---
title: "Management API"
description: "Use scoped API keys to manage organization resources from your backend."
locale: "en"
---

> Documentation Index
> Fetch the locale documentation index at: https://xid.dev/en/llms.txt
> Use this file to discover all available pages before exploring further.

# Management API

## Authentication

Management API calls use `Authorization: Bearer sk_live_*` or`Authorization: Bearer sk_test_*`. Keys are scoped per organization and checked before every resource action.

```shell
curl https://xid.dev/v1/users \
  -H 'Authorization: Bearer sk_live_xxx'
```

## Resources

| Resource | Capabilities | Status |
| --- | --- | --- |
| `/v1/users` | Create, read, update, ban, unban, export, and remove users. | Implemented |
| `/v1/organizations` | Manage organizations, domains, branding, and settings. | Implemented |
| `/v1/organizations/:orgId/memberships` | List, create, update role, and remove members. | Implemented |
| `/v1/organizations/:orgId/invitations` | Create (with bulk limit), revoke, and list invitations. | Implemented |
| `/v1/sessions` | List, get, and revoke user sessions. | Implemented |
| `/v1/applications` | Register OAuth clients, redirect URIs, grants, token policy, and secrets. | Implemented |
| `/v1/connections` | Manage upstream enterprise SSO connections. | Implemented |
| `/v1/directories` | Create SCIM directories and rotate directory tokens. | Implemented |
| `/v1/roles` | Create, read, update, and delete custom roles. | Implemented |
| `/v1/permissions` | Create, read, update, and delete permissions. | Implemented |
| `/v1/users/:userId/emailAddresses` | Add, remove, and set primary email addresses. | Implemented |
| `/v1/users/:userId/phoneNumbers` | Add, remove, and set primary phone numbers. | Implemented |
| `/v1/allowlist-identifiers` | Create, delete, and list allowed email or domain identifiers. | Implemented |
| `/v1/oauth-applications` | Manage OAuth applications where XID acts as the identity provider. | Implemented |
| `/v1/redirect-urls` | Register and remove allowed redirect URL values. | Implemented |
| `/v1/webhooks` | Create, list, update, and delete webhook endpoints. | Implemented |
| `/v1/api-keys` | Create, list, and revoke organization API keys. | Implemented |
| `/v1/billing` | Read plans, manage subscriptions, and view payment history. | Planned |

## Pagination and errors

List endpoints return a data array and cursor metadata. Errors use structured JSON with a stable code, a human-readable message, and optional metadata for field validation.

Source: https://xid.dev/management-api/index.mdx