API reference

API reference: Organization & users

Cloud Control organization API: list, add, update and remove members of your org (the Team page), and transfer organization ownership to an MFA-enrolled member.

Manage the members of your organization. Reads are open to any member; mutations require manage_users_sso. The owner is protected, and cross-org ids return 404.

GET/api/org/usersSession or Bearer

List every member of your organization.

Example response

json

{ "users": [ { "id": 1, "name": "Ada Lovelace", "email": "ada.lovelace@example.com",
  "role": "Org Admin", "mfaEnabled": true, "isOwner": true,
  "isPlatformAdmin": false, "createdAt": "2026-01-04T09:12:00.000Z" } ] }

Errors

Status	When
`401`	Not signed in.

POST/api/org/usersmanage_users_sso

Add a member with an initial password and a role.

Parameters

Name	In	Required	Description
`name`	body	yes	Member name.
`email`	body	yes	Member email (globally unique).
`password`	body	yes	Initial password, at least 8 characters.
`role`	body	yes	One of Viewer, Deployer, SRE · Cloud Admin, Org Admin.

Example request

json

{ "name": "Sam Lee", "email": "sam@acme.io", "password": "temp-pass-123", "role": "Deployer" }

Example response

json

{ "ok": true, "user": { "id": 7, "name": "Sam Lee", "role": "Deployer", "…": "…" } }

Errors

Status	When
`400`	Missing name, malformed email, short password, or unknown role.
`401`	Not signed in.
`403`	Caller lacks manage_users_sso.
`409`	Email already exists.

PATCH/api/org/users/{id}manage_users_sso

Change a member's role.

Parameters

Name	In	Required	Description
`id`	path	yes	Member id (must be in your org).
`role`	body	yes	New role from the assignable set.

Example request

json

{ "role": "SRE · Cloud Admin" }

Example response

json

{ "ok": true, "user": { "id": 7, "role": "SRE · Cloud Admin" } }

Errors

Status	When
`400`	Unknown role, or the target is the owner (protected).
`403`	Caller lacks manage_users_sso.
`404`	No such member in your org (also for cross-org ids).

DELETE/api/org/users/{id}manage_users_sso

Remove a member; cascades their sessions, MFA, reset tokens and API tokens.

Parameters

Name	In	Required	Description
`id`	path	yes	Member id (must be in your org).

Example response

json

{ "ok": true }

Errors

Status	When
`400`	The target is the owner (protected).
`403`	Caller lacks manage_users_sso.
`404`	No such member in your org.

POST/api/org/transfer-ownershipOwner (session only)

Transfer ownership to an MFA-enrolled member of the same org.

Parameters

Name	In	Required	Description
`toUserId`	body	yes	Id of the new owner.

Example request

json

{ "toUserId": 7 }

Example response

json

{ "ok": true, "users": [ { "id": 7, "isOwner": true, "…": "…" } ] }

Errors

Status	When
`400`	Bad id, target already owner, or target has no MFA.
`403`	Caller is not the owner.
`404`	Target is not in your org.