List pending invitations
Returns every still-pending invitation for the active organization, newest first. Existence of the row IS the pending state; accepted invitations are deleted on first sign-in.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List pending invitations › Responses
OK
Invite a user to the organization
Sends a Keycloak-hosted invitation email to the supplied address and records the role names to apply on acceptance. Re-inviting the same address replaces the previous pending role intent. Empty role_names defaults to no_access.
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Invite a user to the organization › Responses
Created
Revoke a pending invitation
Cancels a pending invitation: deletes the kontorion row and best-effort removes the matching Keycloak org-invitation so the action token in the user's inbox stops working. Already-accepted invitations don't exist as rows - remove the user via the membership API instead.
path Parameters
idInvitation UUID
Invitation UUID
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Revoke a pending invitation › Responses
No Content
Get the current organization profile
Returns the organization profile resolved from the caller's auth context (name, slug, default locale, etc.).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Get the current organization profile › Responses
OK
Update the current organization profile
Updates editable fields on the caller's organization profile. The default_locale must be one of the supported invoicing languages (en, de, fr, es, it, pt, nl, ja).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Update the current organization profile › Request Body
billing_emailbusiness_addressdefault_countrydefault_currencydefault_date_formatdefault_first_day_of_weekdefault_languagedefault_localedefault_number_formatdefault_timezonelegal_namenamephonesales_audiencesupport_emailtax_inclusivetax_registration_numbervat_id_collectionUpdate the current organization profile › Responses
OK
Get the active org's security settings
Returns the per-org auth policy: require_mfa, allowed_idps, allowed_email_domains, session_timeout_seconds. Empty arrays mean "no restriction."
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Get the active org's security settings › Responses
OK
Update the active org's security settings
Partial update - fields omitted from the body are left unchanged. Empty arrays clear the restriction (no allowed_idps / allowed_email_domains). Setting require_mfa=true takes effect on the next request; existing sessions whose access token's amr claim lacks an MFA method receive 403 MFA_REQUIRED until they re-auth with MFA.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Update the active org's security settings › Request Body
allowed_email_domainsallowed_idpsjit_default_rolejit_enabledrequire_mfasession_timeout_secondsUpdate the active org's security settings › Responses
OK
Create a new organization
Provisions a new organization and mints its first API key. Mode determines the key prefix - "live" mints sk_live_, "sandbox" mints sk_test_. The plaintext key is returned once.
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Create a new organization › Request Body
billing_emaildefault_currencydefault_localenameslugCreate a new organization › Responses
Created