Retrieves a paginated list of connected accounts for third-party integrations. Filter by organization, user, connector type, provider, or identifier. Returns OAuth tokens, API keys, and connection status for each account. Use pagination tokens to navigate through large result sets.

• organization_id: Filter by organization ID. Returns only connected accounts associated with this organization.
• user_id: Filter by user ID. Returns only connected accounts associated with this user.
• connector: Filter by connector type (e.g., 'notion', 'slack', 'google'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.
• identifier: Filter by account identifier. The unique identifier for the connected account within the third-party service (e.g., email address, workspace ID).
• provider: Filter by OAuth provider. The authentication provider name such as 'google', 'microsoft', 'github', etc.
• page_size: Maximum number of connected accounts to return per page. Must be between 0 and 100. Default is typically 10.
• page_token: Pagination token from a previous response. Use the next_page_token value from ListConnectedAccountsResponse to fetch the next page.
• query: Text search query to filter connected accounts by name, identifier, or other searchable fields. Case-insensitive.
• connection_names: Filter by one or more connection names (exact match). Returns connected accounts belonging to any of the specified connections. Max 20 names per request. Cannot be combined with the `connector` field.

Updates authentication credentials and configuration for an existing connected account. Modify OAuth tokens, refresh tokens, access scopes, or API configuration settings. Specify the account by ID, or by combination of organization/user, connector, and identifier. Returns the updated account with new token expiry and status information.

Creates a new connected account with OAuth tokens or API credentials for third-party service integration. Supply authorization details including access tokens, refresh tokens, scopes, and optional API configuration. The account can be scoped to an organization or user. Returns the created account with its unique identifier and authentication status.

Retrieves complete authentication details for a connected account including OAuth tokens, refresh tokens, scopes, and API configuration. Query by account ID or by combination of organization/user, connector, and identifier. Returns sensitive credential information - use appropriate access controls.

• organization_id: Organization ID for the connector
• user_id: User ID for the connector
• connector: Connector identifier (e.g., 'notion', 'slack', 'google'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.
• identifier: The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).
• id: Unique identifier for the connected account

Returns metadata for a connected account including status, connector type, provider, and configuration without exposing stored authorization credentials. Look up by account ID, or by a combination of organization (or user), connector, and external identifier.

• organization_id: Organization ID for the connector
• user_id: User ID for the connector
• connector: Connector identifier (e.g., 'notion', 'slack', 'google'). Alphanumeric characters, spaces, hyphens, underscores, and colons are allowed.
• identifier: The unique identifier for the connected account within the third-party service (e.g., email address, user ID, workspace identifier).
• id: Unique identifier for the connected account

Creates a time-limited magic link for connecting or re-authorizing a third-party account. The link directs users to the OAuth authorization flow for the specified connector. Returns the generated link URL and expiration timestamp. Links typically expire after a short duration for security.

Confirms the user assertion and activates the connected account after the user completes third-party OAuth. Called by the B2B app server with auth_request_id and identifier. Validates that the asserted identifier matches the one stored on the auth request and promotes pending tokens to live.

Permanently removes a connected account and revokes all associated authentication credentials. Identify the account by ID, or by combination of organization/user, connector, and identifier. This action cannot be undone. All OAuth tokens and API keys for this account will be invalidated.

Search for connected accounts in your environment using a text query that matches against identifiers, providers, or connectors. The search performs case-insensitive matching across account details. Returns paginated results with account status and authentication type information.

• query: Search term to match against connected account identifiers, providers, or connectors. Must be at least 3 characters. Case insensitive.
• page_size: Maximum number of connected accounts to return per page. Value must be between 1 and 30.
• page_token: Token from a previous response for pagination. Provide this to retrieve the next page of results.
• connection_id: Connection ID to filter connected accounts

Retrieves a list of connections in the environment

• organization_id: Filter connections by organization identifier
• domain: Filter connections by email domain associated with the organization
• include: Filter connections by status. Use 'all' to include all connections regardless of status. Default behavior shows only active (completed and enabled) connections

Retrieves the complete configuration and status details for a specific connection by its ID within an organization. Returns all connection properties including provider settings, protocols, and current status.

• organization_id: Organization identifier (required). Specifies which organization owns the connection you want to retrieve.
• id: Connection identifier (required). Specifies which specific connection to retrieve from the organization.

Deletes an SSO connection from the specified organization by connection ID. Use this endpoint when an identity provider integration is no longer needed for the organization. Returns an empty response after the SSO connection is deleted successfully.

• organization_id: Organization ID for the Connection.
• id: Connection ID. Unique ID for the connection

Deactivate an existing connection for the specified organization. When disabled, users cannot authenticate using this connection. This endpoint changes the connection state from enabled to disabled without modifying other configuration settings

• organization_id: Unique identifier of the organization associated with the connection
• id: Unique identifier for the connection to be toggled

Activate an existing connection for the specified organization. When enabled, users can authenticate using this connection. This endpoint changes the connection state from disabled to enabled without modifying other configuration settings

• organization_id: Unique identifier of the organization associated with the connection
• id: Unique identifier for the connection to be toggled

Creates an environment-scoped custom provider (connector) with authentication patterns and optional proxy configuration. The returned identifier must be used for all subsequent update and delete operations on this provider.

Updates an existing environment-scoped custom provider (connector) by its identifier. Only the fields provided in the request are modified.

• identifier: Identifier of the custom connected app provider to update.

Deletes an environment-scoped custom provider (connector) by its identifier. This operation is permanent and removes the provider definition from the environment.

• identifier:

Executes a tool action using authentication credentials from a connected account. Specify the tool by name and provide required parameters as JSON. The connected account can be identified by ID, or by combination of organization/user, connector, and identifier. Returns the execution result data and a unique execution ID for tracking. Use this endpoint to perform actions like sending emails, creating calendar events, or managing resources in external services.

Workspace catalog. Fetch tools by provider, identifier, and connector. Use this when you need every tool in the environment, not tools bound to one user. If `filter.summary` is true, returns only tool names.

• filter.summary: Return only tool names instead of full tool details
• filter.provider: Filter by tool provider
• filter.identifier: Filter by connected account identifier
• filter.tool_name: Filter by one or more tool names
• filter.query: Full-text search query to match tools by name or description (e.g., "gmail get attachment")
• filter.connector: Connector name (e.g., 'My Gmail'). When set together with filter.identifier, resolves to a specific connected account and includes its custom MCP tools in the response.
• filter.organization_id: Organization ID to scope the connected account lookup
• filter.user_id: User ID to scope the connected account lookup
• filter.connected_account_id: Connected account ID. Alternative to filter.identifier + filter.connector for directly identifying the connected account whose custom MCP tools should be included.
• page_size: Maximum number of tools to return per page
• page_token: Token from a previous response for pagination

Tools already bound to one connected-account identifier. Use this when you need the list a user or agent is authorized to call (the list you pass to an LLM). Filter by provider, tool name, or connection name. `identifier` is required.

• identifier: Identifier of the connected account to filter tools
• filter.providers: Filter by one or more tool providers
• filter.tool_names: Filter by one or more tool names
• filter.connection_names: Filter by one or more connection names
• page_size: Maximum number of tools to return per page
• page_token: Token from a previous response for pagination

Tools that can be made available for a connected-account identifier. Use this when you need the candidate set for an identifier, not the tools already scoped to it. `identifier` is required. Distinct from GET /api/v1/tools/scoped.

• identifier: Identifier of the connected account to list available tools for
• page_size: Maximum number of tools to return per page
• page_token: Token from a previous response for pagination

Resends an invitation email to a user who has a pending or expired invitation in the specified organization. If the invitation has expired, a new invitation will be automatically created and sent. If the invitation is still valid, a reminder email will be sent instead. Use this endpoint when a user hasn't responded to their initial invitation and you need to send them a reminder or when the original invitation has expired. The invitation email includes a secure magic link that allows the user to complete their account setup and join the organization. Each resend operation increments the resent counter.

• organization_id: Unique identifier of the organization containing the pending invitation. Must start with 'org_' and be 1-32 characters long.
• id: System-generated user ID of the user who has a pending invitation. Must start with 'usr_' and be 19-25 characters long.

Adds an existing user to an organization and assigns them specific roles and permissions. Use this endpoint when you want to grant an existing user access to a particular organization. You can specify roles, metadata, and other membership details during the invitation process.

• organization_id: Unique identifier of the target organization. Must start with 'org_' and be 1-32 characters long.
• id: System-generated user ID. Must start with 'usr_' (19-25 characters)
• send_invitation_email: If true, sends an activation email to the user. Defaults to true.

Removes a user from an organization by user ID. This action is irreversible and may also remove related group memberships.

• organization_id: Unique organization identifier. Must start with 'org_' and be 1-32 characters long
• id: System-generated user ID. Must start with 'usr_' (19-25 characters)

Updates a user's membership details within an organization by user ID. You can update roles and membership metadata.

• organization_id: Unique identifier of the organization containing the membership. Must start with 'org_' and be 1-32 characters long.
• id: System-generated user ID. Must start with 'usr_' and be 19-25 characters long.

Adds an existing user to an organization using your application's external identifier for the user. Use this endpoint when you store users in Scalekit using your own system's identifiers and need to manage their organization memberships without storing Scalekit's internal user ID.

• organization_id: Unique identifier of the target organization. Must start with 'org_' and be 1-32 characters long.
• external_id: External system identifier from connected directories. Must be unique across the system
• send_invitation_email: If true, sends an activation email to the user. Defaults to true.

Removes a user from an organization using your application's external identifier for the user. Use this endpoint to revoke organization access without needing to store Scalekit's internal user ID.

• organization_id: Unique organization identifier. Must start with 'org_' and be 1-32 characters long
• external_id: External system identifier from connected directories. Must match existing records

Updates a user's membership details within an organization using your application's external identifier for the user. Use this endpoint to update roles and membership metadata without needing to store Scalekit's internal user ID.

• organization_id: Unique identifier of the organization containing the membership. Must start with 'org_' and be 1-32 characters long.
• external_id: Your application's unique identifier for this user.

Retrieves a paginated list of all users who are members of the specified organization. Use this endpoint to view all users with access to a particular organization, including their roles, metadata, and membership details. Supports pagination for large user lists.

• organization_id: Unique identifier of the organization for which to list users. Must start with 'org_' and be 1-32 characters long.
• page_size: Maximum number of users to return in a single response. Valid range: 1-100. Server may return fewer users than specified.
• page_token: Pagination token from a previous ListUserResponse. Used to retrieve the next page of results. Leave empty for the first request.

Creates a new user account and immediately adds them to the specified organization. Use this endpoint when you want to create a user and grant them access to an organization in a single operation. You can provide user profile information, assign roles, and configure membership metadata. The user receives an activation email unless this feature is disabled in the organization settings.

• organization_id:
• send_invitation_email: If true, sends an activation email to the user. Defaults to true.

Retrieves all permissions a user has access to within a specific organization. This includes permissions from direct role assignments and inherited permissions from role hierarchy.

• organization_id: Unique identifier for the organization
• user_id: Unique identifier for the user

Retrieves all roles assigned to a user within a specific organization. This includes both direct role assignments and inherited roles from role hierarchy.

• organization_id: Unique identifier for the organization
• user_id: Unique identifier for the user

Searches for users within a specific organization by email address, user ID, or external ID. The query must be at least 3 characters and is case-insensitive. Scopes results strictly to the given organization. Returns a paginated list of matching users with up to 30 results per page. Use the next_page_token from the response to retrieve subsequent pages.

• organization_id: Unique identifier of the organization to search within. Must start with 'org_' and be 1-32 characters long.
• query: Search term to match against user email, IDs, or external IDs. Must be at least 3 characters. Case insensitive.
• page_size: Maximum number of users to return per page. Value must be between 1 and 30.
• page_token: Token from a previous response for pagination. Provide this to retrieve the next page of results.

Retrieves a paginated list of all users across your entire environment. Use this endpoint to view all users regardless of their organization memberships. This is useful for administrative purposes, user audits, or when you need to see all users in your Scalekit environment. Supports pagination for large user bases.

• page_size: Maximum number of organizations to return per page. Must be between 10 and 100
• page_token: Pagination token from the previous response. Use to retrieve the next page of organizations

Retrieves all details for a user by system-generated user ID. The response includes organization memberships and user metadata.

• id: System-generated user ID

Permanently removes a user from your environment and deletes all associated data. Use this endpoint when you need to completely remove a user account. This action deletes the user's profile, memberships, and all related data across all organizations. This operation cannot be undone, so use with caution.

• id: System-generated user ID. Must start with 'usr_' (19-25 characters)

Modifies user account information including profile details, metadata, and external ID. Use this endpoint to update a user's personal information, contact details, or custom metadata. You can update the user's profile, phone number, and metadata fields. Note that fields like user ID, email address, environment ID, and creation time cannot be modified.

• id: System-generated user ID. Must start with 'usr_' and be 19-25 characters long.

Retrieves all details for a user by your application's external identifier. Use this endpoint when you store users in Scalekit using your own system's identifiers and need to retrieve the Scalekit user record. The response includes organization memberships and user metadata.

• external_id: Your application's unique identifier for this user, used to link Scalekit with your system.

Permanently removes a user identified by your application's external identifier. This action deletes the user's profile, memberships, and all related data across all organizations. This operation cannot be undone.

• external_id: External system identifier from connected directories. Must match existing records

Modifies user account information for a user identified by your application's external identifier. Use this endpoint to keep user profile data in sync from your system without needing to store Scalekit's internal user ID. You can update the user's profile, phone number, and metadata fields.

• external_id: Your application's unique identifier for this user, used to link Scalekit with your system.

Searches for users across the entire environment by email address, user ID, or external ID. The query must be at least 3 characters and is case-insensitive. Returns a paginated list of matching users with up to 30 results per page. Use the next_page_token from the response to retrieve subsequent pages.

• query: Search term to match against user email, IDs, or external IDs. Must be at least 3 characters. Case insensitive.
• page_size: Maximum number of users to return per page. Value must be between 1 and 30.
• page_token: Token from a previous response for pagination. Provide this to retrieve the next page of results.

Returns a paginated list of authentication request logs for the current environment, ordered most-recent first. Use this endpoint to audit login activity, investigate failed authentications. Filter by email, status (INITIATED, PENDING, SUCCESS, FAILED), time window, resource ID, or client ID. Status filters are case-insensitive. The response includes cursor tokens for forward and backward pagination and the total matching count. Pass next_page_token or prev_page_token as page_token on the next call to page through results.

• page_size: Maximum number of authentication requests to return in a single page. If omitted, the server applies a default page size.
• page_token: Opaque cursor from a previous response's next_page_token or prev_page_token. Omit on the first request.
• email: Filter authentication requests by the end-user email associated with the login attempt.
• status: Filter by authentication request status. Accepted values: INITIATED, PENDING, SUCCESS, FAILED. Matching is case-insensitive.
• start_time: Inclusive lower bound for the authentication request timestamp (UTC). Only events at or after this time are returned.
• end_time: Inclusive upper bound for the authentication request timestamp (UTC). Only events at or before this time are returned.
• resource_id: Filter authentication requests by resource identifier (for example an MCP resource ID).
• client_id: Filter authentication logs by client ID

Lists MCP configurations for the current environment with optional filters for id, name prefix, and provider.

• filter.id: Filter by MCP configuration id
• filter.name: Case-insensitive exact match on configuration name. Allowed characters: letters (a–z, A–Z), digits (0–9), hyphens (-), and underscores (_). Maximum 100 characters.
• filter.provider: Filter configs that include this provider
• filter.mcp_server_url: Filter configs by MCP server URL. The UUID is extracted from the last path segment of the URL and used to find the matching configuration.
• search: Look ahead text search on config name
• page_size: Number of configs to return per page (max 30)
• page_token: Pagination token to fetch the next or previous page

Creates a new MCP configuration with a set of connections and tools.

Returns a single MCP configuration for the current environment by ID.

• config_id: ID of the MCP configuration to fetch

Updates the description and connection-to-tool mappings for an existing MCP configuration. The configuration name cannot be changed after creation.

• config_id: ID of the MCP configuration to update

Deletes the MCP configuration and any associated mappings and instances in the current environment.

• config_id: ID of the MCP configuration to delete

Returns the connected account state for each connection in the MCP configuration for the given user identifier. When include_auth_link is true, creates connected accounts on the fly if they do not exist and returns a fresh authentication link per connection. When include_auth_link is false or omitted, returns the current status of existing connected accounts only — no accounts are created and authentication_link is always empty. Authentication links are only present when the connection has an associated key; if the connection has no key, authentication_link is empty regardless of include_auth_link.

• config_id: ID of the MCP configuration

Mints a short-lived JWT that represents a user identifier across the connected accounts associated with an MCP configuration. The supplied identifier becomes the token's `sub` claim; the token's `aud` claim is the MCP server URL bound to the configuration. Claims also carry the MCP configuration ID (`mcp_cfg`) and the list of resolved connected-account IDs (`ca_ids`). Use this operation to issue a single credential an MCP server can present on the user's behalf when calling provider tools. The mint fails if any connection mapped to the configuration has no active connected account for the identifier.

• mcp_config_id: Unique ID of the MCP configuration whose connections back the token. The configuration must exist in the caller's environment.

Retrieve a paginated list of organizations within your environment. The response includes a `page_token` that can be used to access subsequent pages of results.

• page_size: Maximum number of organizations to return per page. Must be between 10 and 100
• page_token: Pagination token from the previous response. Use to retrieve the next page of organizations
• external_id: Your application's unique identifier for this organization, used to link Scalekit with your system

Creates a new organization in your environment. Use this endpoint to add a new tenant that can be configured with various settings and metadata

Retrieves organization details by Scalekit ID, including name, region, metadata, and settings

• id: Unique Scalekit-generated identifier for an organization. Use this with the GetOrganization endpoint. Do not pass this parameter when calling GetOrganizationByExternalId — use external_id instead.

Remove an existing organization from the environment using its unique identifier

• id: Unique scalekit-generated identifier that uniquely references an organization

Updates an organization's display name, external ID, or metadata. Requires a valid organization identifier. Region code cannot be modified through this endpoint.

• id: Unique identifier of the organization to be updated

Creates a single use Admin Portal URL valid for 1 minute. Once the generated admin portal URL is accessed or rendered, a temporary session of 6 hours is created to allow the admin to update SSO/SCIM configuration.

• id: Organization ID
• features: Features to enable in the admin portal link. To enable features, append them as URL parameters: - Single Sign-On: ?features=sso - Directory Sync: ?features=dir_sync - Both features: ?features=sso&features=dir_sync Example URL: https://scalekit.com/portal/lnk_123?features=sso - dir_sync: Enables directory synchronization configuration in the portal - sso: Enables Single Sign-On (SSO) configuration in the portal

Updates configuration settings for an organization. Supports modifying SSO configuration, directory synchronization settings, and session parameters. Requires organization ID and the specific settings to update.

• id: Unique identifier of the organization to update settings. Must begin with 'org_' prefix

Retrieves the session policy for an organization. Returns session_policy='APPLICATION' if the organization inherits the application-level defaults, or session_policy='CUSTOM' with the configured values if a custom policy is active.

• organization_id: The unique identifier of the organization whose session policy is being requested.

Sets a custom session policy for an organization or reverts to application-level settings. Send session_policy='APPLICATION' to revert to application defaults. Send session_policy='CUSTOM' with timeout values to activate a custom policy.

• organization_id: The unique identifier of the organization whose session policy is being updated.

Upsert user management settings for an organization

• organization_id: ID of the organization.

Retrieves organization details by external ID, including name, region, metadata, and settings. Only provide external_id in the path. If the id query parameter is also supplied, it silently takes precedence over external_id due to protobuf oneof semantics, which causes the request to fail with a 400 Bad Request ('ExternalId is required').

• external_id: Unique identifier that links an organization to your app's tenant. Use this with the GetOrganizationByExternalId endpoint. Only one of id or external_id should be provided per request.
• id: Unique Scalekit-generated identifier for an organization. Use this with the GetOrganization endpoint. Do not pass this parameter when calling GetOrganizationByExternalId — use external_id instead.

Retrieves all environment roles and organization specific roles. Use this endpoint to view all role definitions, including custom roles and their configurations. You can optionally include permission details for each role to understand their capabilities. This is useful for role management, auditing organization access controls, or understanding the available access levels within the organization.

• org_id: Unique identifier of the organization
• include: Include additional data in the response. Valid values: 'permissions' (direct permissions only), 'permissions:all' (includes inherited permissions)

Creates a new role within the specified organization with basic configuration including name, display name, description, and permissions. Use this endpoint to define custom roles that can be assigned to users within the organization. You can create hierarchical roles by extending existing roles and assign specific permissions to control access levels. The role will be scoped to the organization and can be used for organization-specific access control.

• org_id: Unique identifier of the organization

Retrieves complete information for a specific organization role including metadata, inheritance details, and optionally permissions. Use this endpoint to audit role configuration and understand the role's place in the organization's role hierarchy. You can include permission details to see what capabilities the role provides. This operation is useful for role management, user assignment decisions, or understanding organization access controls.

• org_id: Unique identifier of the organization
• role_name: Unique name of the role
• include: Include additional data in the response. Valid values: 'permissions' (direct permissions only), 'permissions:all' (includes inherited permissions)

Modifies an existing organization role's properties including display name, description, permissions, and inheritance settings. Use this endpoint to update role metadata, change permission assignments, or modify role hierarchy within the organization. Only the fields you specify will be updated, leaving other properties unchanged. When updating permissions, the new list replaces all existing permissions for the role.

• org_id: Unique identifier of the organization
• role_name: Unique name of the role

Permanently removes a role from the organization and optionally reassigns users who had that role to a different role. Use this endpoint when you need to clean up unused roles or restructure your organization's access control system. If users are assigned to the role being deleted, you can provide a reassign_role_name to move those users to a different role before deletion. This action cannot be undone, so ensure no critical users depend on the role before deletion.

• org_id: Unique identifier of the organization
• role_name: Unique name of the role
• reassign_role_name: Role name to reassign users to when deleting this role

Updates the default member role for the specified organization. Use this endpoint to configure which role is automatically assigned to new users when they join the organization. The system will validate that the specified role exists and update the organization settings accordingly. This configuration affects all new user invitations and memberships within the organization.

• org_id: Unique identifier of the organization

Retrieves a comprehensive list of all roles available within the specified environment including organization roles. Use this endpoint to view all role definitions, including custom roles and their configurations. You can optionally include permission details for each role to understand their capabilities. This is useful for role management, auditing organization access controls, or understanding the available access levels within the organization.

• include: Include additional data in the response. Valid values: 'permissions' (direct permissions only), 'permissions:all' (includes inherited permissions from role hierarchy)

Creates a new role within the environment with specified permissions and metadata. Use this endpoint to define custom roles that can be assigned to users or groups. You can create hierarchical roles by extending existing roles, assign specific permissions, and configure display information. Roles are the foundation of your access control system and determine what actions users can perform.

Updates the default creator and member roles for the current environment. Use this endpoint to configure which roles are automatically assigned to new users when they join the environment. You can specify role names for both creator and member default roles. The system will validate that the specified roles exist and update the environment settings accordingly. Returns the updated default role objects including their complete role information and permissions.

Retrieves complete information for a specific role including metadata and inheritance details (base role and dependent role count). Use this endpoint to audit role configuration and understand the role's place in the hierarchy. To view the role's permissions, use the ListRolePermissions endpoint.

• role_name: Unique name identifier of the role to retrieve. Must be alphanumeric with underscores, 1-64 characters.
• include: Include additional data in the response. Valid values: 'permissions' (direct permissions only), 'permissions:all' (includes inherited permissions from role hierarchy)

Modifies an existing role's properties including display name, description, permissions, and inheritance. Use this endpoint to update role metadata, change permission assignments, or modify role hierarchy. Only the fields you specify will be updated, leaving other properties unchanged. When updating permissions, the new list replaces all existing permissions for the role.

• role_name: Unique name identifier of the role to update. Must be alphanumeric with underscores, 1-64 characters.

Permanently removes a role from the environment and reassigns users who had that role to a different role. Use this endpoint when you need to clean up unused roles or restructure your access control system. The role cannot be deleted if it has dependent roles (roles that extend it) unless you specify a replacement role. If users are assigned to the role being deleted, you must provide a reassign_role_name to move those users to a different role before deletion can proceed. This action cannot be undone, so ensure no critical users depend on the role before deletion.

• role_name: Unique name identifier of the role to delete. Must be alphanumeric with underscores, 1-64 characters.
• reassign_role_id: Role name to reassign users to when deleting this role
• reassign_role_name: Role name to reassign users to when deleting this role

Retrieves all roles that directly extend the specified base role through inheritance. Use this endpoint to understand the role hierarchy and identify which roles inherit permissions from a particular base role. Provide the base role name as a path parameter, and the response will include all dependent roles with their metadata and permission information. This operation is useful for auditing role inheritance relationships, understanding the impact of changes to base roles, or managing role hierarchies effectively. Returns a list of dependent role objects including their names, display names, descriptions, and permission details.

• role_name: Name of the base role

Retrieves all permissions directly assigned to the specified role, excluding permissions inherited from base roles. Use this endpoint to view the explicit permission assignments for a role, which is useful for understanding direct role capabilities, auditing permission assignments, or managing role-permission relationships. Provide the role name as a path parameter, and the response will include only the permissions that are directly assigned to that role. This operation does not include inherited permissions from role hierarchies - use ListEffectiveRolePermissions to see the complete set of permissions including inheritance. Returns a list of permission objects with their names, descriptions, and assignment metadata.

• role_name: Name of the role

Adds one or more permissions to the specified role while preserving existing permission assignments. Use this endpoint to grant additional capabilities to a role without affecting its current permission set. Provide the role name as a path parameter and a list of permission names in the request body. The system will validate that all specified permissions exist in the environment and add them to the role. Existing permission assignments remain unchanged, making this operation safe for incremental permission management. This is useful for gradually expanding role capabilities or adding new permissions as your system evolves. Returns the updated list of all permissions now assigned to the role.

• role_name: Name of the role

Removes a specific permission from the specified role, revoking that capability from all users assigned to the role. Use this endpoint to restrict role capabilities or remove unnecessary permissions. Provide both the role name and permission name as path parameters. This operation only affects the direct permission assignment and does not impact permissions inherited from base roles. If the permission is inherited through role hierarchy, you may need to modify the base role instead. This is useful for fine-tuning role permissions, implementing least-privilege access controls, or removing deprecated permissions. Returns no content on successful removal.

• role_name: Name of the role
• permission_name: Name of the permission to remove

Retrieves the complete set of effective permissions for a role, including both directly assigned permissions and permissions inherited from base roles through the role hierarchy. Use this endpoint to understand the full scope of capabilities available to users assigned to a specific role. Provide the role name as a path parameter, and the response will include all permissions that apply to the role, accounting for inheritance relationships. This operation is essential for auditing role capabilities, understanding permission inheritance, or verifying the complete access scope before role assignment. Returns a comprehensive list of permission names representing the full set of effective permissions for the specified role.

• role_name: Name of the role

Retrieves the total number of users currently assigned to the specified role within the environment. Use this endpoint to monitor role usage, enforce user limits, or understand the scope of role assignments. Provide the role's unique name as a path parameter, and the response will include the current user count for that role. This operation is read-only and does not modify any data or user assignments. The count reflects all users who have the role either directly assigned or inherited through organization membership. This information is useful for capacity planning, security auditing, or understanding the impact of role changes across your user base.

• role_name: Unique name of the role

Updates the default creator and member roles for the current environment. Use this endpoint to configure which roles are automatically assigned to new users when they join the environment. You can specify role names for both creator and member default roles. The system will validate that the specified roles exist and update the environment settings accordingly. Returns the updated default role objects including their complete role information and permissions.

Retrieves a paginated list of API clients for a specific organization. Returns client details including metadata, scopes, and secret information (without exposing actual secret values).

• organization_id: Unique identifier of the organization whose clients to list. Must start with 'org_' prefix.
• page_size: Maximum number of clients to return per page Maximum number of API clients to return per page. Must be between 10 and 100
• page_token: Pagination token from the previous response Pagination token from the previous response. Use to retrieve the next page of organization clients

Creates a new API client for an organization. Returns the client details and a plain secret (available only once).

• organization_id: Unique identifier of the organization

Retrieves details of a specific API client in an organization.

• organization_id: Unique identifier of the organization
• client_id: Unique identifier of the API client

Permanently deletes an API client from an organization. This operation cannot be undone and will revoke all access for the client. All associated secrets will also be invalidated. Use this endpoint to remove unused or compromised clients.

• organization_id: Unique identifier of the organization that owns the client. Must start with 'org_' prefix.
• client_id: Unique identifier of the API client to permanently delete. Must start with 'm2morg_' prefix.

Updates an existing organization API client. Only specified fields are modified.

• organization_id: Unique identifier of the organization
• client_id: Unique identifier of the client

Creates a new secret for an organization API client. Returns the plain secret (available only once).

• organization_id: Unique identifier of the organization
• client_id: Unique identifier of the API client

Permanently deletes a secret from an organization API client. This operation cannot be undone.

• organization_id: Unique identifier of the organization
• client_id: Unique identifier of the API client
• secret_id: Unique identifier of the client secret

List organization directories

• organization_id: Unique identifier of the organization

Retrieves all groups from a specified directory. Use this endpoint to view group structures from your connected identity provider.

• organization_id: Unique identifier of the organization
• directory_id: Unique identifier of the directory
• page_size: Number of groups to return per page. Maximum value is 30. If not specified, defaults to 10
• page_token: Token for pagination. Use the value returned in the 'next_page_token' field of the previous response
• updated_after: Filter groups updated after this timestamp. Use ISO 8601 format
• include_detail: If true, includes full group details. If false or not specified, returns basic information only
• include_external_groups: If true, returns group and its details from external provider (default: false)

Retrieves a list of all users within a specified directory for an organization. This endpoint allows you to view user accounts associated with your connected Directory Providers.

• organization_id: Unique identifier of the organization
• directory_id: Unique identifier of the directory within the organization
• page_size: Number of users to return per page. Maximum value is 30. If not specified, defaults to 10
• page_token: Token for pagination. Use the value returned in the 'next_page_token' field of the previous response to retrieve the next page of results
• include_detail: If set to true, the response will include the full user payload with all available details. If false or not specified, only essential user information will be returned
• directory_group_id: Filter users by their membership in a specific directory group
• updated_after: Filter users that were updated after the specified timestamp. Use ISO 8601 format

Retrieves detailed information about a specific directory within an organization

• organization_id: Unique identifier of the organization
• id: Unique identifier of the directory

Stops synchronization of users and groups from a specified directory within an organization. This operation prevents further updates from the connected Directory provider

• organization_id: A unique identifier for the organization. The value must begin with 'org_' and be between 1 and 32 characters long
• id: A unique identifier for a directory within the organization. The value must begin with 'dir_' and be between 1 and 32 characters long

Activates a directory within an organization, allowing it to synchronize users and groups with the connected Directory provider

• organization_id: A unique identifier for the organization. The value must begin with 'org_' and be between 1 and 32 characters long
• id: A unique identifier for a directory within the organization. The value must begin with 'dir_' and be between 1 and 32 characters long

Retrieves a paginated list of all domains configured for the specified organization. Domain types: - ALLOWED_EMAIL_DOMAIN: Trusted domains used to suggest the organization in the organization switcher during sign-in/sign-up (auth-method agnostic). - ORGANIZATION_DOMAIN: SSO discovery domains used to route users to the correct SSO provider and enforce SSO.

• organization_id: Scalekit-generated unique identifier for the organization. Use either this or external_id to identify the organization.
• include: Optional comma-separated list of additional fields to include in the response (e.g., 'verification_details').
• page_size: Maximum number of domains to return per page. Default is 30, maximum is 100.
• page_number: Page number to retrieve (0-based). Use 0 for the first page.
• domain_type: The domain type. - ALLOWED_EMAIL_DOMAIN: trusted domain used to suggest the organization in the organization switcher during sign-in/sign-up. - ORGANIZATION_DOMAIN: SSO discovery domain used to route users to the correct SSO provider and enforce SSO.

Creates and associates a domain with an organization. Use one of the following domain types: - ALLOWED_EMAIL_DOMAIN: Adds a trusted email domain for organization suggestions in the organization switcher during sign-in/sign-up (auth-method agnostic). - ORGANIZATION_DOMAIN: Enables SSO domain discovery. If a user signs in with a matching email domain, Scalekit redirects them to the organization’s SSO provider and enforces SSO. The domain must be a valid business domain that you control. Public/disposable domains (e.g., gmail.com) are blocked for security.

• organization_id: Scalekit-generated unique identifier for the organization. Use either this or external_id to identify the organization.

Retrieves complete details for a domain including domain type, timestamps, and configuration information.

• organization_id: Scalekit-generated unique identifier for the organization. Use either this or external_id to identify the organization.
• id: Scalekit-generated unique identifier of the domain to retrieve.

Permanently removes a domain record from an organization. - Deleting an ORGANIZATION_DOMAIN disables SSO routing/enforcement for that domain. - Deleting an ALLOWED_EMAIL_DOMAIN stops organization suggestions for users with that email domain.

• organization_id: Scalekit-generated unique identifier for the organization. Use either this or external_id to identify the organization.
• id: Scalekit-generated unique identifier of the domain to be permanently deleted.

Resend a verification email if the user didn't receive it or if the previous code/link has expired

Send a verification email containing either a verification code (OTP), magic link, or both to a user's email address

Verify a user's identity using either a verification code or magic link token

Retrieves a comprehensive, paginated list of all permissions available within the environment. Use this endpoint to view all permission definitions for auditing, role management, or understanding the complete set of available access controls. The response includes pagination tokens to navigate through large sets of permissions efficiently. Each permission object contains the permission name, description, creation time, and last update time. This operation is useful for building permission selection interfaces, auditing permission usage, or understanding the scope of available access controls in your RBAC system.

• page_token: Page token to retrieve next page of results
• page_size: Number of permissions to return per page (max 100)
• type: Filter permissions by type: ALL, SCALEKIT, or ENVIRONMENT, where SCALEKIT are predefined Scalekit permissions and ENVIRONMENT are custom permissions created in the environment, default is ALL

Creates a new permission that represents a specific action users can perform within the environment. Use this endpoint to define granular access controls for your RBAC system. You can provide a unique permission name following the format 'action:resource' (for example, 'read:documents', 'write:users') and an optional description explaining the permission's purpose. The permission name must be unique across the environment and follows alphanumeric naming conventions with colons and underscores. Returns the created permission object including system-generated ID and timestamps.

Retrieves complete information for a specific permission by its unique name identifier. Use this endpoint to view permission details including description, creation time, and last update time. Provide the permission name in the path parameter following the format 'action:resource' (for example, 'read:documents'). This operation is useful for auditing permission definitions, understanding permission purposes, or verifying permission existence before assignment. Returns the complete permission object with all metadata and system-generated timestamps.

• permission_name: Name of the permission

Modifies an existing permission's attributes including description and metadata. Use this endpoint to update permission descriptions or clarify permission purposes after creation. The permission is identified by its unique name in the path parameter, and only the fields you specify in the request body will be updated. Note that the permission name itself cannot be changed as it serves as the immutable identifier. This operation is useful for maintaining clear documentation of permission purposes or updating descriptions to reflect changes in system functionality. Returns the updated permission object with modified timestamps.

• permission_name: Name of the permission

Permanently removes a permission from the environment using its unique name identifier. Use this endpoint when you need to clean up unused permissions or remove access controls that are no longer relevant. The permission is identified by its name in the path parameter following the format 'action:resource'. This operation cannot be undone, so ensure no active roles depend on the permission before deletion. If the permission is currently assigned to any roles, you may need to remove those assignments first or update the roles to use alternative permissions. Returns no content on successful deletion.

• permission_name: Name of the permission

Retrieves comprehensive details for a specific user session including authentication status, device information, and expiration timelines. Use this endpoint to fetch current session metadata for security audits, session validation, or to display session information in user account management interfaces. Returns all session properties including the user ID, authenticated organizations, device details with browser/OS information, IP address and geolocation, and all relevant timestamps (creation, last activity, idle expiration, absolute expiration, and actual expiration if applicable).

• session_id: Unique identifier for the session. Must start with 'ses_' prefix.

Immediately invalidates a specific user session by session ID, setting its status to 'revoked'. Once revoked, the session cannot be used for any future API requests or application access. Use this endpoint to implement session-level logout, force a user to reauthenticate on a specific device, or terminate suspicious sessions. The revocation is instantaneous and irreversible. Returns the revoked session details including the session ID, user ID, and the revocation timestamp.

• session_id: Unique identifier for the session to revoke. Must start with 'ses_' prefix.

Retrieves a paginated list of all sessions associated with a specific user across all devices and browsers. Use this endpoint to audit user activity, display all active sessions in account management interfaces, or verify user authentication status across devices. Supports filtering by session status (active, expired, revoked, logout) and time range (creation date). Returns session details for each session including device information, IP address, geolocation, and current status. The response includes pagination metadata (page tokens and total count) to handle large session lists efficiently.

• user_id: Unique identifier for the user whose sessions to retrieve. Must start with 'usr_' prefix.
• page_size: Maximum number of sessions to return in a single page. Optional parameter. If not specified, defaults to a server-defined limit. Use smaller values for faster responses, larger values for fewer requests.
• page_token: Pagination token from the previous response for retrieving the next page of results. Leave empty for the first page. Use the next_page_token from a previous response to fetch subsequent pages.
• filter.status: Filter sessions by one or more status values. Possible values: 'active', 'expired', 'revoked', 'logout'. Leave empty to include all statuses. Multiple values use OR logic (e.g., status=['active', 'expired'] returns sessions that are either active OR expired).
• filter.start_time: Filter to include only sessions created on or after this timestamp. Optional. Uses RFC 3339 format. Useful for querying sessions within a specific time window.
• filter.end_time: Filter to include only sessions created on or before this timestamp. Optional. Uses RFC 3339 format. Must be after start_time if both are specified.

Immediately invalidates all active sessions for a specific user across all devices and browsers, setting their status to 'revoked'. Use this endpoint to implement global logout functionality, force re-authentication after security incidents, or terminate all sessions following a password reset or credential compromise. Only active sessions are revoked; already expired, logout, or previously revoked sessions remain unchanged. The revocation is atomic and instantaneous. Returns a list of all revoked sessions with their details and a total count of sessions revoked.

• user_id: Unique identifier for the user whose all sessions will be revoked. Must start with 'usr_' prefix.

Retrieves all registered passkeys for the current user, including device information, creation timestamps, and display names. Use this to show users their registered authenticators.

• user_id: User ID to list credentials for (optional, current user if not provided)

Deletes a specific passkey credential for the current user. After removal, the authenticator can no longer be used for authentication.

• credential_id: The credential ID to delete

Updates the display name of a passkey credential to help users identify their authenticators. Only the display name can be modified.

• credential_id: The credential ID to update