Identity API

23 operations. Paths are relative to the API host (http://localhost:5080 in local development). Every operation accepts an OIDC bearer token (Authorization: Bearer …) or a workspace API key (X-Api-Key: keel_live_…); errors are RFC 9457 Problem Details with a code (error codes). Permissions: matrix.

Method	Path	Summary
POST	/api/v1/invitations/{token}:accept	Accept an invitation as the signed-in user.
GET	/api/v1/me	The signed-in user, their tenants and usable workspaces.
PUT	/api/v1/tenant/features/{feature}	Switch a tenant feature flag on or off, e.g. sql-interface (Owners, ADR-0018).
GET	/api/v1/tenant/modules	The platform modules the tenant is licensed for (ADR-0021), e.g. semantic and migrate. Licences are granted by the platform operator.
GET	/api/v1/tenant/settings	Tenant name, plan, region and AI & privacy settings.
PUT	/api/v1/tenant/settings	Update tenant settings (Owners).
GET	/api/v1/tenant/usage	Admin usage (Owners): scans, served queries, quality rule runs and assistant questions per UTC day over the last 1-90 days (default 30).
POST	/api/v1/tenants	Onboarding: create the caller's tenant and first workspace.
GET	/api/v1/workspaces	Workspaces the caller can use.
POST	/api/v1/workspaces	Create a workspace.
GET	/api/v1/workspaces/{workspaceId}	One workspace.
PATCH	/api/v1/workspaces/{workspaceId}	Rename a workspace.
DELETE	/api/v1/workspaces/{workspaceId}	Archive a workspace (soft delete, audited).
GET	/api/v1/workspaces/{workspaceId}/api-keys	API keys of a workspace (never the key itself).
POST	/api/v1/workspaces/{workspaceId}/api-keys	Create an API key. The plaintext key is returned once and never again.
DELETE	/api/v1/workspaces/{workspaceId}/api-keys/{apiKeyId}	Revoke an API key (rejected everywhere within 60 s).
GET	/api/v1/workspaces/{workspaceId}/invitations	Pending invitations of a workspace.
GET	/api/v1/workspaces/{workspaceId}/members	Members of a workspace.
POST	/api/v1/workspaces/{workspaceId}/members	Invite a person by email (token valid 7 days, single use).
PATCH	/api/v1/workspaces/{workspaceId}/members/{userId}	Change a member's role.
DELETE	/api/v1/workspaces/{workspaceId}/members/{userId}	Remove a member from a workspace.
GET	/api/v1/workspaces/{workspaceId}/members/{userId}/attributes	A member's access-policy attributes (e.g. region): those managed here, and those from SCIM (read-only, they win). Owners and Admins.
PUT	/api/v1/workspaces/{workspaceId}/members/{userId}/attributes	Replace a member's access-policy attributes, read by row filters such as {{user.attributes.region}} (audited; they win over IdP claims, SCIM values win over them).

AcceptInvitation

POST /api/v1/invitations/{token}:accept

Accept an invitation as the signed-in user.

Parameter	In	Type	Required	Notes
token	path	string	yes

Status	Description	Body
200	OK	AcceptInvitationResponse

Response 200: AcceptInvitationResponse

Field	Type	Notes
tenantId	uuid
workspaceId	uuid

GetCurrentUser

GET /api/v1/me

The signed-in user, their tenants and usable workspaces.

Status	Description	Body
200	OK	CurrentUserResponse

Response 200: CurrentUserResponse

Field	Type	Notes
currentTenantId	uuid?
isTenantOwner	boolean
onboarding	string?
platformRole	string?
preferences	UserPreferencesDto?
supportSession	SupportSessionInfoDto?
tenants	TenantSummaryDto[]
user	UserDto
workspaces	MyWorkspaceDto[]

SetTenantFeature

PUT /api/v1/tenant/features/{feature}

Switch a tenant feature flag on or off, e.g. sql-interface (Owners, ADR-0018).

Parameter	In	Type	Required	Notes
feature	path	string	yes

Request body (application/json): SetTenantFeatureRequest

Field	Type	Notes
enabled	boolean

Status	Description	Body
204	No Content	—

GetTenantModules

GET /api/v1/tenant/modules

The platform modules the tenant is licensed for (ADR-0021), e.g. semantic and migrate. Licences are granted by the platform operator.

Status	Description	Body
200	OK	TenantModulesDto

Response 200: TenantModulesDto

Field	Type	Notes
licensed	string[]
modules	TenantModuleDto[]

GetTenantSettings

GET /api/v1/tenant/settings

Tenant name, plan, region and AI & privacy settings.

Status	Description	Body
200	OK	TenantSettingsDto

Response 200: TenantSettingsDto

Field	Type	Notes
allowSamplesInPrompts	boolean
autoAcceptThreshold	number?
dailyDigestByDefault	boolean
features	string[]
llmModel	string
llmProvider	string
name	string
plan	string
region	string
tenantId	uuid

UpdateTenantSettings

PUT /api/v1/tenant/settings

Update tenant settings (Owners).

Request body (application/json): UpdateTenantSettingsRequest

Field	Type	Notes
allowSamplesInPrompts	boolean
autoAcceptThreshold	number?
dailyDigestByDefault	boolean
llmModel	string
llmProvider	string

Status	Description	Body
204	No Content	—

GetTenantUsage

GET /api/v1/tenant/usage

Admin usage (Owners): scans, served queries, quality rule runs and assistant questions per UTC day over the last 1-90 days (default 30).

Parameter	In	Type	Required	Notes
days	query	int32	no

Status	Description	Body
200	OK	TenantUsageDto

Response 200: TenantUsageDto

Field	Type	Notes
days	UsageDayDto[]
from	date
llmTokensTracked	boolean
to	date
totals	UsageTotalsDto
workspaces	WorkspaceUsageDto[]

CreateTenant

POST /api/v1/tenants

Onboarding: create the caller's tenant and first workspace.

Request body (application/json): CreateTenantRequest

Field	Type	Notes
name	string
region	DataRegion	One of US, EU
slug	string
workspaceName	string

Status	Description	Body
201	Created	CreateTenantResponse

Response 201: CreateTenantResponse

Field	Type	Notes
tenantId	uuid
workspaceId	uuid

ListWorkspaces

GET /api/v1/workspaces

Workspaces the caller can use.

Status	Description	Body
200	OK	WorkspaceDto[]

CreateWorkspace

POST /api/v1/workspaces

Create a workspace.

Request body (application/json): CreateWorkspaceRequest

Field	Type	Notes
name	string

Status	Description	Body
201	Created	CreatedResponse

Response 201: CreatedResponse

Field	Type	Notes
id	uuid

GetWorkspace

GET /api/v1/workspaces/{workspaceId}

One workspace.

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes

Status	Description	Body
200	OK	WorkspaceDto

Response 200: WorkspaceDto

Field	Type	Notes
id	uuid
memberCount	int32
name	string
status	string

RenameWorkspace

PATCH /api/v1/workspaces/{workspaceId}

Rename a workspace.

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes

Request body (application/json): RenameWorkspaceRequest

Field	Type	Notes
name	string

Status	Description	Body
204	No Content	—

ArchiveWorkspace

DELETE /api/v1/workspaces/{workspaceId}

Archive a workspace (soft delete, audited).

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes

Status	Description	Body
204	No Content	—

ListApiKeys

GET /api/v1/workspaces/{workspaceId}/api-keys

API keys of a workspace (never the key itself).

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes

Status	Description	Body
200	OK	ApiKeyDto[]

CreateApiKey

POST /api/v1/workspaces/{workspaceId}/api-keys

Create an API key. The plaintext key is returned once and never again.

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes

Request body (application/json): CreateApiKeyRequest

Field	Type	Notes
expiresAt	date-time?
name	string
scopes	string[]

Status	Description	Body
201	Created	CreateApiKeyResponse

Response 201: CreateApiKeyResponse

Field	Type	Notes
expiresAt	date-time?
id	uuid
key	string
name	string
prefix	string
scopes	string[]

RevokeApiKey

DELETE /api/v1/workspaces/{workspaceId}/api-keys/{apiKeyId}

Revoke an API key (rejected everywhere within 60 s).

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes
apiKeyId	path	uuid	yes

Status	Description	Body
204	No Content	—

ListInvitations

GET /api/v1/workspaces/{workspaceId}/invitations

Pending invitations of a workspace.

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes

Status	Description	Body
200	OK	InvitationDto[]

ListMembers

GET /api/v1/workspaces/{workspaceId}/members

Members of a workspace.

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes

Status	Description	Body
200	OK	MemberDto[]

InviteMember

POST /api/v1/workspaces/{workspaceId}/members

Invite a person by email (token valid 7 days, single use).

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes

Request body (application/json): InviteMemberRequest

Field	Type	Notes
email	string
role	WorkspaceRole	One of Owner, Admin, Steward, Modeler, Analyst, Viewer

Status	Description	Body
201	Created	CreatedResponse

Response 201: CreatedResponse

Field	Type	Notes
id	uuid

ChangeMemberRole

PATCH /api/v1/workspaces/{workspaceId}/members/{userId}

Change a member's role.

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes
userId	path	uuid	yes

Request body (application/json): ChangeMemberRoleRequest

Field	Type	Notes
role	WorkspaceRole	One of Owner, Admin, Steward, Modeler, Analyst, Viewer

Status	Description	Body
204	No Content	—

RemoveMember

DELETE /api/v1/workspaces/{workspaceId}/members/{userId}

Remove a member from a workspace.

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes
userId	path	uuid	yes

Status	Description	Body
204	No Content	—

GetMemberAttributes

GET /api/v1/workspaces/{workspaceId}/members/{userId}/attributes

A member's access-policy attributes (e.g. region): those managed here, and those from SCIM (read-only, they win). Owners and Admins.

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes
userId	path	uuid	yes

Status	Description	Body
200	OK	MemberAttributesResponse

Response 200: MemberAttributesResponse

Field	Type	Notes
attributes	object
fromScim	object

SetMemberAttributes

PUT /api/v1/workspaces/{workspaceId}/members/{userId}/attributes

Replace a member's access-policy attributes, read by row filters such as {{user.attributes.region}} (audited; they win over IdP claims, SCIM values win over them).

Parameter	In	Type	Required	Notes
workspaceId	path	uuid	yes
userId	path	uuid	yes

Request body (application/json): object

Status	Description	Body
204	No Content	—