Authentication
Management API calls use Authorization: Bearer sk_live_* orAuthorization: Bearer sk_test_*. Keys are scoped per organization and checked before every resource action.
curl https://xid.dev/v1/users \
-H 'Authorization: Bearer sk_live_xxx'Resources
| Resource | Capabilities | Status |
|---|---|---|
/v1/users |
Create, read, update, ban, unban, export, and remove users. | Implemented |
/v1/organizations |
Manage organizations, domains, branding, and settings. | Implemented |
/v1/organizations/:orgId/memberships |
List, create, update role, and remove members. | Implemented |
/v1/organizations/:orgId/invitations |
Create (with bulk limit), revoke, and list invitations. | Implemented |
/v1/sessions |
List, get, and revoke user sessions. | Implemented |
/v1/applications |
Register OAuth clients, redirect URIs, grants, token policy, and secrets. | Implemented |
/v1/connections |
Manage upstream enterprise SSO connections. | Implemented |
/v1/directories |
Create SCIM directories and rotate directory tokens. | Implemented |
/v1/roles |
Create, read, update, and delete custom roles. | Implemented |
/v1/permissions |
Create, read, update, and delete permissions. | Implemented |
/v1/users/:userId/emailAddresses |
Add, remove, and set primary email addresses. | Implemented |
/v1/users/:userId/phoneNumbers |
Add, remove, and set primary phone numbers. | Implemented |
/v1/allowlist-identifiers |
Create, delete, and list allowed email or domain identifiers. | Implemented |
/v1/oauth-applications |
Manage OAuth applications where XID acts as the identity provider. | Implemented |
/v1/redirect-urls |
Register and remove allowed redirect URL values. | Implemented |
/v1/webhooks |
Create, list, update, and delete webhook endpoints. | Implemented |
/v1/api-keys |
Create, list, and revoke organization API keys. | Implemented |
/v1/billing |
Read plans, manage subscriptions, and view payment history. | Planned |
Pagination and errors
List endpoints return a data array and cursor metadata. Errors use structured JSON with a stable code, a human-readable message, and optional metadata for field validation.