Dashboard API

Inspects an invitation without consuming it. Never reports signup or verification state, except that a sign-in reset reports replaces_unverified_account. An organization_admin or organization_member invitation reports the organization's name and no project.

Starts a five-minute registration ceremony bound to the invitation digest and mode. Link create_login requires a verified __Host-screenrig-signup cookie and uses its name.

Email create_login binds the supplied display name; reset binds the target person, except that a reset of an unverified address registers the passkey for the new person it creates, named by the supplied display name or, when absent, from the address.

That reset requires replace_unverified_account true (the inspection reports replaces_unverified_account) and otherwise answers 409 unverified_account_replacement.

Starts a browser-bound link signup and revokes earlier signups for this invitation. The verification challenge is bound to this signup. Development auth verifies the signup immediately without mail.

Returns the live signup belonging to this browser. A missing, revoked, consumed, or expired signup cookie returns invitation_invalid.

Accepts an invitation transactionally and mints a fresh person session, deleting the old session when present.

Link create_login requires the verified __Host-screenrig-signup cookie for this invitation. signed_in requires a dashboard session and recent sign-in or fresh proof; email delivery requires a matching verified email, or the unverified address of the signed-in person, which accepting verifies.

An address a live person already holds, verified or not, returns resource_conflict for create_login. A reset signs in the person who holds a verified address.

A reset of an unverified address requires replace_unverified_account true (the inspection reports replaces_unverified_account) and otherwise answers 409 unverified_account_replacement and consumes nothing; with it, the reset creates a new verified person with the credential it registers, named by display_name or, when absent, from the address, with a new organization and project, and signs that person in; the unverified person is deleted (their sessions, passkeys and agents end) and the projects and organizations they made stay, without them and no longer matching the address as their contact, so no later reset re-sends them an enrollment invitation.

The response names the new project. A session whose email verification is required (email_verification_required on GET /api/session) accepts only an emailed invitation naming its own address and receives 403 email_verification_required for any other.

An organization_admin invitation adds the person to the organization's admins and opens no project; it returns organization_admin_limit when the organization already has 20 admins and stays outstanding, and resource_conflict when the organization was deleted.

An organization_member invitation sets the person's home organization to the inviting organization, from any previous home, and grants no project membership; it returns managed_elsewhere (409) when another organization manages the person, and resource_conflict when the organization was deleted.

An organization_admin invitation sets the home organization only for a person with none. A project_member invitation re-checks the organization's guest policy and returns guest_not_allowed (403) when the person would be an external guest the policy refuses; a project invitation never changes anyone's home organization. A refused invitation stays outstanding.

Starts a five-minute registration ceremony for a self-serve signup, bound to the normalized email address and the display name. It creates nothing and sends no mail.

An address a live person holds, verified or not, returns 409 account_exists; an address at a domain whose organization signs in through an identity provider returns 403 sso_required; an invalid address or name returns 400 invalid_request with field errors. A server running dashboard development authentication returns passkeys_disabled.

Limited per client address.

Creates a self-serve account and signs this browser in.

One transaction creates the person with an unverified email address and a verification deadline 72 hours out, registers the passkey from the ceremony POST /api/signups/passkey-options started, creates the person's organization and project as agent enrollment creates them, makes the person the project owner, stores the marketing email choice, and queues the verification mail (purpose account_email).

The website visitor that opened the page is linked to the account and the signup is counted as signed_up. The response sets the dashboard session cookie. The refusals are those of POST /api/signups/passkey-options; a used, expired or mismatched ceremony returns 400 invalid_request. Limited per client address and per email address.

Switches to one of the person’s projects and updates its last-used time. A staff member may also switch to a project they shadow; that session reports shadow true, is read-only, and updates no last-used time. Any other project returns not_found.

Lists members of the current project without their private email addresses.

Every member has equal authority except member management (removal, approver, scopes, ownership), which belongs to the owner and to an admin of the project's organization who is a member. owner marks the project owner, external marks a guest (the member's home is not the project's organization), and viewer_user_id and viewer_is_owner describe the signed-in person.

Removes a member from the current project. The project owner removes any other member, and so does an admin of the project's organization who is a member; any member removes themselves to leave. The owner is never removed and never leaves (owner_cannot_leave; transfer ownership first). A member removing someone else is refused with owner_required.

A person who is not a member, including one already removed, is not_found. In one transaction the membership ends, that person's outstanding email invitations to the project are revoked, and the project event member.removed is appended (details user_id, removed_by_user_id, left).

The person's sessions stop resolving the project on their next request and fall back as they do after a project deletion. Agent memberships are separate and stay. People only; no bearer route.

One person's activity in the current project, newest first: their sign-ins (and refused sign-ins naming their address or passkey), sign-outs, switches into the project, credential changes, reauthentication proofs and every change they made through the dashboard, refused and failed ones included. Reads are never recorded.

Agent and CLI requests are on their agents (listDashboardAgentEvents). A staff member's shadow of the project records nothing; a change made under an approved staff write lease is a row of that staff member with source staff.

The person themself, the project's owner, an admin of the project's organization and a staff member shadowing the project may read it. Anyone else is answered not_found, as is a person who is neither a member nor has rows here, so the answer never tells who belongs; a former member's rows stay readable.

The project is the session's, never the request's, and only that project's rows are ever returned.

Every value is server-derived: the action from the route the server matched (or a named account action such as session.sign_in or passkey.add), the resource from the route's first path value when it is a server-minted identifier, status, problem_code and error from the problem registry, the client parsed from the User-Agent and platform hint (the raw User-Agent is not kept).

No request body, password, token or cookie is stored. client_ip and email are shown as recorded.

Paging keys on (at, id) descending. Pass next_cursor as after to continue; it is null at the end. A row written meanwhile only lands ahead of the first page and retention removes the oldest rows, so a cursor never repeats or skips a surviving row. A malformed cursor or filter is refused with invalid_request; a limit outside 1-100 is the default.

Rows expire on the project's event retention window at the time they were written. recorded_since is the time of the project's oldest surviving row, or, before any, when this server began recording; nothing before it is reconstructed.

Returns the signed-in person’s profile and credential counts.

Tombstones the signed-in person. Proof-protected: the body carries a fresh sign-in proof verified against a reauthentication bound to this session with kind account_delete and subject_id equal to the signed-in person's user id (start it with POST /api/me/reauthentications). Without a current reauthentication the answer is reauthentication_required.

On success the response is 204, the dashboard session cookie is cleared, and the browser's HTTP cache for the dashboard origin is cleared as on sign-out.

Starts passkey step-up bound to the session, kind, and subject. A person without a passkey receives resource_conflict and uses a password proof.

Sets or replaces the person’s password after fresh proof. The first password requires passkey proof; replacement accepts the current password or a passkey. Revokes other sessions and queues a sign-in changed notice.

A person whose email address is unverified, such as a self-serve signup before they verify it, cannot set a password and receives 403 email_verification_required.

Lists the person’s passkeys with what a client needs to keep the browser’s password manager in step with them (the WebAuthn Signal API). The list carries the relying party ID and the user handle the passkeys are registered under, and each passkey carries its credential ID and the provider its authenticator reported.

Verifies fresh proof and starts a registration bound to the session and person. Passkeys are disabled under development auth.

Stores the new passkey, revokes the person’s other sessions, and queues a sign-in changed notice. A passkey sent without a name is named after its provider, or Passkey when its authenticator reported none the list knows.

Renames a passkey owned by the signed-in person.

Deletes a passkey after fresh proof and sends a sign-in changed notice. Removing the last sign-in method returns last_credential. A person whose account requires a passkey (every staff member) cannot remove their last passkey; that returns 409 resource_conflict.

Returns the person’s verified and pending email state. A person who signed up themselves holds an unverified address until they open the link mailed to it; email_verified is false and verify_by is the deadline, after which the session may use only the routes that verify or change the address (email_verification_required on GET /api/session).

Requests an email change after fresh proof. The verified address stays effective while verification is pending. An address any other live person holds, verified or not, returns user_email_conflict. The old address receives a warning, not an undo link.

A person whose address is unverified changes it the same way; verifying the new address makes it the person's verified address and clears verify_by.

Queues a fresh verification link. While an email change waits for verification (pending_email on GET /api/me/email), it is that change's link, sent to the pending address; otherwise it is an account_email link for the person's current unverified address. Within ten minutes of the last link of its kind it queues nothing and still answers 202.

A person whose address is verified and who has no change pending returns 409 resource_conflict.

Replaces the answers the person gave after signing up with the body, which holds every answer so far; a member left out, or null, is unanswered. Each member has a closed value set, and a value outside it returns 400 invalid_request with a field error.

The profile is kept with the person and shown to screenRIG staff with the organization the person signed up into.

Where an application (web app) of the session's project is placed, computed in one pass over the project's playlists and one read of the screens that hold them. placements are the application primitives whose stored application owner is this application, in playlist (the playlist list's order), page and primitive order; a playlist that places it twice has two. release says how each pinned release stands against the application's latest_ready_release: latest, older, or unknown while it has none. screens are the pairing_pending and active screens that default to, schedule, take over with or currently show a playlist of a placement, newest first; archived screens never count, and a screen whose Player cannot show web apps carries applications_unsupported.

A member or agent limited to screens (screen_scope) sees only its screens, and screen_count counts only those. This is not the delete blocker, which is the runtime grants (a screen's manifest holding a release). An id the project does not hold is not_found as for getApplication. The answer is private and no-store.

Where a ready media item of the session's project is used, computed in one pass over the project's playlists and one read of the screens that hold them. playlists are those that name the file (an image or video primitive's static ids and a by id or ids selector, a stream's fallback, a media:<id> string in a card's params, a stinger's logo, a soundtrack track), then those whose tag, folder or all selectors reach it, each group in the playlist list's order; a playlist is one entry whose uses list each way, the exact kinds first.

Selectors are judged as the runtime resolves them: a tag filter matches the file's tag and tags, a folder selector the files directly inside the folder, an all selector every file of the kind, and a pending file by its last-approved tags and folder (a file never approved is reached by none).

Rotation (batch_size, one_at_a_time), availability windows, aspect fit and a page's visibility are not judged. screens are the pairing_pending and active screens that default to, schedule, take over with or currently show one of those playlists, newest first; archived screens never count.

A member or agent limited to screens (screen_scope) sees only its screens, and screen_count counts only those. An id the project does not hold, or a media item that is not ready, is not_found as for getMedia. The answer is private and no-store.

Returns a small lossy WebP of a ready image owned by the session's project, so the dashboard's grids never decode originals. There is one size: it fits inside 512 x 512 with the aspect kept and is never upscaled, and an animated image shows its first frame.

The first request generates it and stores it beside the original; later requests stream the stored copy, and deleting the media removes it with the original. Another project's identifier, video, audio, and media that is not ready return not_found. Range is not accepted.

The ETag is strong and names the original and the thumbnail generator, so it is the same on every request and host. The response is private, no-cache, and an If-None-Match that matches, checked after the media resolves in the session's project, returns 304 without reading the thumbnail. Completed bytes are recorded as dashboard_media egress.

Applies the same ownership, conditional and generation rules as getDashboardMediaThumbnail and returns its headers without the body. No egress is recorded.

Scanner-safe verification peek. It never verifies an address, mutates a user, or signs the visitor in. It reports the link's purpose and state; a pending account_email link verifies only for a request that carries the person's dashboard session, so a page asks for the sign-in before it asks to confirm.

Explicit human confirmation consumes one purpose-bound verification challenge. Link-signup challenges require the matching __Host-screenrig-signup cookie; email-change challenges are token-bound, so the link works in any browser.

An account_email challenge (mailed at self-serve signup and by POST /api/me/email/verification, valid for 30 days) opens in any browser but verifies only for a request that carries a live dashboard session of the person the link is for, including a session that email_verification_required limits to this route.

With no session, or another person's, it answers 200 sign_in_required, verifies nothing and leaves the link usable. A verified account_email link marks the person's address verified and ends the verification deadline; it answers superseded when another person verified the same address first. Verification never signs the visitor in.

Starts one usernameless WebAuthn assertion ceremony and returns the request options verbatim for navigator.credentials.get. No cookie is required, and no allowCredentials list is published, so the route reveals nothing about which users or credentials exist. The ceremony expires with DashboardCeremonyTTL of five minutes.

When the server runs dashboard development authentication, this route returns passkeys_disabled.

Verifies one usernameless assertion and mints the dashboard session cookie for the user the discoverable credential identifies. No cookie authenticates the request. A ceremony that is unknown, elapsed, or already used returns passkey_invalid, and so does an assertion the relying party cannot verify or a sign counter that moves backwards.

A valid ceremony whose credential identifier is registered to nobody (no stored credential has it, for any person) returns 401 passkey_unknown instead; that answer is for that one case only, so a client may tell the browser to forget the credential (PublicKeyCredential.signalUnknownCredential) on it and on nothing else.

The credential identifier is not authorization on its own: the signed assertion is. A person whose verified address is at a domain whose organization requires single sign-on is refused with 403 sso_required, unless they are a break-glass admin of that organization; such a sign-in is audited.

When the server runs dashboard development authentication, this route returns passkeys_disabled.

Signs in the person identified by verified email and password. Unknown email, no password, and wrong password return the same unauthorized response. Opens the last-used project if still a membership, otherwise the most recent membership, or no project.

An address at a domain whose organization requires single sign-on is refused with 403 sso_required before any account is looked up, so the answer does not depend on whether a person holds the address; POST /api/sso/starts signs that person in through their identity provider.

Password sign-in needs a verified email, so a person who signed themselves up (POST /api/signups) signs in with their passkey, and one who set a password on an unverified address still gets the unauthorized answer. Development auth uses this same password flow.

Returns the current dashboard session. The session cookie and server-side session establish authority; user_id is descriptive. A 401 response means sign-in is required.

The dev_auth field is reserved for local development and is false on the hosted service. organization is the person's home organization, absent while they have none; project.organization_admin says the person administers the current project's organization.

Deletes the server-side session row and expires the session cookie. It does not delete the user and does not remove any credential. It is intrinsically idempotent and takes no Idempotency-Key.

A successful sign-out also clears the browser's HTTP cache for the dashboard origin, dropping the private, no-cache media, screenshot and ad review bytes the session viewed; a session that only expires leaves them until the browser evicts them.

Reports one step of one browser's run through the dashboard's entry flows (sign-up, sign-in, reset, invitation and adding a passkey) for the staff onboarding read. Public: it works with and without a dashboard session.

The journey is the browser's own random id; the server also keeps the edge visitor cookie when the request carries one, and the person and organization when a session does. A journey is staff-only and keeps the real values people entered (addresses, names, answers); it never receives a password, code or token.

The first value of mode, source, utm_source, utm_medium, utm_campaign, click_kind, site_trail and site_cta is kept; each step keeps its first time, and a step's value, detail and the journey's email (from email_submitted) are the latest. source is accepted only with entry_viewed. question is required with the question_* steps and refused with every other. detail is a problem code for a *_failed step, the sign-in method for signed_in, or connected or skipped for signup_finished. email_verified, email_gate_reached, site_visited, site_cta_clicked and the account milestones are written or derived by the server and are refused here.

Only lengths are limited. Limited per client address.

Lists every pending, active, revoked, cancelled, and expired agent of the session project with safe installation metadata, last use, authenticated request count, and directly attributable metered credits. No bearer, recipient key bytes, envelope, or project identifier is returned.

This agent's history, newest first, as ONE record per trigger. It carries both what the agent asked for and what changed as a result. A request that changed something is its domain event, stamped with the command that caused it. A request that changed nothing — refused, failed, or an event-less success — is one agent.command event.

There is no separate commands endpoint; showing the same trigger on two panels was the defect this replaced. Lifecycle events for this agent are included. Worker, player, and dashboard-only activity is never inferred as agent activity. Two requests are two triggers. A retry after a refusal is a second record, never a rewrite of the first.

Reads are not recorded, because they change nothing and a polling agent would bury every real action. Anonymous enrollment is excluded. Every part of the command stamp is derived from the route this server matched or from the problem registry.

There is no argument vector, no request body, no header, and no free text anywhere in a record, so nothing needs redacting and no caller can write chosen text into an operator-visible surface. Resource identifiers appear because an identifier is never authorization and is already published on events. Paging keys on sequence, descending.

Pass the returned next_cursor as after to continue. next_cursor is empty when the page is short, which is the end of the history: a concurrent append only takes a higher sequence, and retention removes the lowest sequences first, so a cursor never duplicates or skips a surviving record. Offset paging is not supported.

Every search parameter is an exact-match or range predicate on a server-written token. A malformed cursor or filter value is refused with invalid_request. A limit outside 1-200 is clamped to the default rather than refused. Records expire on the project's own event retention window.

Disconnects the agent from the selected project after fresh proof. The project must be one of the person’s memberships. Pending connections and credential issuances are cancelled; no replacement token is issued. A member limited to screens does not connect agents, issue credentials or manage the project's people: outside_screen_scope (ask the project owner).

The notes this agent wrote in the session project, newest first, open and resolved. state is all (the default), open or resolved. Pass next_cursor back as after; it is empty on the last page. Note bodies are plain text written by an agent; render them as text, never as HTML or Markdown.

Resolves one of the agent's open notes as the signed-in person, with a required reason; resolution.by names the person. Appends note.resolved with the person as actor. A resolved note is note_not_open.

Deletes one of the agent's notes, open or resolved, as the signed-in person. Appends note.deleted with the person as actor.

The pending connection requests addressed to the session project, which a member may review and approve: requests naming the project, and device sign-ins or connects by an agent identity already a member of it.

A new installation's sign-in is not listed (its project hint is client-supplied); a person reaches it by its user code (POST /api/agent-connections/lookup).

Resolves the user code of a pending device sign-in (`screenrig login`), as typed or prefilled on the connect page, to its connection, whose approval view then shows it. Approves nothing. Separators, spaces and case are ignored. An unknown, used or invalid code is agent_connection_invalid; an expired one agent_connection_expired.

Limited to 5 lookups per dashboard session per 10 minutes, 20 per client address per hour and 1200 per hour fleet-wide (rate_limited). A member limited to screens does not connect agents, issue credentials or manage the project's people: outside_screen_scope (ask the project owner).

Returns safe connection review metadata. Review does not select a project; approval selects one of the person’s memberships.

Approves the connection for the selected project after fresh proof and creates a pending agent. The project must be one of the person’s memberships. Returns safe metadata, never the bearer. A member limited to screens does not connect agents, issue credentials or manage the project's people: outside_screen_scope (ask the project owner).

Denies the connection for the selected project after fresh proof without creating an agent. The project must be one of the person’s memberships. A member limited to screens does not connect agents, issue credentials or manage the project's people: outside_screen_scope (ask the project owner).

One request for the dashboard shell.

Each member is the body the named route answers for this same session (GET /api/me/email, /api/support/status, /api/projects, /api/organizations, /api/project, /api/project/capabilities, /api/advertising/network, /api/alerts?state=open&limit=1 and /api/reviews?state=all&limit=1), produced by that route's own handler under its own authorization, plan and scope checks.

A member is absent when its route would not answer 2xx for this session (a refusal, a role or plan that cannot read it, no current project, a fault), and the dashboard then reads that route itself. advertising_network is null when its route would answer 404 not_found because the project has no network.

A session with no current project gets the members that need none.

Project network-status counters for the session's project. Screen online counts are derived from live paired runtime event streams, the same derivation Screen.online publishes; they are not a stored boolean and not a player heartbeat. Media bytes are the durable bytes of ready media only.

Truthful payout capability state. rails_available is false and unavailable_reason is financial_rails_unavailable while card, tax and cash-out rail are unavailable. No raw bank credentials are returned.

One finalized receipt/tax document owned by the caller. No receipt exists while money collection is unshipped, so this is not_found rather than a fabricated document.

Returns the session project's public whole-credit balance. This cookie-authenticated read never debits, so it remains available at zero. The cookie-only dashboard never presents a project bearer to GET /api/project.

Mints one single-use thirty-second launch ticket for the latest ready release of an application the session's project owns, on that release's own exact preview host, never the release host Players frame, so a Player and the dashboard in one browser never share that host's cached documents or grant cookie.

The ticket converts to the release-grant cookie on that host only, so the preview is cross-origin by construction and web application code can never read a dashboard cookie. The response release_id identifies the exact release selected for this launch, even if another publish completes later. Assign launch_url to iframe.src and to nothing else.

Authority here is owner authority: the session's project owns the application. That is a deliberate second authority source alongside exact-current-manifest authority for screenrig.webapp-package/v1, and it is scoped to this operation. Do not generalize it to media or to protected runtime content.

There is no parent player, so the browser SDK and the key-value bridge fail closed and the preview is presentation-only. An application with no ready release is resource_conflict.

One organization as an item of GET /api/organizations shows it to the caller, with admin, home and reseller. A signed-in person reads it when they administer it, administer the reseller it is delegated to, are staff, or would see it in that listing (a member of one of its live projects, or it is their home organization).

Anyone else, and an organization that does not exist, gets 404 not_found. Grants no project membership. Cookie sessions only; an agent credential is refused.

Organization admins read project names, owners, status and screen counts only; this grants no project access. An admin reads a project's content only after joining it (POST .../projects/{project_id}/access), and manages its people with the owner and members routes below.

The live resellers whose organization the signed-in person administers (admin_user_ids), ordered by name; empty for everyone else. Cookie sessions only. A reseller is an organization staff made a reseller or one of its admins enrolled (POST /api/resellers); its admins run its customers' organizations (docs/resellers.md).

An admin of an organization makes it a reseller at once. The caller must be a signed-in person with a verified email address (cookie sessions only; agents and service clients never hold reseller authority) and an admin of the organization named by organization_id; anyone else gets 404 not_found.

The reseller starts at 2000 basis points of list price (20%) effective now and is pending review, boarding up to 10 current customers (customer_limit) until screenRIG reviews it. The organization must be live, not already a reseller, not a customer of a reseller and not on the staff or promo plan (409 reseller_conflict, the detail names the reason).

Appends reseller.enrolled to the organization audit.

One reseller the caller administers, with its spread. Anyone else gets 404 not_found.

The reseller's current customers (organizations delegated to it), ordered by name, with plan, counts and stored bytes. Reseller admins only; anyone else gets 404 not_found.

Creates a customer organization delegated to the reseller from its creation, on Standard, with the calling reseller admin as its one admin. The caller's home organization does not change. The organization's own admins may later end the delegation (DELETE /api/organizations/{org_id}/reseller).

Appends organization.created and reseller.customer_started to the organization audit. A reseller awaiting review (review_state pending) boards up to customer_limit current customers; past it the answer is 409 reseller_conflict.

One current customer of the reseller. Reseller admins only; an organization that is not a current customer answers 404 not_found.

Sets a current customer's plan, which the reseller pays for. standard removes the plan; plus and premium are always allowed, education only for an education-eligible organization. Enterprise, staff and promo are staff-assigned.

An upgrade applies at once, a downgrade or removal at the next UTC month boundary, as organization plan changes do (docs/billing-rollup.md). Appends reseller.customer_plan to the organization audit.

A current customer's live projects with names, status, screen counts and whether the caller is already a member. Listing grants no project access; POST .../access joins one.

Makes the calling reseller admin a full member of a current customer's project (can_approve, no scopes, source reseller_admin), as an organization admin's join does, so they can open it with PUT /api/session/project. Already a member answers the project unchanged.

Appends member.added_by_reseller to the project and reseller.project_joined to the organization audit, and emails the project owner. The membership stays until removed; ending the delegation does not remove it.

What the reseller owes for one UTC month. One line per customer delegated at any time in the month, with the part of its usage charges in the delegated part of the month that its own credit did not cover (at list price and at the reseller's price), and its plan's annual price.

The reseller's price is list less the spread in force at the later of the month's start and the reseller's (re)creation. Reseller admins only.

An admin of the organization ends its delegation to its reseller at once. From then the organization pays for itself; its plan, projects and members stay as they are, including memberships reseller admins hold. The overage its wallet accrued while delegated, which the reseller is billed for, is written off in the same change.

Appends reseller.customer_ended to the organization audit. An organization with no reseller answers 404 not_found.

Projects elsewhere whose owners have a verified email on the exact verified domain. Contact addresses and subdomains do not match, and admins cannot pull projects in.

Open a 7-day DNS TXT challenge for one domain, replacing that domain's pending challenge; the organization's other domains are unchanged. Put its exact value at its returned DNS name and keep it there. An organization holds at most 20 domains, verified and pending together (resource_conflict). A domain another organization holds is resource_conflict.

A domain this organization already holds may be proved again, which records the new value for the daily DNS check.

Verify one unexpired challenge against DNS and add its domain to the organization, beside the domains it already holds. Each exact domain belongs to one organization. A proof rotated during lookup is refused. Keep the TXT record in place; a daily check removes a domain whose record stays missing for seven days.

Once the claim commits, and in the background after this response, each project whose owner is a verified person at exactly the domain and which sits alone in that owner's personal organization is moved into this organization (renamed "<name> (<owner>)" on a name conflict).

Projects in any other organization, projects holding a customer-paid plan of their own, and projects their owner or staff moved out of a domain organization stay where they are; a project the organization's limits refuse is retried a day later. Placement grants no access.

A designated admin reads the organization's admins, the candidates who may become one (verified, active owners of its live projects who are not admins yet) and the organization revision. Anyone else is refused as on the other organization admin routes. People only; agents and bearer credentials have no admin route.

A designated admin replaces the organization's admins. If-Match carries the organization revision; a stale one is revision_conflict with current_revision. The set names 1 to 20 people, each a current admin or a candidate, otherwise invalid_request; an admin removes themselves only while another admin remains.

The change increments the revision, is recorded in the organization audit, grants no project membership, and returns the same shape as GET. People only; agents and bearer credentials have no admin route.

A designated admin reads the organization's people. Read-only. projects lists the organization's live projects, ordered by name, at most 500. people is the union of the organization's home members (member true), the active memberships of those projects (suspended memberships are left out) and the designated admins.

It is ordered admins first, then home members, then external people (those who are not home members), each group by display name then email.

Each person carries their role in each project (owner or member), whether they can approve reviews there (can_approve) and whether they are limited to screens or uploads (limited), whether they are an admin, a home member (member), managed by the organization (managed), and, for an external person, whether the current guest policy would not admit them (outside_guest_policy).

An admin or home member in no project appears with an empty projects list. email is empty for a person whose address is not verified. Deactivated people and agents never appear. At most 500 people are returned, admins always among them; truncated is true when people, projects or memberships were left out.

Anyone else is refused as on the other organization admin routes. People only; agents and bearer credentials have no route.

A designated admin lists the organization's admin invitations by id, 50 at a time, after expiring those whose time has passed. Recipient addresses are visible to the organization's admins, who supplied them. Tokens and credential URLs are never listed. People only; agents and bearer credentials have no admin route.

A designated admin invites people by email to become admins. Accepting adds the person to the organization's admins and creates their login if they have none; it grants no project membership. At most 20 admins counting pending admin invitations (organization_admin_limit); an address whose person already administers the organization is invalid_request.

Email invitations expire after seven days; an outstanding invitation to the same address is reused. The organization and inviter names must be fit for email. People only; agents and bearer credentials have no admin route.

A designated admin revokes an outstanding admin invitation and frees its admin slot. An already revoked invitation returns 204; an accepted one returns invitation_consumed; an id the organization does not hold is not_found. People only; agents and bearer credentials have no admin route.

A designated admin lists the organization's member invitations by id, 50 at a time, after expiring those whose time has passed. Recipient addresses are visible to the organization's admins, who supplied them. Tokens and credential URLs are never listed. People only; agents and bearer credentials have no admin route.

A designated admin invites people by email to join the organization as members. Accepting sets the person's home organization to this one, from any previous home, and creates their login if they have none; it grants no project membership.

An address whose person is already a home member of the organization is invalid_request; one whose person another organization manages is managed_elsewhere. Email invitations expire after seven days; an outstanding invitation to the same address is reused. The organization and inviter names must be fit for email.

Accepting an invitation to the staff organization (plan_id staff) also makes the person staff, so only staff send those, one address per request with a staff_grant proof bound to it (reauthentication_required without one). People only; agents and bearer credentials have no admin route.

A designated admin revokes an outstanding member invitation. An already revoked invitation returns 204; an accepted one returns invitation_consumed; an id the organization does not hold is not_found. People only; agents and bearer credentials have no admin route.

A designated admin removes a home member from the organization.

In one transaction the person's home organization is cleared and their memberships in all of the organization's live projects end, each as removing them from that project would (outstanding email invitations to it are revoked and their sessions stop resolving it); memberships in other organizations' projects are untouched, and no other organization changes.

The change is recorded in the organization audit.

A person an identity provider manages (single sign-on or SCIM) is managed_member; a designated admin is organization_admin_member (remove the admin seat first with PUT /api/organizations/{org_id}/admins); a person who owns any live project of the organization is member_owns_projects and the detail lists the project names (transfer those projects first, nothing is removed); a person who is not a home member of the organization, including one already removed, is not_found.

People only; agents and bearer credentials have no admin route.

A designated admin sets whom the organization admits to its projects as guests, meaning people whose home organization is another one or who have none. mode allow (the default) admits every guest, domains admits a guest whose verified email address is at one of domains, and none admits no guest. domains lists 1 to 20 distinct lowercase DNS names, required for mode domains and omitted otherwise; anything else is invalid_request.

The policy replaces the previous one, increments the organization revision, is recorded in the organization audit, and answers the policy in force. It is checked when the organization grants a guest a project membership, by project member invitation (create and accept) and by SCIM group binding, and refuses with guest_not_allowed.

Staff and the organization's own admins are exempt, agents are not checked, and home members are never guests. Tightening the policy removes nobody; outside_policy counts the external people already in the organization's live projects whom the new policy would not admit, and GET /api/organizations/{org_id}/people flags each of them (outside_guest_policy).

People only; agents and bearer credentials have no admin route.

A designated admin sets or clears the organization's Library project. project_id names one of the organization's live projects, or null clears it.

Every other project of the organization then reads the Library's media, media folders and playlists (library=true on GET /api/media, /api/media-folders and /api/playlists, and by id) and uses them read-only - page media references, by:folder selectors that name a Library folder (tag and all selectors never reach the Library), screen schedules and stacks, and from_template - while only the Library's own members change them.

The Library project holds no screens - a project with screens is library_no_screens, and the Library admits none afterwards. Setting a Library needs the library plan feature (Premium, Education, Enterprise; feature_not_in_plan otherwise); clearing one never does, and a Library kept after a downgrade keeps serving.

Clearing or replacing the Library leaves member playlists naming its items unresolvable at their next write, and screens stop receiving its media. A project that is the Library and is deleted or moved out of the organization clears it.

Answers the organization view, is recorded in the organization audit (organization.library_changed) and increments the revision. People only.

A designated admin sets the access of many people to many of the organization's live projects in one request, without joining any of them.

Each of 1 to 500 changes names a project, a person and an access, with no (project_id, user_id) pair twice. member makes the person a member of the project who cannot approve reviews (added when they are not one; an approver loses approval), approver a member who can approve (added when they are not one), and none no member (removed when they are one).

Everything is applied in order in one transaction, and one refusal undoes the whole batch; each refusal blames changes[i] (the project or the person) or changes[i].access in errors[].field.

A project that is not a live project of this organization is not_found; a person who is not a live person (an agent, a deactivated person, an unknown id) or who is staff, a suspended membership, and a person added who is not one of the organization's people (its admins, its home members and the active members of its other live projects; anyone else joins through an invitation) are invalid_request; the owner is never set to member or none (owner_cannot_leave); an uploader never approves (resource_conflict, as PUT /api/members/{user_id}/approver answers); removing the admin themself is forbidden (an admin leaves through DELETE /api/members/{user_id}); and a person who is added is admitted as an invitation admits them, so home members and the organization's admins always and an external person only where the guest policy admits them now (guest_not_allowed).

The project's 200-member limit and its plan's member cap apply to what is added (member_limit_reached). The answer repeats every change in request order; changed is false for one whose access was already in effect, which writes and records nothing.

Each change is recorded in the organization audit (organization.project_member_added, organization.project_member_approver_changed or organization.project_member_removed) and in the project's events (member.added_by_organization_admin, project.member_approver_changed or member.removed, marked as the organization admin's), and each project's owner is emailed once for the batch unless they made it.

People only; agents and bearer credentials have no admin route.

A designated admin joins one of the organization's live projects as a member without a screen or upload scope who can approve reviews. Joining is what gives the admin the project's content, which the organization routes never show.

An admin who is already a member without a scope who can approve gets 200 with joined false and nothing changes; a member with a screen or upload scope, or one who cannot approve, becomes a member without a scope who can approve, recorded as a join.

The project's 200-member limit applies (member_limit_reached); the organization's guest policy never applies to its own admins. Joining is recorded in the organization audit as organization.project_joined and in the project's events as member.added_by_organization_admin, and the project's owner is emailed.

A project the organization does not hold, or that was deleted, is not_found. People only; agents and bearer credentials have no admin route.

A designated admin makes a person the owner of one of the organization's live projects without joining it, from whoever owns it now, including an owner whose account is deactivated.

The new owner is a verified, active person who is a member of the project or a home member of the organization (a home member who is not a member of the project is added first as a member without a screen or upload scope who can approve reviews; the guest policy does not apply to a home member); anyone else is invalid_request at user_id.

An admin makes themself the owner only after joining the project (POST /api/organizations/{org_id}/projects/{project_id}/access), and one who is not a member without a screen or upload scope who can approve is invalid_request at user_id.

The effect is that of the owner's own transfer, so the new owner's screen scope and upload scope are cleared and the project's legacy responsibilities are bound to them. Naming the current owner changes nothing. The change is recorded in the organization audit as organization.project_owner_changed, and the previous and the new owner are emailed.

The project's 200-member limit applies to an added home member (member_limit_reached). A project the organization does not hold, or that was deleted, is not_found. People only; agents and bearer credentials have no admin route.

A designated admin removes a member from one of the organization's live projects without joining it. It has the effect of the owner's removal (DELETE /api/members/{user_id}). The membership ends, the person's outstanding email invitations to the project are revoked, their sessions stop resolving the project, and agent memberships stay.

The owner is never removed (owner_cannot_leave; transfer ownership first with PUT /api/organizations/{org_id}/projects/{project_id}/owner). A person who is not a member of the project, including one already removed, and a project the organization does not hold or that was deleted, are not_found.

The removal is recorded in the organization audit as organization.project_member_removed and in the project's events as member.removed with removed_by_organization_admin true. People only; agents and bearer credentials have no admin route.

Remove one domain, verified or pending, and leave the organization's other domains. Future placement and discovery for it stop, and another organization may verify it. Projects already in the organization stay. A domain the organization neither holds nor is proving is not_found.

While the organization requires single sign-on, a verified domain is resource_conflict; turning off Require single sign-on takes effect after 72 hours, and the domain can be removed then.

Sets whether a member can approve: decide reviews and grant agents Manage access. A member who cannot approve has their agents held to Propose. The project owner, or a member who administers the project's organization (forbidden otherwise); the owner's own row is fixed (resource_conflict); a non-member is not_found.

Appends project.member_approver_changed (details user_id, can_approve).

Limits a member to screen folders (each with every folder inside it) and screens, or replaces the scope of one (docs/screen-scope.md).

In one transaction it also ends the agents the person brought to the project (agent.disconnected, as removing them would) and appends project.member_screen_scope_changed (details user_id, screen_scope, previous, changed_by_user_id). The scope is read on the member's next request: the change shows on their next GET /api/session without signing in again.

The project owner, or a member who administers the project's organization (forbidden otherwise); the owner's own row, an uploader (a scoped member is limited to screens, an uploader to content) and a member who approves reviews with single screens in the scope are resource_conflict; a non-member is not_found; an id that is not a live screen folder or screen of the project is invalid_request at screen_scope.folder_ids[i] or screen_scope.screen_ids[i].

A scoped member who approves reviews approves only inside the scope; one who cannot approve reads and runs commands but changes what plays only through approvers (approver_required).

A scope is also refused with resource_conflict while the person, or an agent the person brought, has a live service client of the project: the detail names up to five clients as ID (name) and counts the rest, and nothing is written.

Limiting a person to screens is screen scope, which the Enterprise plan includes; a project whose plan lacks it is refused with feature_not_in_plan (402). A scope that is set keeps limiting the person until it is cleared (DELETE), which every plan may do.

Gives a scoped member the whole project's screens again. The project owner, or a member who administers the project's organization, only; a member who is not scoped is left as they are. Appends project.member_screen_scope_changed with screen_scope null.

Limits an agent's membership of the session project to screen folders and screens, or replaces its scope (docs/screen-scope.md). The agent's reach is this scope narrowed by its responsible person's, so a scoped person never acts through an agent wider than themselves.

The project owner, or a member who administers the project's organization (forbidden otherwise); an agent that is not a member of the project is not_found. Appends agent.screen_scope_changed (details agent_id, screen_scope, previous, changed_by_user_id).

An agent's scope applies to its next request on the instance that wrote it and within two seconds on the others. A scope is refused with resource_conflict while the agent has a live service client of the project: the detail names up to five clients as ID (name) and counts the rest, and nothing is written.

Limiting an agent to screens is screen scope, which the Enterprise plan includes; a project whose plan lacks it is refused with feature_not_in_plan (402). A scope that is set keeps limiting the agent until it is cleared (DELETE), which every plan may do.

Removes the scope of an agent's membership of the session project. The project owner, or a member who administers the project's organization, only. Appends agent.screen_scope_changed with screen_scope null.

Makes a member an uploader, or replaces the scope of one (docs/uploaders.md): the playlists they change pages of and the media folders they upload into.

In one transaction it also stops them approving reviews, ends the agents they brought to the project (agent.disconnected, as removing them would) and appends project.member_upload_scope_changed (details user_id, upload_scope, changed_by_user_id).

The scope is read on the member's next request: the change shows on their next GET /api/session without signing in again.

The project owner, or a member who administers the project's organization (forbidden otherwise); the owner's own row is resource_conflict; a non-member is not_found; an id that is not a live playlist or media folder of the project is invalid_request at upload_scope.playlist_ids[i] or upload_scope.folder_ids[i]. access propose (the default) sends the uploader's changes to review; manage publishes them.

A member limited to screens is resource_conflict: clear that scope first (DELETE /api/members/{user_id}/screen-scope).

Makes an uploader a full member again, who does not approve reviews (turn that on with setDashboardMemberApprover). The project owner, or a member who administers the project's organization, only; a member who is not an uploader is left as they are. Appends project.member_upload_scope_changed with upload_scope null.