Adding someone always sends an invitation they have to accept. There is no endpoint that writes a membership directly, so a key can never put an account inside a workspace without its owner clicking a link in their own inbox.
Roles
A workspace must keep at least one admin. Removing the last one returns
409.
Invite a member
string
required
Who to invite. The invitation email comes from the workspace owner’s address.
string
default:"user"
optional
admin or user.id is the invitation’s id, which DELETE /v1/members/{id} takes to revoke it. Inviting someone who is already a member, or who already has a pending invitation, returns 409.
List members
GET /v1/members returns everyone in the workspace plus every invitation nobody has accepted yet.
array
One entry per member:
id (their user id), email, role, and created in epoch milliseconds.array
One entry per pending invitation, with the same fields.
id is the invitation’s id.curl
id field, so removing a member and revoking an invitation are the same call on whatever you just read.
A workspace created by POST /v1/signup starts with one pending invitation already there: the admin claim link for the address it signed up with. Revoke it like any other to close that door.
Remove a member or revoke an invitation
curl
404 not_found, and so does an id from another workspace.