Authentication
Management API calls use Authorization: Bearer sk_live_* or Authorization: Bearer sk_test_*. Keys are scoped to the resolved Tenant. Organization resources additionally verify that the requested Organization belongs to that Tenant.
curl https://xid.dev/v1/users \
-H 'Authorization: Bearer sk_live_xxx'Resources
| Resource | Capabilities | Status |
|---|---|---|
/v1/users |
Create, read, update, ban, unban, export, and remove users. | Implemented |
/v1/organizations |
Manage organizations, domains, branding, and settings. | Implemented |
/v1/organizations/:orgId/memberships |
List, create, update role, and remove members. | Implemented |
/v1/organizations/:orgId/invitations |
Create (with bulk limit), revoke, and list invitations. | Implemented |
/v1/sessions |
List, get, and revoke user sessions. | Implemented |
/v1/applications |
Register OAuth clients, redirect URIs, grants, token policy, and secrets. | Implemented |
/v1/connections |
Manage upstream enterprise SSO connections. | Implemented |
/v1/directories |
Create SCIM directories and rotate directory tokens. | Implemented |
/v1/roles |
Create, read, update, and delete custom roles. | Implemented |
/v1/permissions |
Create, read, update, and delete permissions. | Implemented |
/v1/project-grants |
Create, list, get, revoke, and delete project grants. | Implemented |
/v1/user-grants |
Assign, list, get, revoke, and delete scoped user grants. | Implemented |
/v1/organizations/:orgId/domains |
List, create, and remove organization domains. | Implemented |
/v1/organizations/:orgId/custom-hostnames |
Create, inspect, refresh, and remove custom hostnames. | Implemented |
/v1/organizations/:orgId/audit-events |
Read organization audit events with cursor pagination. | Implemented |
/v1/webhooks |
Create, list, update, and delete webhook endpoints. | Implemented |
/v1/api-keys |
Create, list, and revoke organization API keys. | Implemented |
/v1/organizations/:orgId/scim-targets |
Create, update, sync, and remove outbound SCIM targets. | Implemented |
Pagination and errors
List endpoints return a data array and cursor metadata. Errors use structured JSON with a stable code, a human-readable message, and optional metadata for field validation.