounts

Ad-hoc merged counterparts.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

List merged account views visible to the actor

List merged account views visible to the actor.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "description": "string",
      • "defaultFromDate": "string",
      • "defaultToDate": "string",
      • "defaultBucket": "string",
      • "accounts": [
        • {
          • "id": 0,
          • "name": "string",
          • "number": "string",
          • "bank": "string",
          • "position": 0,
          • "colorHint": "string"
          }
        ],
      • "accountIds": [
        • null
        ],
      • "isFavorite": true,
      • "owner": "string",
      • "deniedAccountIds": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": 0,
      • "currentPage": 0,
      • "lastPage": 0
      }
    }
}

Create a merged account view

Create a new merged account view. Returns 201 + Location header.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
required
string <= 120 characters
description
string or null
defaultFromDate
string or null <date>
defaultToDate
string or null <date>
defaultBucket
string or null
Enum: "auto" "day" "week" "month"
accountIds
required
Array of integers [ 1 .. 50 ] items
colorHints
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "defaultFromDate": "2019-08-24",
  • "defaultToDate": "2019-08-24",
  • "defaultBucket": "auto",
  • "accountIds": [
    • 0
    ],
  • "colorHints": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "description": "string",
    • "defaultFromDate": "string",
    • "defaultToDate": "string",
    • "defaultBucket": "string",
    • "accounts": [
      • {
        • "id": 0,
        • "name": "string",
        • "number": "string",
        • "bank": "string",
        • "position": 0,
        • "colorHint": "string"
        }
      ],
    • "accountIds": [
      • null
      ],
    • "isFavorite": true,
    • "owner": "string",
    • "deniedAccountIds": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Fetch a single merged account view

Fetch a single merged account view.

Authorizations:
http
path Parameters
view
required
string <uuid>

The view ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "description": "string",
    • "defaultFromDate": "string",
    • "defaultToDate": "string",
    • "defaultBucket": "string",
    • "accounts": [
      • {
        • "id": 0,
        • "name": "string",
        • "number": "string",
        • "bank": "string",
        • "position": 0,
        • "colorHint": "string"
        }
      ],
    • "accountIds": [
      • null
      ],
    • "isFavorite": true,
    • "owner": "string",
    • "deniedAccountIds": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

PUT/PATCH accounttracking/v1/views/{view} — update a merged account view

Update a merged account view.

Authorizations:
http
path Parameters
view
required
string <uuid>

The view ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 120 characters
description
string or null
defaultFromDate
string or null <date>
defaultToDate
string or null <date>
defaultBucket
string or null
Enum: "auto" "day" "week" "month"
accountIds
Array of integers [ 1 .. 50 ] items

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "defaultFromDate": "2019-08-24",
  • "defaultToDate": "2019-08-24",
  • "defaultBucket": "auto",
  • "accountIds": [
    • 0
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "description": "string",
    • "defaultFromDate": "string",
    • "defaultToDate": "string",
    • "defaultBucket": "string",
    • "accounts": [
      • {
        • "id": 0,
        • "name": "string",
        • "number": "string",
        • "bank": "string",
        • "position": 0,
        • "colorHint": "string"
        }
      ],
    • "accountIds": [
      • null
      ],
    • "isFavorite": true,
    • "owner": "string",
    • "deniedAccountIds": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

PUT/PATCH accounttracking/v1/views/{view} — update a merged account view

Update a merged account view.

Authorizations:
http
path Parameters
view
required
string <uuid>

The view ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 120 characters
description
string or null
defaultFromDate
string or null <date>
defaultToDate
string or null <date>
defaultBucket
string or null
Enum: "auto" "day" "week" "month"
accountIds
Array of integers [ 1 .. 50 ] items

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "defaultFromDate": "2019-08-24",
  • "defaultToDate": "2019-08-24",
  • "defaultBucket": "auto",
  • "accountIds": [
    • 0
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "description": "string",
    • "defaultFromDate": "string",
    • "defaultToDate": "string",
    • "defaultBucket": "string",
    • "accounts": [
      • {
        • "id": 0,
        • "name": "string",
        • "number": "string",
        • "bank": "string",
        • "position": 0,
        • "colorHint": "string"
        }
      ],
    • "accountIds": [
      • null
      ],
    • "isFavorite": true,
    • "owner": "string",
    • "deniedAccountIds": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Delete a merged account view

Delete a merged account view. Returns 204 No Content.

Authorizations:
http
path Parameters
view
required
string <uuid>

The view ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Get transactions for a saved view

Get transactions for a saved view. Cursor-paginated.

Authorizations:
http
path Parameters
view
required
string <uuid>

The view ID

query Parameters
perPage
integer [ 1 .. 10000 ]
cursor
string or null
filter[fromDate]
string <date>
filter[toDate]
string <date>
bucket
string
Enum: "auto" "day" "week" "month"
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "transactions": [
      • {
        • "id": "string",
        • "transactionId": "string",
        • "internalTransactionId": "string",
        • "physicalAccountId": "string",
        • "transactionAmount": 0,
        • "amount": 0,
        • "signedAmount": "string",
        • "currencyCode": "string",
        • "currency": "string",
        • "sourceCurrency": "string",
        • "targetCurrency": "string",
        • "exchangeRate": 0,
        • "bookingDate": "string",
        • "valueDate": "string",
        • "debtorIban": "string",
        • "debtorBban": "string",
        • "debtorName": "string",
        • "debtorBankName": "string",
        • "debtorRemittanceInformation": "string",
        • "creditorIban": "string",
        • "creditorBban": "string",
        • "creditorName": "string",
        • "creditorBankName": "string",
        • "creditorRemittanceInformation": "string",
        • "direction": "string",
        • "counterpartAccountNumber": "string",
        • "counterpartName": "string",
        • "remittanceInformation": "string",
        • "description": "string",
        • "counterpartyBankName": "string",
        • "countryCode": "string",
        • "countryCodeConfidence": 0,
        • "countryCodeMethod": "string",
        • "transactionType": "string",
        • "type": "string",
        • "canonicalType": "string",
        • "canonicalTypeLabel": "string",
        • "canonicalSubtype": "string",
        • "canonicalChannel": "string",
        • "canonicalChannelLabel": "string",
        • "canonicalScheme": "string",
        • "canonicalPurpose": "string",
        • "classificationConfidence": 0,
        • "classificationMethod": "string",
        • "classificationCountry": "string",
        • "classificationProvider": "string",
        • "merchantCategoryCode": "string",
        • "transactionStatus": "string",
        • "status": "string",
        • "transactionMetadata": "string",
        • "mandateId": "string",
        • "referenceNumber": "string",
        • "isReversal": true,
        • "counterpartType": "string",
        • "counterpartTypeLabel": "string",
        • "counterpartTypeConfidence": 0,
        • "counterpartTypeMethod": "string",
        • "companyId": "string",
        • "company": {
          • "id": "string",
          • "name": "string",
          • "organizationNumber": "string"
          },
        • "companyBindingSource": "string",
        • "companyBindingConfidence": 0,
        • "companyBoundAt": "string",
        • "companyBoundBy": "string",
        • "counterpartEntityId": "string",
        • "counterpart": {
          • "id": "string",
          • "counterpartName": "string",
          • "displayName": "string",
          • "effectiveName": "string",
          • "userAlias": "string",
          • "userAliasNotes": "string",
          • "hasUserAlias": true,
          • "type": "string",
          • "countryCode": "string",
          • "isRoot": "string",
          • "directCounterpart": {
            • "id": "string",
            • "counterpartName": "string",
            • "displayName": "string"
            }
          },
        • "isCardTransaction": "string",
        • "isInstantPayment": "string",
        • "isFee": "string",
        • "isTransfer": "string",
        • "hasHighConfidence": "string",
        • "needsReclassification": "string",
        • "hasCounterpartClassification": "string",
        • "hasHighCounterpartConfidence": "string",
        • "needsCounterpartClassification": "string",
        • "boundCompanyId": "string",
        • "boundCompanyName": "string",
        • "raw": "string",
        • "createdAt": "string",
        • "updatedAt": "string",
        • "trackedAccountId": 0,
        • "viewId": "string"
        }
      ],
    • "deniedAccountIds": [ ]
    },
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "perPage": { },
      • "nextCursor": "string",
      • "prevCursor": null
      }
    }
}

Get aggregates for a saved view

Get aggregates for a saved view.

Authorizations:
http
path Parameters
view
required
string <uuid>

The view ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
bucket
required
string
requested_bucket
required
string
from
required
string
to
required
string
required
Array of objects
currencies
required
Array of any
denied_account_ids
required
string
count_per_bucket
required
string
amount_per_bucket
required
string
running_balance
required
string
balance_origin
required
string

Response samples

Content type
application/json
{
  • "bucket": "string",
  • "requested_bucket": "string",
  • "from": "string",
  • "to": "string",
  • "accounts": [
    • {
      • "id": 0,
      • "label": "string",
      • "currency": "string",
      • "color_hint": "string",
      • "position": 0
      }
    ],
  • "currencies": [
    • null
    ],
  • "denied_account_ids": "string",
  • "count_per_bucket": "string",
  • "amount_per_bucket": "string",
  • "running_balance": "string",
  • "balance_origin": "string"
}

Get counterparts for a saved view

Get counterparts for a saved view.

Authorizations:
http
path Parameters
view
required
string <uuid>

The view ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "counterpartIdentifier": "string",
      • "name": "string",
      • "nameLowercase": "string",
      • "type": "string",
      • "countryCode": "string",
      • "visibleToEntityType": "string",
      • "visibleToEntityId": "string",
      • "accessScope": "string",
      • "confidenceScore": 0,
      • "creationSource": "string",
      • "isActive": true,
      • "isRoot": true,
      • "parentId": "string",
      • "displayName": "string",
      • "userAlias": "string",
      • "userAliasNotes": "string",
      • "effectiveName": "string",
      • "hasUserAlias": "string",
      • "transactionCount": "string",
      • "childCount": "string",
      • "transactionVolumes": "string",
      • "ownership": "string",
      • "relationshipSummary": "string",
      • "boundEntities": "string",
      • "entityMappings": "string",
      • "parent": "string",
      • "metadata": "string",
      • "establishedAt": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "trackedAccountIds": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0,
      • "perPage": { },
      • "currentPage": { },
      • "lastPage": 0
      },
    • "deniedAccountIds": [ ],
    • "timeframe": {
      • "startDate": "string",
      • "endDate": "string"
      }
    }
}

Generate a PDF report for a view

Generate a PDF report for a merged account view.

Returns binary application/pdf — not wrapped in the {data,meta} envelope. This endpoint does not support the Idempotency-Key header.

Authorizations:
http
path Parameters
view
required
string <uuid>

The view ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
filename
string or null <= 255 characters
object
required
Array of objects [ 1 .. 6 ] items

Responses

Request samples

Content type
application/json
{
  • "filename": "string",
  • "filters": {
    • "fromDate": "2019-08-24",
    • "toDate": "2019-08-24",
    • "direction": "Incoming"
    },
  • "charts": [
    • {
      • "id": "string",
      • "image_base64": "string",
      • "width": 1,
      • "height": 1
      }
    ]
}

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Pin a view as a favorite

Pin a view as a favorite for the current user.

Authorizations:
http
path Parameters
view
required
string <uuid>

The view ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "viewId": "string",
    • "isFavorite": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Unpin a view from favorites

Unpin a view from favorites.

Authorizations:
http
path Parameters
view
required
string <uuid>

The view ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "viewId": "string",
    • "isFavorite": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Clients

Client records managed within a scope.

Bulk soft-delete clients by ID

DELETE clients/v1?ids[]=uuid1&ids[]=uuid2

Atomic: all deletions happen in a single transaction. If any item fails authorization or has active cases, the whole batch is rolled back.

Returns 200 with the list of deleted IDs on success.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "deleted": [
      • "string"
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

List all clients visible to the authenticated user in the active scope

Two-tier authorization:

  1. Tenant-scope clients.list capability gates access to the endpoint.
  2. Layer-1 visibility filter restricts the returned set to clients that have a visibility-scope assignment reachable from the current operating scope (X-Scope header).
Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (ClientListResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "type": "string",
      • "displayName": "string",
      • "countryCode": "string",
      • "registrationNumber": "string",
      • "companySnapshot": {
        • "registrationNumber": "string",
        • "countryCode": "string",
        • "country": "string",
        • "vatNumber": "string",
        • "name": "string",
        • "tradingName": "string",
        • "status": "string",
        • "statusCode": "string",
        • "legalForm": "string",
        • "legalFormCode": "string",
        • "registrationDate": "string",
        • "incorporationDate": "string",
        • "dissolutionDate": "string",
        • "address": {
          • "street": "string",
          • "street2": "string",
          • "postalCode": "string",
          • "city": "string",
          • "region": "string",
          • "countryCode": "string",
          • "country": "string"
          },
        • "postalAddress": {
          • "street": "string",
          • "street2": "string",
          • "postalCode": "string",
          • "city": "string",
          • "region": "string",
          • "countryCode": "string",
          • "country": "string"
          },
        • "industryCode": "string",
        • "industryDescription": "string",
        • "naceCode": "string",
        • "numberOfEmployees": 0,
        • "website": "string",
        • "email": "string",
        • "shareCapital": 0,
        • "capitalCurrency": "string",
        • "businessDescription": "string",
        • "sectorCode": "string",
        • "sectorDescription": "string",
        • "isGroupMember": true,
        • "registrySource": "string",
        • "fetchedAt": "string",
        • "sourceUpdatedAt": "string",
        • "contacts": [
          • null
          ],
        • "schemaVersion": 0
        },
      • "nationalIdLast4": "string",
      • "dateOfBirth": "string",
      • "personSnapshot": {
        • "name": "string",
        • "countryCode": "string",
        • "nationalIdLast4": "string",
        • "dateOfBirth": "string",
        • "address": "string"
        },
      • "status": "string",
      • "onboardedAt": "string",
      • "riskClassification": "string",
      • "cddLevel": "string",
      • "pepStatus": "string",
      • "sanctionsStatus": "string",
      • "amlLastReviewedAt": "string",
      • "amlNextReviewDueAt": "string",
      • "conflictCheckStatus": "string",
      • "conflictCheckedAt": "string",
      • "conflictCheckNotes": "string",
      • "engagementType": "string",
      • "taxResidenceCountryCode": "string",
      • "vatNumber": "string",
      • "lei": "string",
      • "preferredLanguage": "string",
      • "notes": "string",
      • "tags": "string",
      • "lastSyncedAt": "string",
      • "createdBy": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "registryId": 0
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create a new client anchored at the operating scope (X-Scope)

Returns 201 Created + Location header pointing to the new resource.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
type
required
string
Enum: "company" "person"
displayName
required
string <= 255 characters
countryCode
required
string = 2 characters
registrationNumber
string or null <= 20 characters

Company-specific

nationalId
string or null <= 100 characters

Person-specific

nationalIdLast4
string or null = 4 characters
dateOfBirth
string or null <date-time>
personSnapshot
Array of strings or null
status
string or null
Enum: "prospect" "active" "inactive" "archived"

Optional common fields

onboardedAt
string or null <date-time>
engagementType
string or null
Enum: "advisory" "litigation" "transactional" "compliance" "other"
taxResidenceCountryCode
string or null = 2 characters
vatNumber
string or null <= 30 characters
lei
string or null <= 20 characters
preferredLanguage
string or null = 2 characters
notes
string or null
tags
Array of strings or null[ items <= 50 characters ]
object

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "type": "company",
  • "displayName": "string",
  • "countryCode": "st",
  • "registrationNumber": "string",
  • "nationalId": "string",
  • "nationalIdLast4": "stri",
  • "dateOfBirth": "2019-08-24T14:15:22Z",
  • "personSnapshot": [
    • "string"
    ],
  • "status": "prospect",
  • "onboardedAt": "2019-08-24T14:15:22Z",
  • "engagementType": "advisory",
  • "taxResidenceCountryCode": "st",
  • "vatNumber": "string",
  • "lei": "string",
  • "preferredLanguage": "st",
  • "notes": "string",
  • "tags": [
    • "string"
    ],
  • "companySnapshot": {
    • "registrationNumber": "string",
    • "name": "string",
    • "countryCode": "st"
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "type": "string",
    • "displayName": "string",
    • "countryCode": "string",
    • "registrationNumber": "string",
    • "companySnapshot": {
      • "registrationNumber": "string",
      • "countryCode": "string",
      • "country": "string",
      • "vatNumber": "string",
      • "name": "string",
      • "tradingName": "string",
      • "status": "string",
      • "statusCode": "string",
      • "legalForm": "string",
      • "legalFormCode": "string",
      • "registrationDate": "string",
      • "incorporationDate": "string",
      • "dissolutionDate": "string",
      • "address": {
        • "street": "string",
        • "street2": "string",
        • "postalCode": "string",
        • "city": "string",
        • "region": "string",
        • "countryCode": "string",
        • "country": "string"
        },
      • "postalAddress": {
        • "street": "string",
        • "street2": "string",
        • "postalCode": "string",
        • "city": "string",
        • "region": "string",
        • "countryCode": "string",
        • "country": "string"
        },
      • "industryCode": "string",
      • "industryDescription": "string",
      • "naceCode": "string",
      • "numberOfEmployees": 0,
      • "website": "string",
      • "email": "string",
      • "shareCapital": 0,
      • "capitalCurrency": "string",
      • "businessDescription": "string",
      • "sectorCode": "string",
      • "sectorDescription": "string",
      • "isGroupMember": true,
      • "registrySource": "string",
      • "fetchedAt": "string",
      • "sourceUpdatedAt": "string",
      • "contacts": [
        • null
        ],
      • "schemaVersion": 0
      },
    • "nationalIdLast4": "string",
    • "dateOfBirth": "string",
    • "personSnapshot": {
      • "name": "string",
      • "countryCode": "string",
      • "nationalIdLast4": "string",
      • "dateOfBirth": "string",
      • "address": "string"
      },
    • "status": "string",
    • "onboardedAt": "string",
    • "riskClassification": "string",
    • "cddLevel": "string",
    • "pepStatus": "string",
    • "sanctionsStatus": "string",
    • "amlLastReviewedAt": "string",
    • "amlNextReviewDueAt": "string",
    • "conflictCheckStatus": "string",
    • "conflictCheckedAt": "string",
    • "conflictCheckNotes": "string",
    • "engagementType": "string",
    • "taxResidenceCountryCode": "string",
    • "vatNumber": "string",
    • "lei": "string",
    • "preferredLanguage": "string",
    • "notes": "string",
    • "tags": [
      • null
      ],
    • "lastSyncedAt": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "registryId": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Show a single client

Two-layer check:

  1. Layer 1 visibility — client must be visible in the current scope. 404 on miss to avoid leaking existence.
  2. Layer 3 permission — caller must hold a client role granting client.view (responsible_partner, client_team, client_viewer).
Authorizations:
http
path Parameters
client
required
string

The client ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "type": "string",
    • "displayName": "string",
    • "countryCode": "string",
    • "registrationNumber": "string",
    • "companySnapshot": {
      • "registrationNumber": "string",
      • "countryCode": "string",
      • "country": "string",
      • "vatNumber": "string",
      • "name": "string",
      • "tradingName": "string",
      • "status": "string",
      • "statusCode": "string",
      • "legalForm": "string",
      • "legalFormCode": "string",
      • "registrationDate": "string",
      • "incorporationDate": "string",
      • "dissolutionDate": "string",
      • "address": {
        • "street": "string",
        • "street2": "string",
        • "postalCode": "string",
        • "city": "string",
        • "region": "string",
        • "countryCode": "string",
        • "country": "string"
        },
      • "postalAddress": {
        • "street": "string",
        • "street2": "string",
        • "postalCode": "string",
        • "city": "string",
        • "region": "string",
        • "countryCode": "string",
        • "country": "string"
        },
      • "industryCode": "string",
      • "industryDescription": "string",
      • "naceCode": "string",
      • "numberOfEmployees": 0,
      • "website": "string",
      • "email": "string",
      • "shareCapital": 0,
      • "capitalCurrency": "string",
      • "businessDescription": "string",
      • "sectorCode": "string",
      • "sectorDescription": "string",
      • "isGroupMember": true,
      • "registrySource": "string",
      • "fetchedAt": "string",
      • "sourceUpdatedAt": "string",
      • "contacts": [
        • null
        ],
      • "schemaVersion": 0
      },
    • "nationalIdLast4": "string",
    • "dateOfBirth": "string",
    • "personSnapshot": {
      • "name": "string",
      • "countryCode": "string",
      • "nationalIdLast4": "string",
      • "dateOfBirth": "string",
      • "address": "string"
      },
    • "status": "string",
    • "onboardedAt": "string",
    • "riskClassification": "string",
    • "cddLevel": "string",
    • "pepStatus": "string",
    • "sanctionsStatus": "string",
    • "amlLastReviewedAt": "string",
    • "amlNextReviewDueAt": "string",
    • "conflictCheckStatus": "string",
    • "conflictCheckedAt": "string",
    • "conflictCheckNotes": "string",
    • "engagementType": "string",
    • "taxResidenceCountryCode": "string",
    • "vatNumber": "string",
    • "lei": "string",
    • "preferredLanguage": "string",
    • "notes": "string",
    • "tags": [
      • null
      ],
    • "lastSyncedAt": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "registryId": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update an existing client

Supports both PUT (full replace) and PATCH (partial update). PATCH is the default — UpdateClientRequest uses sometimes throughout.

Authorizations:
http
path Parameters
client
required
string

The client ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
displayName
string <= 255 characters
countryCode
string = 2 characters
registrationNumber
string or null <= 20 characters

Company fields

companySnapshot
Array of strings or null
nationalId
string or null <= 100 characters

Person fields

nationalIdLast4
string or null = 4 characters
dateOfBirth
string or null <date-time>
personSnapshot
Array of strings or null
status
string
Enum: "prospect" "active" "inactive" "archived"

Status / engagement

onboardedAt
string or null <date-time>
engagementType
string or null
Enum: "advisory" "litigation" "transactional" "compliance" "other"
taxResidenceCountryCode
string or null = 2 characters

Tax / financial

vatNumber
string or null <= 30 characters
lei
string or null <= 20 characters
preferredLanguage
string or null = 2 characters

Comms

notes
string or null

Freeform

tags
Array of strings or null[ items <= 50 characters ]

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "displayName": "string",
  • "countryCode": "st",
  • "registrationNumber": "string",
  • "companySnapshot": [
    • "string"
    ],
  • "nationalId": "string",
  • "nationalIdLast4": "stri",
  • "dateOfBirth": "2019-08-24T14:15:22Z",
  • "personSnapshot": [
    • "string"
    ],
  • "status": "prospect",
  • "onboardedAt": "2019-08-24T14:15:22Z",
  • "engagementType": "advisory",
  • "taxResidenceCountryCode": "st",
  • "vatNumber": "string",
  • "lei": "string",
  • "preferredLanguage": "st",
  • "notes": "string",
  • "tags": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "type": "string",
    • "displayName": "string",
    • "countryCode": "string",
    • "registrationNumber": "string",
    • "companySnapshot": {
      • "registrationNumber": "string",
      • "countryCode": "string",
      • "country": "string",
      • "vatNumber": "string",
      • "name": "string",
      • "tradingName": "string",
      • "status": "string",
      • "statusCode": "string",
      • "legalForm": "string",
      • "legalFormCode": "string",
      • "registrationDate": "string",
      • "incorporationDate": "string",
      • "dissolutionDate": "string",
      • "address": {
        • "street": "string",
        • "street2": "string",
        • "postalCode": "string",
        • "city": "string",
        • "region": "string",
        • "countryCode": "string",
        • "country": "string"
        },
      • "postalAddress": {
        • "street": "string",
        • "street2": "string",
        • "postalCode": "string",
        • "city": "string",
        • "region": "string",
        • "countryCode": "string",
        • "country": "string"
        },
      • "industryCode": "string",
      • "industryDescription": "string",
      • "naceCode": "string",
      • "numberOfEmployees": 0,
      • "website": "string",
      • "email": "string",
      • "shareCapital": 0,
      • "capitalCurrency": "string",
      • "businessDescription": "string",
      • "sectorCode": "string",
      • "sectorDescription": "string",
      • "isGroupMember": true,
      • "registrySource": "string",
      • "fetchedAt": "string",
      • "sourceUpdatedAt": "string",
      • "contacts": [
        • null
        ],
      • "schemaVersion": 0
      },
    • "nationalIdLast4": "string",
    • "dateOfBirth": "string",
    • "personSnapshot": {
      • "name": "string",
      • "countryCode": "string",
      • "nationalIdLast4": "string",
      • "dateOfBirth": "string",
      • "address": "string"
      },
    • "status": "string",
    • "onboardedAt": "string",
    • "riskClassification": "string",
    • "cddLevel": "string",
    • "pepStatus": "string",
    • "sanctionsStatus": "string",
    • "amlLastReviewedAt": "string",
    • "amlNextReviewDueAt": "string",
    • "conflictCheckStatus": "string",
    • "conflictCheckedAt": "string",
    • "conflictCheckNotes": "string",
    • "engagementType": "string",
    • "taxResidenceCountryCode": "string",
    • "vatNumber": "string",
    • "lei": "string",
    • "preferredLanguage": "string",
    • "notes": "string",
    • "tags": [
      • null
      ],
    • "lastSyncedAt": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "registryId": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update an existing client

Supports both PUT (full replace) and PATCH (partial update). PATCH is the default — UpdateClientRequest uses sometimes throughout.

Authorizations:
http
path Parameters
client
required
string

The client ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
displayName
string <= 255 characters
countryCode
string = 2 characters
registrationNumber
string or null <= 20 characters

Company fields

companySnapshot
Array of strings or null
nationalId
string or null <= 100 characters

Person fields

nationalIdLast4
string or null = 4 characters
dateOfBirth
string or null <date-time>
personSnapshot
Array of strings or null
status
string
Enum: "prospect" "active" "inactive" "archived"

Status / engagement

onboardedAt
string or null <date-time>
engagementType
string or null
Enum: "advisory" "litigation" "transactional" "compliance" "other"
taxResidenceCountryCode
string or null = 2 characters

Tax / financial

vatNumber
string or null <= 30 characters
lei
string or null <= 20 characters
preferredLanguage
string or null = 2 characters

Comms

notes
string or null

Freeform

tags
Array of strings or null[ items <= 50 characters ]

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "displayName": "string",
  • "countryCode": "st",
  • "registrationNumber": "string",
  • "companySnapshot": [
    • "string"
    ],
  • "nationalId": "string",
  • "nationalIdLast4": "stri",
  • "dateOfBirth": "2019-08-24T14:15:22Z",
  • "personSnapshot": [
    • "string"
    ],
  • "status": "prospect",
  • "onboardedAt": "2019-08-24T14:15:22Z",
  • "engagementType": "advisory",
  • "taxResidenceCountryCode": "st",
  • "vatNumber": "string",
  • "lei": "string",
  • "preferredLanguage": "st",
  • "notes": "string",
  • "tags": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "type": "string",
    • "displayName": "string",
    • "countryCode": "string",
    • "registrationNumber": "string",
    • "companySnapshot": {
      • "registrationNumber": "string",
      • "countryCode": "string",
      • "country": "string",
      • "vatNumber": "string",
      • "name": "string",
      • "tradingName": "string",
      • "status": "string",
      • "statusCode": "string",
      • "legalForm": "string",
      • "legalFormCode": "string",
      • "registrationDate": "string",
      • "incorporationDate": "string",
      • "dissolutionDate": "string",
      • "address": {
        • "street": "string",
        • "street2": "string",
        • "postalCode": "string",
        • "city": "string",
        • "region": "string",
        • "countryCode": "string",
        • "country": "string"
        },
      • "postalAddress": {
        • "street": "string",
        • "street2": "string",
        • "postalCode": "string",
        • "city": "string",
        • "region": "string",
        • "countryCode": "string",
        • "country": "string"
        },
      • "industryCode": "string",
      • "industryDescription": "string",
      • "naceCode": "string",
      • "numberOfEmployees": 0,
      • "website": "string",
      • "email": "string",
      • "shareCapital": 0,
      • "capitalCurrency": "string",
      • "businessDescription": "string",
      • "sectorCode": "string",
      • "sectorDescription": "string",
      • "isGroupMember": true,
      • "registrySource": "string",
      • "fetchedAt": "string",
      • "sourceUpdatedAt": "string",
      • "contacts": [
        • null
        ],
      • "schemaVersion": 0
      },
    • "nationalIdLast4": "string",
    • "dateOfBirth": "string",
    • "personSnapshot": {
      • "name": "string",
      • "countryCode": "string",
      • "nationalIdLast4": "string",
      • "dateOfBirth": "string",
      • "address": "string"
      },
    • "status": "string",
    • "onboardedAt": "string",
    • "riskClassification": "string",
    • "cddLevel": "string",
    • "pepStatus": "string",
    • "sanctionsStatus": "string",
    • "amlLastReviewedAt": "string",
    • "amlNextReviewDueAt": "string",
    • "conflictCheckStatus": "string",
    • "conflictCheckedAt": "string",
    • "conflictCheckNotes": "string",
    • "engagementType": "string",
    • "taxResidenceCountryCode": "string",
    • "vatNumber": "string",
    • "lei": "string",
    • "preferredLanguage": "string",
    • "notes": "string",
    • "tags": [
      • null
      ],
    • "lastSyncedAt": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "registryId": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Soft-delete a single client

Returns 204 No Content on success. Refuses deletion if active LegalCases exist.

Authorizations:
http
path Parameters
client
required
string

The client ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Cases

Legal cases and their lifecycle.

Bulk soft-delete cases by ID

DELETE cases/v1?ids[]=uuid1&ids[]=uuid2

Atomic: all deletions happen in a single transaction. If any item fails authorization or visibility, the whole batch is rolled back.

Returns 200 with the list of deleted IDs on success.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "deleted": [
      • "string"
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

List all cases visible to the authenticated user in the active scope

Two-tier authorization:

  1. Tenant-scope cases.list capability gates access to the endpoint.
  2. Layer-1 visibility filter restricts the returned set to cases that have a visibility-scope assignment reachable from the current operating scope (X-Scope header).
Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (LegalCaseListResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "caseIdDisplay": "string",
      • "caseType": "string",
      • "status": "string",
      • "clientId": "string",
      • "client": {
        • "id": "string",
        • "type": "string",
        • "displayName": "string",
        • "countryCode": "string",
        • "registrationNumber": "string",
        • "companySnapshot": {
          • "registrationNumber": "string",
          • "countryCode": "string",
          • "country": "string",
          • "vatNumber": "string",
          • "name": "string",
          • "tradingName": "string",
          • "status": "string",
          • "statusCode": "string",
          • "legalForm": "string",
          • "legalFormCode": "string",
          • "registrationDate": "string",
          • "incorporationDate": "string",
          • "dissolutionDate": "string",
          • "address": {
            • "street": "string",
            • "street2": "string",
            • "postalCode": "string",
            • "city": "string",
            • "region": "string",
            • "countryCode": "string",
            • "country": "string"
            },
          • "postalAddress": {
            • "street": "string",
            • "street2": "string",
            • "postalCode": "string",
            • "city": "string",
            • "region": "string",
            • "countryCode": "string",
            • "country": "string"
            },
          • "industryCode": "string",
          • "industryDescription": "string",
          • "naceCode": "string",
          • "numberOfEmployees": 0,
          • "website": "string",
          • "email": "string",
          • "shareCapital": 0,
          • "capitalCurrency": "string",
          • "businessDescription": "string",
          • "sectorCode": "string",
          • "sectorDescription": "string",
          • "isGroupMember": true,
          • "registrySource": "string",
          • "fetchedAt": "string",
          • "sourceUpdatedAt": "string",
          • "contacts": [
            • null
            ],
          • "schemaVersion": 0
          },
        • "nationalIdLast4": "string",
        • "dateOfBirth": "string",
        • "personSnapshot": {
          • "name": "string",
          • "countryCode": "string",
          • "nationalIdLast4": "string",
          • "dateOfBirth": "string",
          • "address": "string"
          },
        • "status": "string",
        • "onboardedAt": "string",
        • "riskClassification": "string",
        • "cddLevel": "string",
        • "pepStatus": "string",
        • "sanctionsStatus": "string",
        • "amlLastReviewedAt": "string",
        • "amlNextReviewDueAt": "string",
        • "conflictCheckStatus": "string",
        • "conflictCheckedAt": "string",
        • "conflictCheckNotes": "string",
        • "engagementType": "string",
        • "taxResidenceCountryCode": "string",
        • "vatNumber": "string",
        • "lei": "string",
        • "preferredLanguage": "string",
        • "notes": "string",
        • "tags": [
          • null
          ],
        • "lastSyncedAt": "string",
        • "createdBy": "string",
        • "createdAt": "string",
        • "updatedAt": "string",
        • "registryId": 0
        },
      • "openedAt": "string",
      • "closedAt": "string",
      • "targetCompletionDate": "string",
      • "description": "string",
      • "notes": "string",
      • "tags": "string",
      • "team": {
        • "leadAttorney": "string",
        • "caseManager": "string",
        • "stakeholders": [
          • "string"
          ]
        },
      • "createdBy": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "registryId": 0
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create a new case and process internal team assignments

Runs in a DB transaction so case creation and role assignments are atomic. If any role assignment fails the entire operation rolls back.

Returns 201 Created + Location header pointing to the new resource.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
name
required
string <= 255 characters

Required fields

clientId
required
string <uuid>
caseType
required
string
Enum: "m_a" "bankruptcy" "litigation" "compliance" "due_diligence" "other"
caseIdDisplay
string or null <= 50 characters

Optional fields

status
string or null
Enum: "draft" "open" "on_hold" "closed" "archived"
openedAt
string or null <date-time>
targetCompletionDate
string or null <date-time>
description
string or null
notes
string or null
tags
Array of strings or null[ items <= 50 characters ]
object

Internal team assignments (processed post-creation). User IDs are integers today; the codebase plans to migrate to UUIDs. Validation accepts either by deferring to the exists:users,id check.

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "clientId": "5e505642-9024-474d-9434-e5a44f505cc5",
  • "caseType": "m_a",
  • "caseIdDisplay": "string",
  • "status": "draft",
  • "openedAt": "2019-08-24T14:15:22Z",
  • "targetCompletionDate": "2019-08-24T14:15:22Z",
  • "description": "string",
  • "notes": "string",
  • "tags": [
    • "string"
    ],
  • "team": {
    • "leadAttorneyId": 0,
    • "caseManagerId": 0,
    • "stakeholderIds": [
      • 0
      ]
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "caseIdDisplay": "string",
    • "caseType": "string",
    • "status": "string",
    • "clientId": "string",
    • "client": {
      • "id": "string",
      • "type": "string",
      • "displayName": "string",
      • "countryCode": "string",
      • "registrationNumber": "string",
      • "companySnapshot": {
        • "registrationNumber": "string",
        • "countryCode": "string",
        • "country": "string",
        • "vatNumber": "string",
        • "name": "string",
        • "tradingName": "string",
        • "status": "string",
        • "statusCode": "string",
        • "legalForm": "string",
        • "legalFormCode": "string",
        • "registrationDate": "string",
        • "incorporationDate": "string",
        • "dissolutionDate": "string",
        • "address": {
          • "street": "string",
          • "street2": "string",
          • "postalCode": "string",
          • "city": "string",
          • "region": "string",
          • "countryCode": "string",
          • "country": "string"
          },
        • "postalAddress": {
          • "street": "string",
          • "street2": "string",
          • "postalCode": "string",
          • "city": "string",
          • "region": "string",
          • "countryCode": "string",
          • "country": "string"
          },
        • "industryCode": "string",
        • "industryDescription": "string",
        • "naceCode": "string",
        • "numberOfEmployees": 0,
        • "website": "string",
        • "email": "string",
        • "shareCapital": 0,
        • "capitalCurrency": "string",
        • "businessDescription": "string",
        • "sectorCode": "string",
        • "sectorDescription": "string",
        • "isGroupMember": true,
        • "registrySource": "string",
        • "fetchedAt": "string",
        • "sourceUpdatedAt": "string",
        • "contacts": [
          • null
          ],
        • "schemaVersion": 0
        },
      • "nationalIdLast4": "string",
      • "dateOfBirth": "string",
      • "personSnapshot": {
        • "name": "string",
        • "countryCode": "string",
        • "nationalIdLast4": "string",
        • "dateOfBirth": "string",
        • "address": "string"
        },
      • "status": "string",
      • "onboardedAt": "string",
      • "riskClassification": "string",
      • "cddLevel": "string",
      • "pepStatus": "string",
      • "sanctionsStatus": "string",
      • "amlLastReviewedAt": "string",
      • "amlNextReviewDueAt": "string",
      • "conflictCheckStatus": "string",
      • "conflictCheckedAt": "string",
      • "conflictCheckNotes": "string",
      • "engagementType": "string",
      • "taxResidenceCountryCode": "string",
      • "vatNumber": "string",
      • "lei": "string",
      • "preferredLanguage": "string",
      • "notes": "string",
      • "tags": [
        • null
        ],
      • "lastSyncedAt": "string",
      • "createdBy": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "registryId": 0
      },
    • "openedAt": "string",
    • "closedAt": "string",
    • "targetCompletionDate": "string",
    • "description": "string",
    • "notes": "string",
    • "tags": [
      • null
      ],
    • "team": {
      • "leadAttorney": "string",
      • "caseManager": "string",
      • "stakeholders": [
        • "string"
        ]
      },
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "registryId": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Show a single case with its client

Two-layer check:

  1. Layer 1 visibility — the case must be visible from the current operating scope. Returns 404 (not 403) on miss to avoid leaking that the case exists.
  2. Layer 3 permission — caller must hold a case role granting case.view (lead_attorney, case_manager, stakeholder, external_*).
Authorizations:
http
path Parameters
case
required
string

The case ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "caseIdDisplay": "string",
    • "caseType": "string",
    • "status": "string",
    • "clientId": "string",
    • "client": {
      • "id": "string",
      • "type": "string",
      • "displayName": "string",
      • "countryCode": "string",
      • "registrationNumber": "string",
      • "companySnapshot": {
        • "registrationNumber": "string",
        • "countryCode": "string",
        • "country": "string",
        • "vatNumber": "string",
        • "name": "string",
        • "tradingName": "string",
        • "status": "string",
        • "statusCode": "string",
        • "legalForm": "string",
        • "legalFormCode": "string",
        • "registrationDate": "string",
        • "incorporationDate": "string",
        • "dissolutionDate": "string",
        • "address": {
          • "street": "string",
          • "street2": "string",
          • "postalCode": "string",
          • "city": "string",
          • "region": "string",
          • "countryCode": "string",
          • "country": "string"
          },
        • "postalAddress": {
          • "street": "string",
          • "street2": "string",
          • "postalCode": "string",
          • "city": "string",
          • "region": "string",
          • "countryCode": "string",
          • "country": "string"
          },
        • "industryCode": "string",
        • "industryDescription": "string",
        • "naceCode": "string",
        • "numberOfEmployees": 0,
        • "website": "string",
        • "email": "string",
        • "shareCapital": 0,
        • "capitalCurrency": "string",
        • "businessDescription": "string",
        • "sectorCode": "string",
        • "sectorDescription": "string",
        • "isGroupMember": true,
        • "registrySource": "string",
        • "fetchedAt": "string",
        • "sourceUpdatedAt": "string",
        • "contacts": [
          • null
          ],
        • "schemaVersion": 0
        },
      • "nationalIdLast4": "string",
      • "dateOfBirth": "string",
      • "personSnapshot": {
        • "name": "string",
        • "countryCode": "string",
        • "nationalIdLast4": "string",
        • "dateOfBirth": "string",
        • "address": "string"
        },
      • "status": "string",
      • "onboardedAt": "string",
      • "riskClassification": "string",
      • "cddLevel": "string",
      • "pepStatus": "string",
      • "sanctionsStatus": "string",
      • "amlLastReviewedAt": "string",
      • "amlNextReviewDueAt": "string",
      • "conflictCheckStatus": "string",
      • "conflictCheckedAt": "string",
      • "conflictCheckNotes": "string",
      • "engagementType": "string",
      • "taxResidenceCountryCode": "string",
      • "vatNumber": "string",
      • "lei": "string",
      • "preferredLanguage": "string",
      • "notes": "string",
      • "tags": [
        • null
        ],
      • "lastSyncedAt": "string",
      • "createdBy": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "registryId": 0
      },
    • "openedAt": "string",
    • "closedAt": "string",
    • "targetCompletionDate": "string",
    • "description": "string",
    • "notes": "string",
    • "tags": [
      • null
      ],
    • "team": {
      • "leadAttorney": "string",
      • "caseManager": "string",
      • "stakeholders": [
        • "string"
        ]
      },
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "registryId": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update an existing case

Supports both PUT (full replace) and PATCH (partial update). PATCH is the default — UpdateCaseRequest uses sometimes throughout.

Authorizations:
http
path Parameters
case
required
string

The case ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters
caseType
string
Enum: "m_a" "bankruptcy" "litigation" "compliance" "due_diligence" "other"
status
string
Enum: "draft" "open" "on_hold" "closed" "archived"
openedAt
string or null <date-time>
closedAt
string or null <date-time>
targetCompletionDate
string or null <date-time>
description
string or null
notes
string or null
tags
Array of strings or null[ items <= 50 characters ]

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "caseType": "m_a",
  • "status": "draft",
  • "openedAt": "2019-08-24T14:15:22Z",
  • "closedAt": "2019-08-24T14:15:22Z",
  • "targetCompletionDate": "2019-08-24T14:15:22Z",
  • "description": "string",
  • "notes": "string",
  • "tags": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "caseIdDisplay": "string",
    • "caseType": "string",
    • "status": "string",
    • "clientId": "string",
    • "client": {
      • "id": "string",
      • "type": "string",
      • "displayName": "string",
      • "countryCode": "string",
      • "registrationNumber": "string",
      • "companySnapshot": {
        • "registrationNumber": "string",
        • "countryCode": "string",
        • "country": "string",
        • "vatNumber": "string",
        • "name": "string",
        • "tradingName": "string",
        • "status": "string",
        • "statusCode": "string",
        • "legalForm": "string",
        • "legalFormCode": "string",
        • "registrationDate": "string",
        • "incorporationDate": "string",
        • "dissolutionDate": "string",
        • "address": {
          • "street": "string",
          • "street2": "string",
          • "postalCode": "string",
          • "city": "string",
          • "region": "string",
          • "countryCode": "string",
          • "country": "string"
          },
        • "postalAddress": {
          • "street": "string",
          • "street2": "string",
          • "postalCode": "string",
          • "city": "string",
          • "region": "string",
          • "countryCode": "string",
          • "country": "string"
          },
        • "industryCode": "string",
        • "industryDescription": "string",
        • "naceCode": "string",
        • "numberOfEmployees": 0,
        • "website": "string",
        • "email": "string",
        • "shareCapital": 0,
        • "capitalCurrency": "string",
        • "businessDescription": "string",
        • "sectorCode": "string",
        • "sectorDescription": "string",
        • "isGroupMember": true,
        • "registrySource": "string",
        • "fetchedAt": "string",
        • "sourceUpdatedAt": "string",
        • "contacts": [
          • null
          ],
        • "schemaVersion": 0
        },
      • "nationalIdLast4": "string",
      • "dateOfBirth": "string",
      • "personSnapshot": {
        • "name": "string",
        • "countryCode": "string",
        • "nationalIdLast4": "string",
        • "dateOfBirth": "string",
        • "address": "string"
        },
      • "status": "string",
      • "onboardedAt": "string",
      • "riskClassification": "string",
      • "cddLevel": "string",
      • "pepStatus": "string",
      • "sanctionsStatus": "string",
      • "amlLastReviewedAt": "string",
      • "amlNextReviewDueAt": "string",
      • "conflictCheckStatus": "string",
      • "conflictCheckedAt": "string",
      • "conflictCheckNotes": "string",
      • "engagementType": "string",
      • "taxResidenceCountryCode": "string",
      • "vatNumber": "string",
      • "lei": "string",
      • "preferredLanguage": "string",
      • "notes": "string",
      • "tags": [
        • null
        ],
      • "lastSyncedAt": "string",
      • "createdBy": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "registryId": 0
      },
    • "openedAt": "string",
    • "closedAt": "string",
    • "targetCompletionDate": "string",
    • "description": "string",
    • "notes": "string",
    • "tags": [
      • null
      ],
    • "team": {
      • "leadAttorney": "string",
      • "caseManager": "string",
      • "stakeholders": [
        • "string"
        ]
      },
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "registryId": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update an existing case

Supports both PUT (full replace) and PATCH (partial update). PATCH is the default — UpdateCaseRequest uses sometimes throughout.

Authorizations:
http
path Parameters
case
required
string

The case ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters
caseType
string
Enum: "m_a" "bankruptcy" "litigation" "compliance" "due_diligence" "other"
status
string
Enum: "draft" "open" "on_hold" "closed" "archived"
openedAt
string or null <date-time>
closedAt
string or null <date-time>
targetCompletionDate
string or null <date-time>
description
string or null
notes
string or null
tags
Array of strings or null[ items <= 50 characters ]

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "caseType": "m_a",
  • "status": "draft",
  • "openedAt": "2019-08-24T14:15:22Z",
  • "closedAt": "2019-08-24T14:15:22Z",
  • "targetCompletionDate": "2019-08-24T14:15:22Z",
  • "description": "string",
  • "notes": "string",
  • "tags": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "caseIdDisplay": "string",
    • "caseType": "string",
    • "status": "string",
    • "clientId": "string",
    • "client": {
      • "id": "string",
      • "type": "string",
      • "displayName": "string",
      • "countryCode": "string",
      • "registrationNumber": "string",
      • "companySnapshot": {
        • "registrationNumber": "string",
        • "countryCode": "string",
        • "country": "string",
        • "vatNumber": "string",
        • "name": "string",
        • "tradingName": "string",
        • "status": "string",
        • "statusCode": "string",
        • "legalForm": "string",
        • "legalFormCode": "string",
        • "registrationDate": "string",
        • "incorporationDate": "string",
        • "dissolutionDate": "string",
        • "address": {
          • "street": "string",
          • "street2": "string",
          • "postalCode": "string",
          • "city": "string",
          • "region": "string",
          • "countryCode": "string",
          • "country": "string"
          },
        • "postalAddress": {
          • "street": "string",
          • "street2": "string",
          • "postalCode": "string",
          • "city": "string",
          • "region": "string",
          • "countryCode": "string",
          • "country": "string"
          },
        • "industryCode": "string",
        • "industryDescription": "string",
        • "naceCode": "string",
        • "numberOfEmployees": 0,
        • "website": "string",
        • "email": "string",
        • "shareCapital": 0,
        • "capitalCurrency": "string",
        • "businessDescription": "string",
        • "sectorCode": "string",
        • "sectorDescription": "string",
        • "isGroupMember": true,
        • "registrySource": "string",
        • "fetchedAt": "string",
        • "sourceUpdatedAt": "string",
        • "contacts": [
          • null
          ],
        • "schemaVersion": 0
        },
      • "nationalIdLast4": "string",
      • "dateOfBirth": "string",
      • "personSnapshot": {
        • "name": "string",
        • "countryCode": "string",
        • "nationalIdLast4": "string",
        • "dateOfBirth": "string",
        • "address": "string"
        },
      • "status": "string",
      • "onboardedAt": "string",
      • "riskClassification": "string",
      • "cddLevel": "string",
      • "pepStatus": "string",
      • "sanctionsStatus": "string",
      • "amlLastReviewedAt": "string",
      • "amlNextReviewDueAt": "string",
      • "conflictCheckStatus": "string",
      • "conflictCheckedAt": "string",
      • "conflictCheckNotes": "string",
      • "engagementType": "string",
      • "taxResidenceCountryCode": "string",
      • "vatNumber": "string",
      • "lei": "string",
      • "preferredLanguage": "string",
      • "notes": "string",
      • "tags": [
        • null
        ],
      • "lastSyncedAt": "string",
      • "createdBy": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "registryId": 0
      },
    • "openedAt": "string",
    • "closedAt": "string",
    • "targetCompletionDate": "string",
    • "description": "string",
    • "notes": "string",
    • "tags": [
      • null
      ],
    • "team": {
      • "leadAttorney": "string",
      • "caseManager": "string",
      • "stakeholders": [
        • "string"
        ]
      },
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "registryId": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Soft-delete a case

Returns 204 No Content on success.

Authorizations:
http
path Parameters
case
required
string

The case ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Teams

Teams within a tenant.

List teams visible to the authenticated user in the current scope

Subscription gate: team.view requires the 'team' entity_service_subscription on the tenant. Returns 403 (not empty list) when the feature is unavailable so the client knows this tier does not include Teams.

Visibility: tenant-wide viewers (admin/owner role on the tenant) see all teams. Team managers and members see only teams that GlobalAccessControl considers visible to them (they have a relationship with the team).

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (TeamResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "slug": "string",
      • "description": "string",
      • "metadata": "string",
      • "isActive": "string",
      • "createdBy": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create a new team in the current tenant scope.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
name
required
string <= 255 characters
slug
string or null <= 255 characters
description
string or null
metadata
Array of strings or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "slug": "string",
  • "description": "string",
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "metadata": "string",
    • "isActive": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Show a single team.

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "metadata": "string",
    • "isActive": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "memberCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a team (PUT = full replace, PATCH = partial).

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters
description
string or null
metadata
Array of strings or null
isActive
boolean

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "metadata": [
    • "string"
    ],
  • "isActive": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "metadata": "string",
    • "isActive": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a team (PUT = full replace, PATCH = partial).

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters
description
string or null
metadata
Array of strings or null
isActive
boolean

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "metadata": [
    • "string"
    ],
  • "isActive": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "metadata": "string",
    • "isActive": "string",
    • "createdBy": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Deactivate a team (sets is_active = false; no cascade delete).

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

List members of a team.

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": 0,
      • "user_id": 0,
      • "name": "string",
      • "email": "string",
      • "member_role": "manager",
      • "role": "string",
      • "roles": [
        • null
        ],
      • "permissions": [
        • "string"
        ],
      • "permission_count": 0,
      • "established_at": "2019-08-24T14:15:22Z"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Add a member to a team.

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
userId
required
integer
memberRole
string or null
Enum: "member" "manager"

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "userId": 0,
  • "memberRole": "member"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Member added successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Remove a member from a team.

Authorizations:
http
path Parameters
group
required
string

The group ID

userId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

List roles assigned to the team as a polymorphic actor.

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "role": "string",
      • "role_name": "string",
      • "capabilities": [
        • null
        ],
      • "key": "string",
      • "type": "string",
      • "target_entity_type": "string",
      • "target_entity_id": "string",
      • "assigned_at": "2019-08-24T14:15:22Z",
      • "assigned_by": 0,
      • "expires_at": "2019-08-24T14:15:22Z"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Assign a role to the team as a polymorphic actor on a target entity.

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
role
required
string <= 100 characters
roleType
string or null
Enum: "standard" "custom"
expiresAt
string or null <date-time>

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "role": "string",
  • "roleType": "standard",
  • "expiresAt": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Role assigned to team."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a role from the team.

Authorizations:
http
path Parameters
group
required
string

The group ID

role
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Role revoked from team.",
    • "revoked": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

List effective permissions for the authenticated user via this team

Returns the permissions the user has at the team's tenant scope (inherited via the team's polymorphic role assignments).

Route middleware: entity.permission:group,team.view

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "capability": "string",
      • "source": "team"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "teamId": "string",
    • "teamRoles": [
      • {
        • "id": "string",
        • "role": "string",
        • "role_name": "string",
        • "capabilities": [
          • null
          ],
        • "key": "string",
        • "type": "string",
        • "target_entity_type": "string",
        • "target_entity_id": "string",
        • "assigned_at": "2019-08-24T14:15:22Z",
        • "assigned_by": 0,
        • "expires_at": "2019-08-24T14:15:22Z"
        }
      ],
    • "permissionCount": 0
    }
}

Groups

Entity groups used to organize structure and access.

List groups accessible by the authenticated user.

User-scoping: only returns groups where the user has an active member, owner, or admin relationship.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (GroupResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "slug": "string",
      • "description": "string",
      • "groupType": "string",
      • "metadata": [
        • null
        ],
      • "isActive": true,
      • "createdBy": 0,
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create a new group.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
name
required
string <= 255 characters
slug
string or null <= 255 characters
description
string or null
groupType
string or null
Enum: "department" "team" "workgroup" "community" "custom"
metadata
Array of strings or null
tenantId
string or null
object

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "slug": "string",
  • "description": "string",
  • "groupType": "department",
  • "metadata": [
    • "string"
    ],
  • "tenantId": "string",
  • "profile": {
    • "displayName": "string",
    • "description": "string",
    • "visibilityScope": "private"
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "groupType": "string",
    • "metadata": [
      • null
      ],
    • "isActive": true,
    • "createdBy": 0,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Show a single group.

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "groupType": "string",
    • "metadata": [
      • null
      ],
    • "isActive": true,
    • "createdBy": 0,
    • "createdAt": "string",
    • "updatedAt": "string",
    • "memberCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a group (PUT = full replace, PATCH = partial).

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters
description
string or null
groupType
string
Enum: "department" "team" "workgroup" "community" "custom"
metadata
Array of strings or null
isActive
boolean
object

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "groupType": "department",
  • "metadata": [
    • "string"
    ],
  • "isActive": true,
  • "profile": {
    • "displayName": "string",
    • "description": "string",
    • "visibilityScope": "private"
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "groupType": "string",
    • "metadata": [
      • null
      ],
    • "isActive": true,
    • "createdBy": 0,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a group (PUT = full replace, PATCH = partial).

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters
description
string or null
groupType
string
Enum: "department" "team" "workgroup" "community" "custom"
metadata
Array of strings or null
isActive
boolean
object

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "groupType": "department",
  • "metadata": [
    • "string"
    ],
  • "isActive": true,
  • "profile": {
    • "displayName": "string",
    • "description": "string",
    • "visibilityScope": "private"
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "groupType": "string",
    • "metadata": [
      • null
      ],
    • "isActive": true,
    • "createdBy": 0,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Deactivate a group (sets is_active = false; no cascade delete).

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

List members of a group (active + pending + suspended).

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "membershipId": "string",
      • "childEntityType": "string",
      • "childEntityId": "string",
      • "membershipStatus": "string",
      • "invitedAt": "string",
      • "acceptedAt": "string",
      • "displayName": "string",
      • "email": null
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Add a member to a group.

Authorizations:
http
path Parameters
group
required
string

The group ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
userId
required
integer
role
required
string
Enum: "member" "owner" "admin"

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "userId": 0,
  • "role": "member"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Member added successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Remove a member from a group.

Authorizations:
http
path Parameters
group
required
string

The group ID

userId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a member's role on a group.

Authorizations:
http
path Parameters
group
required
string

The group ID

userId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
role
required
string
Enum: "member" "owner" "admin"

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "role": "member"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Member role updated successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get a member's permissions on a group.

Authorizations:
http
path Parameters
group
required
string

The group ID

userId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "userId": 0,
    • "groupId": "string",
    • "roles": [
      • {
        • "key": "string",
        • "type": "string",
        • "assignedAt": "string"
        }
      ],
    • "permissions": [
      • "string"
      ],
    • "permissionCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Grant a specific permission to a group member.

Authorizations:
http
path Parameters
group
required
string

The group ID

userId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
permission
required
string
expiresAt
string or null <date-time>

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "permission": "string",
  • "expiresAt": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Permission granted successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a specific permission from a group member.

Authorizations:
http
path Parameters
group
required
string

The group ID

userId
required
integer
permission
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Permission revoked successfully.",
    • "revoked": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Projects

Projects that group related work.

List projects accessible by the authenticated user.

User-scoping: only returns active projects where the user has an active assigned, owner, or collaborator relationship.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (ProjectResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "slug": "string",
      • "description": "string",
      • "projectCode": "string",
      • "projectType": "string",
      • "status": "string",
      • "priority": "string",
      • "startDate": "string",
      • "endDate": "string",
      • "deadlineDate": "string",
      • "budget": "string",
      • "currencyCode": "string",
      • "metadata": [
        • null
        ],
      • "isActive": true,
      • "archivedAt": "string",
      • "createdBy": 0,
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create a new project.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
name
required
string <= 255 characters
slug
string or null <= 255 characters
description
string or null
projectCode
string or null <= 50 characters
projectType
string or null
Enum: "audit" "compliance" "investigation" "research" "development" "consulting" "custom"
status
string or null
Enum: "draft" "active" "on_hold" "completed" "cancelled"
priority
string or null
Enum: "low" "medium" "high" "critical"
startDate
string or null <date-time>
endDate
string or null <date-time>
deadlineDate
string or null <date-time>
budget
number or null >= 0
currencyCode
string or null = 3 characters
metadata
Array of strings or null
tenantId
string or null
groupId
string or null
object

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "slug": "string",
  • "description": "string",
  • "projectCode": "string",
  • "projectType": "audit",
  • "status": "draft",
  • "priority": "low",
  • "startDate": "2019-08-24T14:15:22Z",
  • "endDate": "2019-08-24T14:15:22Z",
  • "deadlineDate": "2019-08-24T14:15:22Z",
  • "budget": 0,
  • "currencyCode": "str",
  • "metadata": [
    • "string"
    ],
  • "tenantId": "string",
  • "groupId": "string",
  • "profile": {
    • "displayName": "string",
    • "description": "string"
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "projectCode": "string",
    • "projectType": "string",
    • "status": "string",
    • "priority": "string",
    • "startDate": "string",
    • "endDate": "string",
    • "deadlineDate": "string",
    • "budget": "string",
    • "currencyCode": "string",
    • "metadata": [
      • null
      ],
    • "isActive": true,
    • "archivedAt": "string",
    • "createdBy": 0,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get overdue projects assigned to the authenticated user.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (ProjectResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "slug": "string",
      • "description": "string",
      • "projectCode": "string",
      • "projectType": "string",
      • "status": "string",
      • "priority": "string",
      • "startDate": "string",
      • "endDate": "string",
      • "deadlineDate": "string",
      • "budget": "string",
      • "currencyCode": "string",
      • "metadata": [
        • null
        ],
      • "isActive": true,
      • "archivedAt": "string",
      • "createdBy": 0,
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Get projects with upcoming deadlines for the authenticated user.

Same whereExists pattern — avoids broken whereUserIsAssigned scope.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (ProjectResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "slug": "string",
      • "description": "string",
      • "projectCode": "string",
      • "projectType": "string",
      • "status": "string",
      • "priority": "string",
      • "startDate": "string",
      • "endDate": "string",
      • "deadlineDate": "string",
      • "budget": "string",
      • "currencyCode": "string",
      • "metadata": [
        • null
        ],
      • "isActive": true,
      • "archivedAt": "string",
      • "createdBy": 0,
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Show a single project.

Authorizations:
http
path Parameters
project
required
string

The project ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "projectCode": "string",
    • "projectType": "string",
    • "status": "string",
    • "priority": "string",
    • "startDate": "string",
    • "endDate": "string",
    • "deadlineDate": "string",
    • "budget": "string",
    • "currencyCode": "string",
    • "metadata": [
      • null
      ],
    • "isActive": true,
    • "archivedAt": "string",
    • "createdBy": 0,
    • "createdAt": "string",
    • "updatedAt": "string",
    • "assignedUserCount": 0,
    • "assignedGroupCount": 0,
    • "isOverdue": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a project (PUT = full replace, PATCH = partial).

Authorizations:
http
path Parameters
project
required
string

The project ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters
description
string or null
projectType
string
Enum: "audit" "compliance" "investigation" "research" "development" "consulting" "custom"
status
string
Enum: "draft" "active" "on_hold" "completed" "cancelled"
priority
string
Enum: "low" "medium" "high" "critical"
startDate
string or null <date-time>
endDate
string or null <date-time>
deadlineDate
string or null <date-time>
budget
number or null >= 0
metadata
Array of strings or null
object

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "projectType": "audit",
  • "status": "draft",
  • "priority": "low",
  • "startDate": "2019-08-24T14:15:22Z",
  • "endDate": "2019-08-24T14:15:22Z",
  • "deadlineDate": "2019-08-24T14:15:22Z",
  • "budget": 0,
  • "metadata": [
    • "string"
    ],
  • "profile": {
    • "displayName": "string",
    • "description": "string"
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "projectCode": "string",
    • "projectType": "string",
    • "status": "string",
    • "priority": "string",
    • "startDate": "string",
    • "endDate": "string",
    • "deadlineDate": "string",
    • "budget": "string",
    • "currencyCode": "string",
    • "metadata": [
      • null
      ],
    • "isActive": true,
    • "archivedAt": "string",
    • "createdBy": 0,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a project (PUT = full replace, PATCH = partial).

Authorizations:
http
path Parameters
project
required
string

The project ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
name
string <= 255 characters
description
string or null
projectType
string
Enum: "audit" "compliance" "investigation" "research" "development" "consulting" "custom"
status
string
Enum: "draft" "active" "on_hold" "completed" "cancelled"
priority
string
Enum: "low" "medium" "high" "critical"
startDate
string or null <date-time>
endDate
string or null <date-time>
deadlineDate
string or null <date-time>
budget
number or null >= 0
metadata
Array of strings or null
object

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "projectType": "audit",
  • "status": "draft",
  • "priority": "low",
  • "startDate": "2019-08-24T14:15:22Z",
  • "endDate": "2019-08-24T14:15:22Z",
  • "deadlineDate": "2019-08-24T14:15:22Z",
  • "budget": 0,
  • "metadata": [
    • "string"
    ],
  • "profile": {
    • "displayName": "string",
    • "description": "string"
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "slug": "string",
    • "description": "string",
    • "projectCode": "string",
    • "projectType": "string",
    • "status": "string",
    • "priority": "string",
    • "startDate": "string",
    • "endDate": "string",
    • "deadlineDate": "string",
    • "budget": "string",
    • "currencyCode": "string",
    • "metadata": [
      • null
      ],
    • "isActive": true,
    • "archivedAt": "string",
    • "createdBy": 0,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Archive a project.

Authorizations:
http
path Parameters
project
required
string

The project ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Project archived successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Unarchive a project.

Authorizations:
http
path Parameters
project
required
string

The project ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Project unarchived successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

List all assignments (users + groups) for a project.

Authorizations:
http
path Parameters
project
required
string

The project ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "users": [
      • {
        • "id": "string",
        • "parent_entity_id": "string",
        • "parent_entity_type": "string",
        • "child_entity_id": "string",
        • "child_entity_type": "string",
        • "relationship_type": "string",
        • "established_at": "2019-08-24T14:15:22Z",
        • "expires_at": "2019-08-24T14:15:22Z",
        • "established_by": 0,
        • "is_active": true,
        • "status": "string",
        • "invitation_token": "string",
        • "invitation_token_expires_at": "2019-08-24T14:15:22Z",
        • "invited_at": "2019-08-24T14:15:22Z",
        • "accepted_at": "2019-08-24T14:15:22Z",
        • "rejected_at": "2019-08-24T14:15:22Z",
        • "suspended_at": "2019-08-24T14:15:22Z",
        • "invited_by": 0,
        • "invitation_message": "string",
        • "requested_role_key": "string",
        • "cascade_mode": "string",
        • "tenant_id": 0,
        • "metadata": [
          • null
          ],
        • "created_at": "2019-08-24T14:15:22Z",
        • "updated_at": "2019-08-24T14:15:22Z",
        • "deleted_at": "2019-08-24T14:15:22Z"
        }
      ],
    • "groups": [
      • {
        • "id": "string",
        • "parent_entity_id": "string",
        • "parent_entity_type": "string",
        • "child_entity_id": "string",
        • "child_entity_type": "string",
        • "relationship_type": "string",
        • "established_at": "2019-08-24T14:15:22Z",
        • "expires_at": "2019-08-24T14:15:22Z",
        • "established_by": 0,
        • "is_active": true,
        • "status": "string",
        • "invitation_token": "string",
        • "invitation_token_expires_at": "2019-08-24T14:15:22Z",
        • "invited_at": "2019-08-24T14:15:22Z",
        • "accepted_at": "2019-08-24T14:15:22Z",
        • "rejected_at": "2019-08-24T14:15:22Z",
        • "suspended_at": "2019-08-24T14:15:22Z",
        • "invited_by": 0,
        • "invitation_message": "string",
        • "requested_role_key": "string",
        • "cascade_mode": "string",
        • "tenant_id": 0,
        • "metadata": [
          • null
          ],
        • "created_at": "2019-08-24T14:15:22Z",
        • "updated_at": "2019-08-24T14:15:22Z",
        • "deleted_at": "2019-08-24T14:15:22Z"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Remove an assignment from a project.

Authorizations:
http
path Parameters
project
required
string

The project ID

query Parameters
entityType
required
string
Enum: "user" "group"
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Assign a user to a project.

Authorizations:
http
path Parameters
project
required
string

The project ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
userId
required
integer
role
required
string
Enum: "assigned" "owner" "collaborator"

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "userId": 0,
  • "role": "assigned"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "User assigned to project successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Assign a group to a project.

Authorizations:
http
path Parameters
project
required
string

The project ID

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
groupId
required
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "groupId": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Group assigned to project successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a user's role on a project.

Authorizations:
http
path Parameters
project
required
string

The project ID

userId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
role
required
string
Enum: "assigned" "owner" "collaborator" "admin" "manager" "member" "viewer"

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "role": "assigned"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "User role updated successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get a user's permissions on a project.

Authorizations:
http
path Parameters
project
required
string

The project ID

userId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "userId": 0,
    • "projectId": "string",
    • "roles": [
      • {
        • "key": "string",
        • "type": "string",
        • "assignedAt": "string"
        }
      ],
    • "permissions": [
      • "string"
      ],
    • "permissionCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Grant a specific permission to a user on a project.

Authorizations:
http
path Parameters
project
required
string

The project ID

userId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
permission
required
string
expiresAt
string or null <date-time>

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "permission": "string",
  • "expiresAt": "2019-08-24T14:15:22Z"
}

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Permission granted successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a specific permission from a user on a project.

Authorizations:
http
path Parameters
project
required
string

The project ID

userId
required
integer
permission
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "message": "Permission revoked successfully.",
    • "revoked": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Profiles

Profile details attached to an entity.

Get the entity's profile

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "scopeEntityType": "string",
    • "scopeEntityId": "string",
    • "displayName": "string",
    • "description": "string",
    • "logoPath": "string",
    • "avatarPath": "string",
    • "metadata": [
      • null
      ],
    • "settings": [
      • null
      ],
    • "visibilityScope": "string",
    • "ownerEntityType": "string",
    • "ownerEntityId": "string",
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update the entity's profile (PUT = full replace, PATCH = partial)

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
displayName
string or null <= 255 characters
description
string or null
visibilityScope
string or null
Enum: "private" "group" "tenant" "partner" "global"
metadata
Array of strings or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "displayName": "string",
  • "description": "string",
  • "visibilityScope": "private",
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "scopeEntityType": "string",
    • "scopeEntityId": "string",
    • "displayName": "string",
    • "description": "string",
    • "logoPath": "string",
    • "avatarPath": "string",
    • "metadata": [
      • null
      ],
    • "settings": [
      • null
      ],
    • "visibilityScope": "string",
    • "ownerEntityType": "string",
    • "ownerEntityId": "string",
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update the entity's profile (PUT = full replace, PATCH = partial)

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
displayName
string or null <= 255 characters
description
string or null
visibilityScope
string or null
Enum: "private" "group" "tenant" "partner" "global"
metadata
Array of strings or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "displayName": "string",
  • "description": "string",
  • "visibilityScope": "private",
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "scopeEntityType": "string",
    • "scopeEntityId": "string",
    • "displayName": "string",
    • "description": "string",
    • "logoPath": "string",
    • "avatarPath": "string",
    • "metadata": [
      • null
      ],
    • "settings": [
      • null
      ],
    • "visibilityScope": "string",
    • "ownerEntityType": "string",
    • "ownerEntityId": "string",
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get complete profile summary with all related data

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "entityType": "string",
    • "entityId": "string",
    • "name": "string",
    • "displayName": "string",
    • "description": "string",
    • "profile": {
      • "id": 0,
      • "entityType": "string",
      • "entityId": "string",
      • "scopeEntityType": "string",
      • "scopeEntityId": "string",
      • "displayName": "string",
      • "description": "string",
      • "logoPath": "string",
      • "avatarPath": "string",
      • "metadata": [
        • null
        ],
      • "settings": [
        • null
        ],
      • "visibilityScope": "string",
      • "ownerEntityType": "string",
      • "ownerEntityId": "string",
      • "isActive": true,
      • "createdAt": "string",
      • "updatedAt": "string"
      },
    • "primaryAddress": {
      • "id": "string",
      • "entityType": "string",
      • "entityId": "string",
      • "addressType": "string",
      • "label": "string",
      • "addressLine1": "string",
      • "addressLine2": "string",
      • "city": "string",
      • "stateProvince": "string",
      • "postalCode": "string",
      • "countryCode": "string",
      • "isPrimary": true,
      • "isActive": true,
      • "createdAt": "string",
      • "updatedAt": "string"
      },
    • "addresses": [
      • {
        • "id": "string",
        • "entityType": "string",
        • "entityId": "string",
        • "addressType": "string",
        • "label": "string",
        • "addressLine1": "string",
        • "addressLine2": "string",
        • "city": "string",
        • "stateProvince": "string",
        • "postalCode": "string",
        • "countryCode": "string",
        • "isPrimary": true,
        • "isActive": true,
        • "createdAt": "string",
        • "updatedAt": "string"
        }
      ],
    • "addressesCount": 0,
    • "contacts": [
      • {
        • "id": 0,
        • "entityType": "string",
        • "entityId": "string",
        • "contactType": "string",
        • "contactValue": "string",
        • "label": "string",
        • "isPrimary": true,
        • "isVerified": true,
        • "verifiedAt": "string",
        • "isActive": true,
        • "createdAt": "string",
        • "updatedAt": "string"
        }
      ],
    • "contactsCount": 0,
    • "avatar": {
      • "id": 0,
      • "url": "string",
      • "fileName": "string"
      },
    • "logo": {
      • "id": 0,
      • "url": "string",
      • "fileName": "string"
      },
    • "media": [
      • {
        • "id": 0,
        • "entityType": "string",
        • "entityId": "string",
        • "mediaType": "string",
        • "fileName": "string",
        • "fileSize": 0,
        • "mimeType": "string",
        • "url": "string",
        • "metadata": [
          • null
          ],
        • "uploadedBy": 0,
        • "isActive": true,
        • "createdAt": "string",
        • "updatedAt": "string"
        }
      ],
    • "mediaCount": 0,
    • "groupType": "string",
    • "memberCount": 0,
    • "projectType": "string",
    • "status": "string",
    • "priority": "string",
    • "assignedUserCount": 0,
    • "assignedGroupCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Contacts

Contact records attached to an entity.

Get all contacts for an entity.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
query Parameters
type
string
verified
boolean
Default: false
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (EntityContactResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": 0,
      • "entityType": "string",
      • "entityId": "string",
      • "contactType": "string",
      • "contactValue": "string",
      • "label": "string",
      • "isPrimary": true,
      • "isVerified": true,
      • "verifiedAt": "string",
      • "isActive": true,
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create a new contact for an entity.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
contactType
required
string
Enum: "email" "phone" "mobile" "fax" "website" "linkedin" "twitter" "facebook" "instagram" "other"
contactValue
required
string <= 255 characters
label
string or null <= 100 characters
isPrimary
boolean or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "contactType": "email",
  • "contactValue": "string",
  • "label": "string",
  • "isPrimary": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "contactType": "string",
    • "contactValue": "string",
    • "label": "string",
    • "isPrimary": true,
    • "isVerified": true,
    • "verifiedAt": "string",
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get a specific contact

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
contactId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "contactType": "string",
    • "contactValue": "string",
    • "label": "string",
    • "isPrimary": true,
    • "isVerified": true,
    • "verifiedAt": "string",
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a contact (PUT = full replace, PATCH = partial)

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
contactId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
contactType
string
Enum: "email" "phone" "mobile" "fax" "website" "linkedin" "twitter" "facebook" "instagram" "other"
contactValue
string <= 255 characters
label
string or null <= 100 characters
isPrimary
boolean or null
isActive
boolean or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "contactType": "email",
  • "contactValue": "string",
  • "label": "string",
  • "isPrimary": true,
  • "isActive": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "contactType": "string",
    • "contactValue": "string",
    • "label": "string",
    • "isPrimary": true,
    • "isVerified": true,
    • "verifiedAt": "string",
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a contact (PUT = full replace, PATCH = partial)

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
contactId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
contactType
string
Enum: "email" "phone" "mobile" "fax" "website" "linkedin" "twitter" "facebook" "instagram" "other"
contactValue
string <= 255 characters
label
string or null <= 100 characters
isPrimary
boolean or null
isActive
boolean or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "contactType": "email",
  • "contactValue": "string",
  • "label": "string",
  • "isPrimary": true,
  • "isActive": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "contactType": "string",
    • "contactValue": "string",
    • "label": "string",
    • "isPrimary": true,
    • "isVerified": true,
    • "verifiedAt": "string",
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Delete a contact.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
contactId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Set a contact as primary

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
contactId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "contactType": "string",
    • "contactValue": "string",
    • "label": "string",
    • "isPrimary": true,
    • "isVerified": true,
    • "verifiedAt": "string",
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Verify a contact

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
contactId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "contactType": "string",
    • "contactValue": "string",
    • "label": "string",
    • "isPrimary": true,
    • "isVerified": true,
    • "verifiedAt": "string",
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Media

Files and media attached to an entity.

Get all media for an entity.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
query Parameters
type
string
active
boolean
Default: false
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (EntityMediaResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": 0,
      • "entityType": "string",
      • "entityId": "string",
      • "mediaType": "string",
      • "fileName": "string",
      • "fileSize": 0,
      • "mimeType": "string",
      • "url": "string",
      • "metadata": [
        • null
        ],
      • "uploadedBy": 0,
      • "isActive": true,
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Upload new media for an entity.

NOTE: This action handles multipart/form-data — do NOT add api.idempotent middleware to the route invoking this method.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: multipart/form-data
required
file
required
string <binary> <application/octet-stream> <= 10240 characters
media_type
required
string
Enum: "avatar" "logo" "document" "image" "video" "other"

10 MB max

metadata
Array of strings or null

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "mediaType": "string",
    • "fileName": "string",
    • "fileSize": 0,
    • "mimeType": "string",
    • "url": "string",
    • "metadata": [
      • null
      ],
    • "uploadedBy": 0,
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get a specific media item

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
mediaId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "mediaType": "string",
    • "fileName": "string",
    • "fileSize": 0,
    • "mimeType": "string",
    • "url": "string",
    • "metadata": [
      • null
      ],
    • "uploadedBy": 0,
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Delete a media item.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
mediaId
required
integer
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get current avatar

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "url": "string",
    • "fileName": "string",
    • "uploadedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Upload avatar shortcut.

NOTE: multipart/form-data — do NOT add api.idempotent middleware to this route.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: multipart/form-data
required
file
required
string <binary> <application/octet-stream> <= 10240 characters
media_type
required
string
Enum: "avatar" "logo" "document" "image" "video" "other"

10 MB max

metadata
Array of strings or null

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "mediaType": "string",
    • "fileName": "string",
    • "fileSize": 0,
    • "mimeType": "string",
    • "url": "string",
    • "metadata": [
      • null
      ],
    • "uploadedBy": 0,
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get current logo

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "url": "string",
    • "fileName": "string",
    • "uploadedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Upload logo shortcut.

NOTE: multipart/form-data — do NOT add api.idempotent middleware to this route.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: multipart/form-data
required
file
required
string <binary> <application/octet-stream> <= 10240 characters
media_type
required
string
Enum: "avatar" "logo" "document" "image" "video" "other"

10 MB max

metadata
Array of strings or null

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": 0,
    • "entityType": "string",
    • "entityId": "string",
    • "mediaType": "string",
    • "fileName": "string",
    • "fileSize": 0,
    • "mimeType": "string",
    • "url": "string",
    • "metadata": [
      • null
      ],
    • "uploadedBy": 0,
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Addresses

Postal and physical addresses attached to an entity.

Get all addresses for an entity

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (EntityAddressResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "entityType": "string",
      • "entityId": "string",
      • "addressType": "string",
      • "label": "string",
      • "addressLine1": "string",
      • "addressLine2": "string",
      • "city": "string",
      • "stateProvince": "string",
      • "postalCode": "string",
      • "countryCode": "string",
      • "isPrimary": true,
      • "isActive": true,
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create a new address for an entity.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
addressType
required
string
Enum: "headquarters" "branch" "billing" "shipping" "home" "work" "other"
label
string or null <= 100 characters
addressLine1
required
string <= 255 characters
addressLine2
string or null <= 255 characters
city
required
string <= 100 characters
stateProvince
string or null <= 100 characters
postalCode
string or null <= 20 characters
countryCode
required
string = 2 characters
isPrimary
boolean or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "addressType": "headquarters",
  • "label": "string",
  • "addressLine1": "string",
  • "addressLine2": "string",
  • "city": "string",
  • "stateProvince": "string",
  • "postalCode": "string",
  • "countryCode": "st",
  • "isPrimary": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "addressType": "string",
    • "label": "string",
    • "addressLine1": "string",
    • "addressLine2": "string",
    • "city": "string",
    • "stateProvince": "string",
    • "postalCode": "string",
    • "countryCode": "string",
    • "isPrimary": true,
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Get a specific address

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
addressId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "addressType": "string",
    • "label": "string",
    • "addressLine1": "string",
    • "addressLine2": "string",
    • "city": "string",
    • "stateProvince": "string",
    • "postalCode": "string",
    • "countryCode": "string",
    • "isPrimary": true,
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update an address (PUT = full replace, PATCH = partial)

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
addressId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
addressType
string
Enum: "headquarters" "branch" "billing" "shipping" "home" "work" "other"
label
string or null <= 100 characters
addressLine1
string <= 255 characters
addressLine2
string or null <= 255 characters
city
string <= 100 characters
stateProvince
string or null <= 100 characters
postalCode
string or null <= 20 characters
countryCode
string = 2 characters
isPrimary
boolean or null
isActive
boolean or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "addressType": "headquarters",
  • "label": "string",
  • "addressLine1": "string",
  • "addressLine2": "string",
  • "city": "string",
  • "stateProvince": "string",
  • "postalCode": "string",
  • "countryCode": "st",
  • "isPrimary": true,
  • "isActive": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "addressType": "string",
    • "label": "string",
    • "addressLine1": "string",
    • "addressLine2": "string",
    • "city": "string",
    • "stateProvince": "string",
    • "postalCode": "string",
    • "countryCode": "string",
    • "isPrimary": true,
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update an address (PUT = full replace, PATCH = partial)

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
addressId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
addressType
string
Enum: "headquarters" "branch" "billing" "shipping" "home" "work" "other"
label
string or null <= 100 characters
addressLine1
string <= 255 characters
addressLine2
string or null <= 255 characters
city
string <= 100 characters
stateProvince
string or null <= 100 characters
postalCode
string or null <= 20 characters
countryCode
string = 2 characters
isPrimary
boolean or null
isActive
boolean or null

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "addressType": "headquarters",
  • "label": "string",
  • "addressLine1": "string",
  • "addressLine2": "string",
  • "city": "string",
  • "stateProvince": "string",
  • "postalCode": "string",
  • "countryCode": "st",
  • "isPrimary": true,
  • "isActive": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "addressType": "string",
    • "label": "string",
    • "addressLine1": "string",
    • "addressLine2": "string",
    • "city": "string",
    • "stateProvince": "string",
    • "postalCode": "string",
    • "countryCode": "string",
    • "isPrimary": true,
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Delete an address.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
addressId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Set an address as primary

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
addressId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "addressType": "string",
    • "label": "string",
    • "addressLine1": "string",
    • "addressLine2": "string",
    • "city": "string",
    • "stateProvince": "string",
    • "postalCode": "string",
    • "countryCode": "string",
    • "isPrimary": true,
    • "isActive": true,
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Invitations

Invitations to join an entity.

List pending invitations issued by the host entity.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (InvitationResource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "parentEntityType": "string",
      • "parentEntityId": "string",
      • "childEntityType": "string",
      • "childEntityId": "string",
      • "relationshipType": "string",
      • "status": "string",
      • "invitationToken": "string",
      • "invitationTokenExpiresAt": "string",
      • "invitedAt": "string",
      • "acceptedAt": "string",
      • "rejectedAt": "string",
      • "suspendedAt": "string",
      • "invitedBy": "string",
      • "invitationMessage": "string",
      • "requestedRoleKey": "string",
      • "establishedBy": "string",
      • "establishedAt": "string",
      • "expiresAt": "string",
      • "metadata": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create (send) a new invitation from the host entity.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
member_type
required
string <= 50 characters
member_email
string or null <email> <= 255 characters
member_id
string or null <= 255 characters
requested_role_key
required
string <= 50 characters
message
string or null <= 2000 characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "member_type": "string",
  • "member_email": "user@example.com",
  • "member_id": "string",
  • "requested_role_key": "string",
  • "message": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "parentEntityType": "string",
    • "parentEntityId": "string",
    • "childEntityType": "string",
    • "childEntityId": "string",
    • "relationshipType": "string",
    • "status": "string",
    • "invitationToken": "string",
    • "invitationTokenExpiresAt": "string",
    • "invitedAt": "string",
    • "acceptedAt": "string",
    • "rejectedAt": "string",
    • "suspendedAt": "string",
    • "invitedBy": "string",
    • "invitationMessage": "string",
    • "requestedRoleKey": "string",
    • "establishedBy": "string",
    • "establishedAt": "string",
    • "expiresAt": "string",
    • "metadata": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a pending invitation issued by the host entity.

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
string
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "parentEntityType": "string",
    • "parentEntityId": "string",
    • "childEntityType": "string",
    • "childEntityId": "string",
    • "relationshipType": "string",
    • "status": "string",
    • "invitationToken": "string",
    • "invitationTokenExpiresAt": "string",
    • "invitedAt": "string",
    • "acceptedAt": "string",
    • "rejectedAt": "string",
    • "suspendedAt": "string",
    • "invitedBy": "string",
    • "invitationMessage": "string",
    • "requestedRoleKey": "string",
    • "establishedBy": "string",
    • "establishedAt": "string",
    • "expiresAt": "string",
    • "metadata": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Products

The catalog of available products.

List available products for the current entity scope

GET productmanagement/v1/products

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (ProductV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "slug": "string",
      • "name": "string",
      • "description": "string",
      • "icon": "string",
      • "category": "string",
      • "productType": "string",
      • "status": "string",
      • "isFree": true,
      • "requiresIntegration": true,
      • "sortOrder": 0,
      • "createdAt": "string",
      • "updatedAt": "string",
      • "features": [
        • {
          • "id": "string",
          • "featureKey": "string",
          • "name": "string",
          • "description": "string",
          • "isRequired": true,
          • "sortOrder": 0
          }
        ],
      • "defaultIntegrationSlugs": [
        • null
        ],
      • "metadata": [
        • null
        ]
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

List eligible integrations for a product, annotated with the entity's configuration state.

GET productmanagement/v1/products/{slug}/integrations/eligible?regions[]=NO&regions[]=DK

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "slug": "string",
      • "description": "string",
      • "health": "string",
      • "status": "string",
      • "supportedCountries": [
        • null
        ],
      • "coveredRegions": "string",
      • "missingRegions": "string",
      • "isConfigured": true,
      • "isAttached": true,
      • "isDefault": true
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "requestedRegions": [
      • null
      ],
    • "productSlug": "string",
    • "productType": "string"
    }
}

Check entity eligibility for a specific product

GET productmanagement/v1/products/{slug}/eligibility

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object (ProductEligibilityV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "eligible": "string",
    • "alreadyActivated": "string",
    • "existingActivationStatus": "string",
    • "reason": "string",
    • "resumable": "string",
    • "existingActivationId": "string",
    • "integrationsAvailable": "string",
    • "availableIntegrationCount": "string",
    • "currentPackageSlug": "string",
    • "currentPackageName": "string",
    • "currentTierLevel": "string",
    • "requiredPackageSlug": "string",
    • "requiredPackageName": "string",
    • "requiredTierLevel": "string",
    • "tierMet": "string",
    • "featureAvailability": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Show product details with features

GET productmanagement/v1/products/{slug}

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object (ProductV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "slug": "string",
    • "name": "string",
    • "description": "string",
    • "icon": "string",
    • "category": "string",
    • "productType": "string",
    • "status": "string",
    • "isFree": true,
    • "requiresIntegration": true,
    • "sortOrder": 0,
    • "createdAt": "string",
    • "updatedAt": "string",
    • "features": [
      • {
        • "id": "string",
        • "featureKey": "string",
        • "name": "string",
        • "description": "string",
        • "isRequired": true,
        • "sortOrder": 0
        }
      ],
    • "defaultIntegrationSlugs": [
      • null
      ],
    • "metadata": [
      • null
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Packages

The catalog of product packages.

List public active packages for the entity scope.

GET productmanagement/v1/packages

Authorizations:
http
query Parameters
type
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (PackageV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "slug": "string",
      • "name": "string",
      • "description": "string",
      • "icon": "string",
      • "packageType": "string",
      • "tierLevel": 0,
      • "tierGroup": "string",
      • "isPublic": true,
      • "audience": [
        • null
        ],
      • "status": "string",
      • "sortOrder": 0,
      • "priceAmount": "string",
      • "priceCurrency": "string",
      • "billingPeriod": "string",
      • "metadata": [
        • null
        ],
      • "createdAt": "string",
      • "updatedAt": "string",
      • "products": [
        • {
          • "productId": "string",
          • "grantedTier": "string",
          • "autoActivate": true,
          • "includedFeatures": [
            • null
            ],
          • "limits": [
            • null
            ],
          • "product": {
            • "id": "string",
            • "slug": "string",
            • "name": "string",
            • "description": "string",
            • "icon": "string",
            • "category": "string",
            • "productType": "string",
            • "status": "string",
            • "isFree": true,
            • "requiresIntegration": true,
            • "sortOrder": 0,
            • "createdAt": "string",
            • "updatedAt": "string",
            • "features": [
              • {
                • "id": "string",
                • "featureKey": "string",
                • "name": "string",
                • "description": "string",
                • "isRequired": true,
                • "sortOrder": 0
                }
              ],
            • "defaultIntegrationSlugs": [
              • null
              ],
            • "metadata": [
              • null
              ]
            }
          }
        ],
      • "isEntitySubscribed": true
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Get package details by slug

GET productmanagement/v1/packages/{slug}

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object (PackageV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "slug": "string",
    • "name": "string",
    • "description": "string",
    • "icon": "string",
    • "packageType": "string",
    • "tierLevel": 0,
    • "tierGroup": "string",
    • "isPublic": true,
    • "audience": [
      • null
      ],
    • "status": "string",
    • "sortOrder": 0,
    • "priceAmount": "string",
    • "priceCurrency": "string",
    • "billingPeriod": "string",
    • "metadata": [
      • null
      ],
    • "createdAt": "string",
    • "updatedAt": "string",
    • "products": [
      • {
        • "productId": "string",
        • "grantedTier": "string",
        • "autoActivate": true,
        • "includedFeatures": [
          • null
          ],
        • "limits": [
          • null
          ],
        • "product": {
          • "id": "string",
          • "slug": "string",
          • "name": "string",
          • "description": "string",
          • "icon": "string",
          • "category": "string",
          • "productType": "string",
          • "status": "string",
          • "isFree": true,
          • "requiresIntegration": true,
          • "sortOrder": 0,
          • "createdAt": "string",
          • "updatedAt": "string",
          • "features": [
            • {
              • "id": "string",
              • "featureKey": "string",
              • "name": "string",
              • "description": "string",
              • "isRequired": true,
              • "sortOrder": 0
              }
            ],
          • "defaultIntegrationSlugs": [
            • null
            ],
          • "metadata": [
            • null
            ]
          }
        }
      ],
    • "isEntitySubscribed": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Activations

Product activations and their status.

Get activation status for a product

GET productmanagement/v1/products/{slug}/status

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
Any of
required
object (ProductActivationV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "productSlug": "string",
    • "status": "not_activated"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Check credential availability for activation

GET productmanagement/v1/products/{slug}/activate/credentials

Authorizations:
http
path Parameters
slug
required
string
query Parameters
integrationId
string
integration_id
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
Any of
required
object
required
object

Response samples

Content type
application/json
{
  • "data": [
    • null
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Configure entity-specific credentials for activation

PUT productmanagement/v1/products/{slug}/activate/credentials

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
credentialType
string <= 100 characters
integrationId
string <= 36 characters
credentials
required
Array of strings non-empty

Responses

Response Schema: application/json
required
object (ProductActivationV1Resource)
required
object

Request samples

Content type
application/json
{
  • "credentialType": "string",
  • "integrationId": "string",
  • "credentials": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "productId": "string",
    • "status": "string",
    • "activatedBy": "string",
    • "activatedAt": "string",
    • "deactivatedAt": "string",
    • "activationContext": [
      • null
      ],
    • "metadata": [
      • null
      ],
    • "createdAt": "string",
    • "updatedAt": "string",
    • "product": {
      • "id": "string",
      • "slug": "string",
      • "name": "string",
      • "description": "string",
      • "icon": "string",
      • "category": "string",
      • "productType": "string",
      • "status": "string",
      • "isFree": true,
      • "requiresIntegration": true,
      • "sortOrder": 0,
      • "createdAt": "string",
      • "updatedAt": "string",
      • "features": [
        • {
          • "id": "string",
          • "featureKey": "string",
          • "name": "string",
          • "description": "string",
          • "isRequired": true,
          • "sortOrder": 0
          }
        ],
      • "defaultIntegrationSlugs": [
        • null
        ],
      • "metadata": [
        • null
        ]
      },
    • "integrations": [
      • {
        • "id": "string",
        • "name": "string",
        • "slug": "string",
        • "status": "string",
        • "health": "string",
        • "supportedCountries": [
          • null
          ],
        • "pivotStatus": "string",
        • "attachedAt": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Complete product activation

POST productmanagement/v1/products/{slug}/activate/complete

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object (ProductActivationV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "productId": "string",
    • "status": "string",
    • "activatedBy": "string",
    • "activatedAt": "string",
    • "deactivatedAt": "string",
    • "activationContext": [
      • null
      ],
    • "metadata": [
      • null
      ],
    • "createdAt": "string",
    • "updatedAt": "string",
    • "product": {
      • "id": "string",
      • "slug": "string",
      • "name": "string",
      • "description": "string",
      • "icon": "string",
      • "category": "string",
      • "productType": "string",
      • "status": "string",
      • "isFree": true,
      • "requiresIntegration": true,
      • "sortOrder": 0,
      • "createdAt": "string",
      • "updatedAt": "string",
      • "features": [
        • {
          • "id": "string",
          • "featureKey": "string",
          • "name": "string",
          • "description": "string",
          • "isRequired": true,
          • "sortOrder": 0
          }
        ],
      • "defaultIntegrationSlugs": [
        • null
        ],
      • "metadata": [
        • null
        ]
      },
    • "integrations": [
      • {
        • "id": "string",
        • "name": "string",
        • "slug": "string",
        • "status": "string",
        • "health": "string",
        • "supportedCountries": [
          • null
          ],
        • "pivotStatus": "string",
        • "attachedAt": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Cancel a pending/configuring activation

DELETE productmanagement/v1/products/{slug}/activate/cancel

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Deactivate a product

DELETE productmanagement/v1/products/{slug}/activate

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Begin product activation (creates pending activation).

POST productmanagement/v1/products/{slug}/activate

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object (ProductActivationV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "productId": "string",
    • "status": "string",
    • "activatedBy": "string",
    • "activatedAt": "string",
    • "deactivatedAt": "string",
    • "activationContext": [
      • null
      ],
    • "metadata": [
      • null
      ],
    • "createdAt": "string",
    • "updatedAt": "string",
    • "product": {
      • "id": "string",
      • "slug": "string",
      • "name": "string",
      • "description": "string",
      • "icon": "string",
      • "category": "string",
      • "productType": "string",
      • "status": "string",
      • "isFree": true,
      • "requiresIntegration": true,
      • "sortOrder": 0,
      • "createdAt": "string",
      • "updatedAt": "string",
      • "features": [
        • {
          • "id": "string",
          • "featureKey": "string",
          • "name": "string",
          • "description": "string",
          • "isRequired": true,
          • "sortOrder": 0
          }
        ],
      • "defaultIntegrationSlugs": [
        • null
        ],
      • "metadata": [
        • null
        ]
      },
    • "integrations": [
      • {
        • "id": "string",
        • "name": "string",
        • "slug": "string",
        • "status": "string",
        • "health": "string",
        • "supportedCountries": [
          • null
          ],
        • "pivotStatus": "string",
        • "attachedAt": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Select integration providers for activation (multi-select)

PUT productmanagement/v1/products/{slug}/activate/integrations

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
integrationIds
required
Array of strings non-empty [ items <= 36 characters ]
regions
Array of strings[ items <= 8 characters ]

Responses

Response Schema: application/json
required
object (ProductActivationV1Resource)
required
object

Request samples

Content type
application/json
{
  • "integrationIds": [
    • "string"
    ],
  • "regions": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "productId": "string",
    • "status": "string",
    • "activatedBy": "string",
    • "activatedAt": "string",
    • "deactivatedAt": "string",
    • "activationContext": [
      • null
      ],
    • "metadata": [
      • null
      ],
    • "createdAt": "string",
    • "updatedAt": "string",
    • "product": {
      • "id": "string",
      • "slug": "string",
      • "name": "string",
      • "description": "string",
      • "icon": "string",
      • "category": "string",
      • "productType": "string",
      • "status": "string",
      • "isFree": true,
      • "requiresIntegration": true,
      • "sortOrder": 0,
      • "createdAt": "string",
      • "updatedAt": "string",
      • "features": [
        • {
          • "id": "string",
          • "featureKey": "string",
          • "name": "string",
          • "description": "string",
          • "isRequired": true,
          • "sortOrder": 0
          }
        ],
      • "defaultIntegrationSlugs": [
        • null
        ],
      • "metadata": [
        • null
        ]
      },
    • "integrations": [
      • {
        • "id": "string",
        • "name": "string",
        • "slug": "string",
        • "status": "string",
        • "health": "string",
        • "supportedCountries": [
          • null
          ],
        • "pivotStatus": "string",
        • "attachedAt": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

List the integrations attached to a specific activation

GET productmanagement/v1/products/{slug}/integrations

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "integrationId": "string",
      • "integration": {
        • "id": "string",
        • "name": "string",
        • "slug": "string",
        • "health": "string",
        • "status": "string",
        • "supportedCountries": [
          • null
          ]
        },
      • "status": "string",
      • "attachedAt": "string",
      • "pausedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Attach an additional integration to an existing activation

POST productmanagement/v1/products/{slug}/integrations

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
integrationId
required
string <= 36 characters

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "integrationId": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "integrationId": "string",
    • "status": "string",
    • "attachedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Detach an integration from an existing activation

DELETE productmanagement/v1/products/{slug}/integrations/{integrationId}

Authorizations:
http
path Parameters
slug
required
string
integrationId
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

List entity's activated products

GET productmanagement/v1/activations

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (ProductActivationV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "entityType": "string",
      • "entityId": "string",
      • "productId": "string",
      • "status": "string",
      • "activatedBy": "string",
      • "activatedAt": "string",
      • "deactivatedAt": "string",
      • "activationContext": [
        • null
        ],
      • "metadata": [
        • null
        ],
      • "createdAt": "string",
      • "updatedAt": "string",
      • "product": {
        • "id": "string",
        • "slug": "string",
        • "name": "string",
        • "description": "string",
        • "icon": "string",
        • "category": "string",
        • "productType": "string",
        • "status": "string",
        • "isFree": true,
        • "requiresIntegration": true,
        • "sortOrder": 0,
        • "createdAt": "string",
        • "updatedAt": "string",
        • "features": [
          • {
            • "id": "string",
            • "featureKey": "string",
            • "name": "string",
            • "description": "string",
            • "isRequired": true,
            • "sortOrder": 0
            }
          ],
        • "defaultIntegrationSlugs": [
          • null
          ],
        • "metadata": [
          • null
          ]
        },
      • "integrations": [
        • {
          • "id": "string",
          • "name": "string",
          • "slug": "string",
          • "status": "string",
          • "health": "string",
          • "supportedCountries": [
            • null
            ],
          • "pivotStatus": "string",
          • "attachedAt": "string"
          }
        ]
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Product Credentials

Credentials required to use a product.

Get credential status for an active product

GET productmanagement/v1/products/{slug}/credentials

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
Any of
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "hasCredentials": true,
    • "credentialLevel": null,
    • "authenticationMethod": null,
    • "credentialSchema": [ ],
    • "existingCredentials": {
      • "global": null,
      • "entity": null
      },
    • "credentialMode": "system_default"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update credentials for an active product (rotation / new entity-level set)

PUT productmanagement/v1/products/{slug}/credentials

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
credentialType
string <= 100 characters
integrationId
string <= 36 characters
credentials
required
Array of strings non-empty

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "credentialType": "string",
  • "integrationId": "string",
  • "credentials": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "status": "ok",
    • "message": "Credentials updated successfully."
    },
  • "meta": {
    • "requestId": "string"
    }
}

Reset to global credentials by deactivating entity-level credentials.

DELETE productmanagement/v1/products/{slug}/credentials

Authorizations:
http
path Parameters
slug
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Subscriptions

Product and package subscriptions.

List the current entity scope's active package subscriptions

GET productmanagement/v1/subscriptions

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
Array of objects (SubscriptionV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "entityType": "string",
      • "entityId": "string",
      • "packageId": "string",
      • "isActive": true,
      • "source": "string",
      • "assignedBy": 0,
      • "startsAt": "string",
      • "expiresAt": "string",
      • "autoRenew": true,
      • "metadata": [
        • null
        ],
      • "createdAt": "string",
      • "updatedAt": "string",
      • "package": {
        • "id": "string",
        • "slug": "string",
        • "name": "string",
        • "description": "string",
        • "icon": "string",
        • "packageType": "string",
        • "tierLevel": 0,
        • "tierGroup": "string",
        • "isPublic": true,
        • "audience": [
          • null
          ],
        • "status": "string",
        • "sortOrder": 0,
        • "priceAmount": "string",
        • "priceCurrency": "string",
        • "billingPeriod": "string",
        • "metadata": [
          • null
          ],
        • "createdAt": "string",
        • "updatedAt": "string",
        • "products": [
          • {
            • "productId": "string",
            • "grantedTier": "string",
            • "autoActivate": true,
            • "includedFeatures": [
              • null
              ],
            • "limits": [
              • null
              ],
            • "product": {
              • "id": "string",
              • "slug": "string",
              • "name": "string",
              • "description": "string",
              • "icon": "string",
              • "category": "string",
              • "productType": "string",
              • "status": "string",
              • "isFree": true,
              • "requiresIntegration": true,
              • "sortOrder": 0,
              • "createdAt": "string",
              • "updatedAt": "string",
              • "features": [
                • {
                  • "id": "string",
                  • "featureKey": "string",
                  • "name": "string",
                  • "description": "string",
                  • "isRequired": true,
                  • "sortOrder": 0
                  }
                ],
              • "defaultIntegrationSlugs": [
                • null
                ],
              • "metadata": [
                • null
                ]
              }
            }
          ],
        • "isEntitySubscribed": true
        }
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create a subscription for the current entity scope.

POST productmanagement/v1/subscriptions

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
packageSlug
string <= 191 characters
packageId
string <uuid>
metadata
Array of strings

Responses

Response Schema: application/json
required
object (SubscriptionV1Resource)
required
object

Request samples

Content type
application/json
{
  • "packageSlug": "string",
  • "packageId": "471cc1d4-ec27-4504-b7c2-949af95662bc",
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "packageId": "string",
    • "isActive": true,
    • "source": "string",
    • "assignedBy": 0,
    • "startsAt": "string",
    • "expiresAt": "string",
    • "autoRenew": true,
    • "metadata": [
      • null
      ],
    • "createdAt": "string",
    • "updatedAt": "string",
    • "package": {
      • "id": "string",
      • "slug": "string",
      • "name": "string",
      • "description": "string",
      • "icon": "string",
      • "packageType": "string",
      • "tierLevel": 0,
      • "tierGroup": "string",
      • "isPublic": true,
      • "audience": [
        • null
        ],
      • "status": "string",
      • "sortOrder": 0,
      • "priceAmount": "string",
      • "priceCurrency": "string",
      • "billingPeriod": "string",
      • "metadata": [
        • null
        ],
      • "createdAt": "string",
      • "updatedAt": "string",
      • "products": [
        • {
          • "productId": "string",
          • "grantedTier": "string",
          • "autoActivate": true,
          • "includedFeatures": [
            • null
            ],
          • "limits": [
            • null
            ],
          • "product": {
            • "id": "string",
            • "slug": "string",
            • "name": "string",
            • "description": "string",
            • "icon": "string",
            • "category": "string",
            • "productType": "string",
            • "status": "string",
            • "isFree": true,
            • "requiresIntegration": true,
            • "sortOrder": 0,
            • "createdAt": "string",
            • "updatedAt": "string",
            • "features": [
              • {
                • "id": "string",
                • "featureKey": "string",
                • "name": "string",
                • "description": "string",
                • "isRequired": true,
                • "sortOrder": 0
                }
              ],
            • "defaultIntegrationSlugs": [
              • null
              ],
            • "metadata": [
              • null
              ]
            }
          }
        ],
      • "isEntitySubscribed": true
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Return the single current tier subscription for the scope, or null

GET productmanagement/v1/subscriptions/current

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
Any of
required
object (SubscriptionV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Cancel the current tier subscription for the scope

DELETE productmanagement/v1/subscriptions/current

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Cancel a specific subscription by id

DELETE productmanagement/v1/subscriptions/{id}

Authorizations:
http
path Parameters
id
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response samples

Content type
application/json
{
  • "error": {
    • "code": "unauthenticated",
    • "message": "string",
    • "details": { }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Users

User accounts within a tenant.

List members of the active scope.

Authorizations:
http
query Parameters
filter
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
object

Response samples

Content type
application/json
{ }

Remove multiple members from the active scope. Body { ids }.

Authorizations:
http
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

A member's detail within the active scope.

Authorizations:
http
path Parameters
id
required
string or null
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
object

Response samples

Content type
application/json
{ }

Remove a member from the active scope.

Authorizations:
http
path Parameters
id
required
string or null
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

User Roles

A user's roles across scopes and profiles.

Read the user's profile within the current scope

Read the user's profile as seen within the current scope, resolving in order: scope-specific, then ancestor scope, then default — so an unset scope profile gracefully falls back to the user's default profile.

Authorizations:
http
path Parameters
id
required
string or null
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "defaultMetadata": "string",
    • "scopedMetadata": "string",
    • "mergedMetadata": "string",
    • "scope": "string",
    • "profile": {
      • "id": "string",
      • "displayName": "string",
      • "description": "string",
      • "logoPath": "string",
      • "avatarPath": "string",
      • "visibilityScope": "string",
      • "isActive": "string",
      • "scopeEntityType": "string",
      • "scopeEntityId": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update the user's scope-specific profile metadata

Save the user's scope-specific profile metadata. This does not write any credentials.

Authorization: self-update is always permitted; updating another user's profile requires the members.manage permission.

Authorizations:
http
path Parameters
id
required
string or null
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
metadata
required
Array of strings non-empty

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "metadata": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "defaultMetadata": "string",
    • "scopedMetadata": "string",
    • "mergedMetadata": "string",
    • "scope": "string",
    • "profile": {
      • "id": "string",
      • "displayName": "string",
      • "description": "string",
      • "logoPath": "string",
      • "avatarPath": "string",
      • "visibilityScope": "string",
      • "isActive": "string",
      • "scopeEntityType": "string",
      • "scopeEntityId": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    },
  • "meta": {
    • "requestId": "string"
    }
}

Assign a role to a user on the current scope entity

Assign a role to a user on the current scope entity.

Returns the updated user detail.

Authorizations:
http
path Parameters
id
required
string or null
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Request Body schema: application/json
required
role_key
required
string

Responses

Response Schema: application/json
required
object
required
object

Request samples

Content type
application/json
{
  • "role_key": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "firstName": "string",
    • "lastName": "string",
    • "email": "string",
    • "phone": "string",
    • "avatarUrl": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "membership": {
      • "id": "string",
      • "status": "string",
      • "invitedAt": { },
      • "acceptedAt": { },
      • "suspendedAt": { }
      },
    • "roles": [
      • {
        • "id": "string",
        • "key": "string",
        • "name": "string",
        • "assignedAt": { },
        • "assignedBy": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a role from a user on the current scope entity

Revoke a role from a user on the current scope entity.

Returns the updated user detail. If the role assignment does not exist, this returns a 404.

Authorizations:
http
path Parameters
id
required
string or null
roleKey
required
string
header Parameters
X-Scope
required
string

Operating scope for the request: the opaque scopeId string obtained from GET /scopes/v1. Send it exactly as returned — it is NOT an entity UUID and cannot be constructed by the client. Resolves the tenant/group/project the request operates within.

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "firstName": "string",
    • "lastName": "string",
    • "email": "string",
    • "phone": "string",
    • "avatarUrl": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "membership": {
      • "id": "string",
      • "status": "string",
      • "invitedAt": { },
      • "acceptedAt": { },
      • "suspendedAt": { }
      },
    • "roles": [
      • {
        • "id": "string",
        • "key": "string",
        • "name": "string",
        • "assignedAt": { },
        • "assignedBy": "string"
        }
      ]
    },
  • "meta": {
    • "requestId": "string"
    }
}

User Invitations

Invitations addressed to the current user.

List the authenticated user's pending invitations

Returns the authenticated user's pending invitations.

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
Array of objects (UserInvitationV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "parentEntityType": "string",
      • "parentEntityId": "string",
      • "childEntityType": "string",
      • "childEntityId": "string",
      • "relationshipType": "string",
      • "status": "string",
      • "invitationToken": "string",
      • "invitationTokenExpiresAt": "string",
      • "invitedAt": "string",
      • "acceptedAt": "string",
      • "rejectedAt": "string",
      • "suspendedAt": "string",
      • "invitedBy": "string",
      • "invitationMessage": "string",
      • "requestedRoleKey": "string",
      • "establishedBy": "string",
      • "establishedAt": "string",
      • "expiresAt": "string",
      • "metadata": "string",
      • "createdAt": "string",
      • "updatedAt": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Accept a pending membership invitation

Re-runnable: accepting an already-accepted invitation returns the current state without erroring.

Authorizations:
http
path Parameters
token
required
string

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "parentEntityType": "string",
    • "parentEntityId": "string",
    • "childEntityType": "string",
    • "childEntityId": "string",
    • "relationshipType": "string",
    • "status": "string",
    • "invitationToken": "string",
    • "invitationTokenExpiresAt": "string",
    • "invitedAt": "string",
    • "acceptedAt": "string",
    • "rejectedAt": "string",
    • "suspendedAt": "string",
    • "invitedBy": "string",
    • "invitationMessage": "string",
    • "requestedRoleKey": "string",
    • "establishedBy": "string",
    • "establishedAt": "string",
    • "expiresAt": "string",
    • "metadata": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Decline a pending membership invitation

Re-runnable: declining an already-declined invitation returns the current state without erroring.

Authorizations:
http
path Parameters
token
required
string

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "parentEntityType": "string",
    • "parentEntityId": "string",
    • "childEntityType": "string",
    • "childEntityId": "string",
    • "relationshipType": "string",
    • "status": "string",
    • "invitationToken": "string",
    • "invitationTokenExpiresAt": "string",
    • "invitedAt": "string",
    • "acceptedAt": "string",
    • "rejectedAt": "string",
    • "suspendedAt": "string",
    • "invitedBy": "string",
    • "invitationMessage": "string",
    • "requestedRoleKey": "string",
    • "establishedBy": "string",
    • "establishedAt": "string",
    • "expiresAt": "string",
    • "metadata": "string",
    • "createdAt": "string",
    • "updatedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Scopes

The scopes (tenant, group, project) a request can operate in.

List scopes

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
data
required
Array of any
required
object

Response samples

Content type
application/json
{
  • "data": [
    • null
    ],
  • "meta": {
    • "requestId": "string",
    • "requiresScope": "string",
    • "activeScope": {
      • "scopeId": "string",
      • "type": "string",
      • "id": "string",
      • "name": "string",
      • "avatarUrl": "string"
      }
    }
}

Role Assignments

Roles assigned to users on entities.

List role assignments for a user on an entity

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
integer
userId
required
integer

Responses

Response Schema: application/json
required
Array of objects (RoleAssignmentV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "userId": "string",
      • "entityType": "string",
      • "entityId": "string",
      • "roleKey": "string",
      • "roleType": "string",
      • "assignedBy": "string",
      • "assignedAt": "string",
      • "expiresAt": "string",
      • "isActive": true
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0
      }
    }
}

Assign a role to a user on an entity

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
integer
userId
required
integer
Request Body schema: application/json
required
role_type
required
string
Enum: "standard" "custom"
role_key
required
string
object

Responses

Response Schema: application/json
required
object (RoleAssignmentV1Resource)
required
object

Request samples

Content type
application/json
{
  • "role_type": "standard",
  • "role_key": "string",
  • "options": {
    • "expires_at": "2019-08-24T14:15:22Z",
    • "metadata": [
      • "string"
      ],
    • "tenant_id": 0
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "userId": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "roleKey": "string",
    • "roleType": "string",
    • "assignedBy": "string",
    • "assignedAt": "string",
    • "expiresAt": "string",
    • "isActive": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a role assignment from a user

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
integer
userId
required
integer
roleKey
required
string

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "revoked": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Permission Grants

Direct permission grants for users on entities.

List active direct permission grants for a user

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
integer
userId
required
integer

Responses

Response Schema: application/json
required
Array of objects (PermissionGrantV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "userId": "string",
      • "entityType": "string",
      • "entityId": "string",
      • "permission": "string",
      • "grantedBy": "string",
      • "grantedAt": "string",
      • "expiresAt": "string",
      • "isActive": true
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0
      }
    }
}

Grant a permission directly to a user

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
integer
userId
required
integer
Request Body schema: application/json
required
permission
required
string
object

Responses

Response Schema: application/json
required
object (PermissionGrantV1Resource)
required
object

Request samples

Content type
application/json
{
  • "permission": "string",
  • "options": {
    • "expires_at": "2019-08-24T14:15:22Z",
    • "metadata": [
      • "string"
      ],
    • "tenant_id": 0
    }
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "userId": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "permission": "string",
    • "grantedBy": "string",
    • "grantedAt": "string",
    • "expiresAt": "string",
    • "isActive": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Revoke a direct permission grant

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
integer
userId
required
integer
permissionKey
required
string

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "revoked": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Effective Permissions

Resolved, effective permissions for a user on an entity.

Get a user's effective permissions on an entity

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
integer
userId
required
integer
query Parameters
with_sources
boolean
check_inheritance
boolean

Responses

Response Schema: application/json
required
EffectivePermissionsV1Resource (object) or EffectivePermissionsV1Resource (object) (EffectivePermissionsV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "userId": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "permissions": "string",
    • "count": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Clear cached effective permissions for a user

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
integer
userId
required
integer

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "userId": 0,
    • "entityType": "string",
    • "entityId": 0,
    • "cleared": true
    },
  • "meta": {
    • "requestId": "string"
    }
}

Permission Checks

Checks for whether an actor may perform an action.

Check whether a user has a permission

Authorizations:
http
Request Body schema: application/json
required
user_id
required
integer >= 1
entity_type
required
string
Enum: "user" "tenant" "group" "project" "client" "case" "consent"
entity_id
required
integer >= 1
permission
required
string
check_inheritance
boolean

Responses

Response Schema: application/json
required
object (PermissionCheckV1Resource)
required
object

Request samples

Content type
application/json
{
  • "user_id": 1,
  • "entity_type": "user",
  • "entity_id": 1,
  • "permission": "string",
  • "check_inheritance": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "hasPermission": "string",
    • "userId": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "permission": "string",
    • "checkedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Check multiple permissions for a user

Authorizations:
http
Request Body schema: application/json
required
user_id
required
integer >= 1
entity_type
required
string
Enum: "user" "tenant" "group" "project" "client" "case" "consent"
entity_id
required
integer >= 1
check_inheritance
boolean
permissions
required
Array of strings non-empty

Responses

Response Schema: application/json
required
object (PermissionCheckBatchV1Resource)
required
object

Request samples

Content type
application/json
{
  • "user_id": 1,
  • "entity_type": "user",
  • "entity_id": 1,
  • "check_inheritance": true,
  • "permissions": [
    • "string"
    ]
}

Response samples

Content type
application/json
{
  • "data": {
    • "userId": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "permissions": "string",
    • "checkedAt": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Check whether a user has a role

Authorizations:
http
Request Body schema: application/json
required
user_id
required
integer >= 1
entity_type
required
string
Enum: "user" "tenant" "group" "project" "client" "case" "consent"
entity_id
required
integer >= 1
role_key
required
string

Responses

Response Schema: application/json
required
object (HasRoleV1Resource)
required
object

Request samples

Content type
application/json
{
  • "user_id": 1,
  • "entity_type": "user",
  • "entity_id": 1,
  • "role_key": "string"
}

Response samples

Content type
application/json
{
  • "data": {
    • "hasRole": "string",
    • "userId": "string",
    • "entityType": "string",
    • "entityId": "string",
    • "roleKey": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

My Permissions

The current user's own permissions.

Permissions me

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
object (MePermissionsV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "scope": "string",
    • "items": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

My Entity Permissions

The current user's resolved permissions on a specific entity.

Entity permissions me

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
object (MeEntityPermissionsV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "scope": "string",
    • "entityPermissions": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Permission Definitions

The catalog of defined permissions.

Definitions

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
data
required
Array of any (PermissionDefinitionsV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • null
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Roles

The catalog of available roles.

List available global roles

Authorizations:
http
query Parameters
entity_type
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
Array of objects (RoleCatalogV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "key": "string",
      • "id": "string",
      • "name": "string",
      • "description": "string",
      • "type": "string",
      • "capabilities": "string",
      • "hierarchyLevel": "string",
      • "isBarrier": "string",
      • "canCascade": "string"
      }
    ],
  • "meta": {
    • "requestId": "string",
    • "pagination": {
      • "total": 0
      }
    }
}

Entity Hierarchy

The hierarchy and relationships between entities.

Hierarchy entities

Authorizations:
http
path Parameters
entityType
required
string
entityId
required
integer
query Parameters
include_role_counts
boolean
Default: false

Responses

Response Schema: application/json
required
object (EntityHierarchyV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "root": "string",
    • "totalEntities": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Datasets

Datasets and their subset types.

List dataset subset types

Authorizations:
http
query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
Array of objects (DatasetSubsetTypeV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "type": "string",
      • "name": "string",
      • "description": "string",
      • "model": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

List accessible datasets

Returns datasets whose groups are in the user's accessible company IDs, with optional provider/entity filters. Accepts perPage (or the deprecated per_page, default 15).

Authorizations:
http
query Parameters
provider_id
string
entity_id
string
perPage
integer [ 1 .. 100 ]
per_page
integer [ 1 .. 100 ]
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
Array of objects (DatasetV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "datasetRelationId": "string",
      • "dataVersion": "string",
      • "providerId": "string",
      • "providerVersion": "string",
      • "createdAt": "string",
      • "updatedAt": "string",
      • "subsets": [
        • {
          • "id": "string",
          • "type": "string",
          • "subsetId": "string",
          • "subsetType": {
            • "id": "string",
            • "type": "string",
            • "name": "string",
            • "description": "string"
            }
          }
        ],
      • "groups": "string"
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Retrieve a single dataset

Returns a single accessible dataset with subsets and groups loaded.

Authorizations:
http
path Parameters
id
required
string

Responses

Response Schema: application/json
required
object (DatasetV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "datasetRelationId": "string",
    • "dataVersion": "string",
    • "providerId": "string",
    • "providerVersion": "string",
    • "createdAt": "string",
    • "updatedAt": "string",
    • "subsets": [
      • {
        • "id": "string",
        • "type": "string",
        • "subsetId": "string",
        • "subsetType": {
          • "id": "string",
          • "type": "string",
          • "name": "string",
          • "description": "string"
          }
        }
      ],
    • "groups": "string"
    },
  • "meta": {
    • "requestId": "string"
    }
}

Dataset Profiles

Profiles describing dataset contents.

List accessible dataset profiles

Returns active profiles filtered by entity/profession, merged with global profiles, de-duplicated by id.

Authorizations:
http
query Parameters
entity_id
string
entity_type
string
profession
string
sub_profession
string
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
required
Array of objects (DatasetProfileV1Resource)
required
object

Response samples

Content type
application/json
{
  • "data": [
    • {
      • "id": "string",
      • "name": "string",
      • "description": "string",
      • "scope": "string",
      • "profession": "string",
      • "subProfession": "string",
      • "subsetSelection": [
        • null
        ],
      • "providerPriorities": [
        • null
        ],
      • "isDefault": true,
      • "usageCount": 0
      }
    ],
  • "meta": {
    • "requestId": "string"
    }
}

Create a dataset profile

Authorizations:
http
Request Body schema: application/json
required
name
required
string <= 255 characters
description
string or null
scope
required
string
Enum: "global" "entity" "profession"
entity_id
string or null
entity_type
string or null
profession
string or null
sub_profession
string or null
subset_selection
required
Array of strings non-empty
provider_priorities
Array of strings or null
is_default
boolean

Responses

Response Schema: application/json
required
object (DatasetProfileV1Resource)
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "scope": "global",
  • "entity_id": "string",
  • "entity_type": "string",
  • "profession": "string",
  • "sub_profession": "string",
  • "subset_selection": [
    • "string"
    ],
  • "provider_priorities": [
    • "string"
    ],
  • "is_default": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "description": "string",
    • "scope": "string",
    • "profession": "string",
    • "subProfession": "string",
    • "subsetSelection": [
      • null
      ],
    • "providerPriorities": [
      • null
      ],
    • "isDefault": true,
    • "usageCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Update a dataset profile

Authorizations:
http
path Parameters
id
required
string
Request Body schema: application/json
name
string <= 255 characters
description
string or null
subset_selection
Array of strings non-empty
provider_priorities
Array of strings or null
is_active
boolean
is_default
boolean

Responses

Response Schema: application/json
required
object (DatasetProfileV1Resource)
required
object

Request samples

Content type
application/json
{
  • "name": "string",
  • "description": "string",
  • "subset_selection": [
    • "string"
    ],
  • "provider_priorities": [
    • "string"
    ],
  • "is_active": true,
  • "is_default": true
}

Response samples

Content type
application/json
{
  • "data": {
    • "id": "string",
    • "name": "string",
    • "description": "string",
    • "scope": "string",
    • "profession": "string",
    • "subProfession": "string",
    • "subsetSelection": [
      • null
      ],
    • "providerPriorities": [
      • null
      ],
    • "isDefault": true,
    • "usageCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Delete a dataset profile

Returns 204 No Content on success.

Authorizations:
http
path Parameters
id
required
string

Responses

Response samples

Content type
application/json
{
  • "data": null,
  • "meta": {
    • "requestId": "string"
    }
}

Increment a dataset profile's usage count

Safe to call repeatedly; this action does not require an Idempotency-Key header.

Authorizations:
http
path Parameters
id
required
string

Responses

Response Schema: application/json
required
object
required
object

Response samples

Content type
application/json
{
  • "data": {
    • "usageCount": 0
    },
  • "meta": {
    • "requestId": "string"
    }
}

Service Health

Lightweight per-service health and version checks.

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"

Health

query Parameters
perPage
integer

Items per page (default 25, max 100).

sort
string

Comma-separated sort terms, e.g. -createdAt,displayName. Prefix a term with - for descending order. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

filter[field]
string

Allowlisted field filter, e.g. filter[status]=active. Only per-endpoint allowlisted fields are honoured; others are silently ignored.

Responses

Response Schema: application/json
string

Response samples

Content type
application/json
"string"