openapi: 3.2.0 info: title: 'GTM API public contract: gtm.service.id Team Members API' description: 'Identity, access and money: users, teams and members, API keys, OAuth clients and authorizations, billing products, subscriptions, transactions and payment methods, notifications, TLS certificates and support requests.' version: '1.0' contact: name: GTM API url: https://gtm-api.com email: support@gtm-api.com license: name: Proprietary url: https://gtm-api.com/license servers: - url: https://app.gtm-api.com/id/v4 description: Production, through the app.gtm-api.com gateway security: - BearerJwt: [] TeamSid: [] tags: - name: team_members description: Registry package `mcp.id/team_members`, served on MCP mount `id.identity`. paths: /api/team-members: post: operationId: create_team_member summary: Invite team member description: 'Invite a person by email. Born status=invited, user_sid=null, with a one-time code (+7d expiry); dispatches the invite email. permissions is the explicit token list validated against the catalog (403 grant_exceeds_ceiling when it exceeds the CALLER''s own grant; ''*'' is grantable only by the owner or a wildcard holder; can_view_teams is always added - the membership floor). account_sids is the optional profile slice (null/omitted = all team profiles; an explicit empty list is refused, and a sliced caller cannot grant beyond their own slice). Natural key (team, email) over live rows; re-inviting a live member returns already_exists:true. Contract: - MCP tool `create_team_member`, registry package `mcp.id/team_members`, mount `id.identity`. - Operation `create`, response envelope `create`. - Flags: none.' tags: - team_members requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateTeamMemberRequest' responses: '200': description: '`create` success envelope.' content: application/json: schema: $ref: '#/components/schemas/CreateTeamMemberResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: create_team_member x-gtm-mcp-mount: id.identity x-gtm-entity: team_members x-gtm-operation: create x-gtm-envelope: create x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/team-members/accept-invitation: post: operationId: accept_team_member_invitation summary: Accept team-member invitation description: 'Accept a pending invite by its one-time code. Public REST: code-bearer, no team scope. Hashes the code, matches the row it belongs to and branches on that row: invited → flips invited → active, binds the authenticated user_sid, and sets users.default_team_sid if the user had none; already active for the SAME user → 200 already_accepted:true naming that same invite; already redeemed by another account → 409 invitation_already_redeemed; no row (unknown, cancelled, or the membership was removed) → 404. An expired code is 409 invitation_expired, a seatless plan 402. Contract: - MCP tool `accept_team_member_invitation`, registry package `mcp.id/team_members`, mount `id.identity`. - Operation `action`, response envelope `action`. - Flags: none.' tags: - team_members requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AcceptTeamMemberInvitationRequest' responses: '200': description: '`action` success envelope.' content: application/json: schema: $ref: '#/components/schemas/AcceptTeamMemberInvitationResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: accept_team_member_invitation x-gtm-mcp-mount: id.identity x-gtm-entity: team_members x-gtm-operation: action x-gtm-envelope: action x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/team-members/search: post: operationId: search_team_members summary: Search team members description: 'List members and pending invites in the caller''s team: render the Members tab, find pending invites (filter.user_sid.is_null or filter.status.eq="invited"), or look up a member by email (q). include:["user"] hydrates the resolved profile (absent for pending invites). Returns a counts block. page_size:0 returns counts only. Contract: - MCP tool `search_team_members`, registry package `mcp.id/team_members`, mount `id.identity`. - Operation `search`, response envelope `search`. - Flags: read only.' tags: - team_members requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/SearchTeamMembersRequest' responses: '200': description: '`search` success envelope.' content: application/json: schema: $ref: '#/components/schemas/SearchTeamMembersResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: search_team_members x-gtm-mcp-mount: id.identity x-gtm-entity: team_members x-gtm-operation: search x-gtm-envelope: search x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/team-members/{sid}: patch: operationId: update_team_member summary: Update team member description: 'Re-scope an existing member: replace permissions and/or account_sids. email / status / user_sid / team_sid are read-only (rejected silently). At least one field with an ACTUAL change required (a value-identical PATCH answers 422 nothing_to_update). The change applies immediately: the member''s live tokens are invalidated and re-minted with the new grant on their next request (agents re-exchange). Bounded by the caller''s own grant (403 grant_exceeds_ceiling); the structural owner''s seat is not re-scopable (409 owner_cannot_be_rescoped - move ownership via transfer_team_ownership). Contract: - MCP tool `update_team_member`, registry package `mcp.id/team_members`, mount `id.identity`. - Operation `update`, response envelope `update`. - Flags: none.' tags: - team_members parameters: - name: sid in: path required: true description: Team-member (membership/invite) sid (ts_mb_…). schema: type: string minLength: 18 maxLength: 18 pattern: ^ts_mb_ description: Team-member (membership/invite) sid (ts_mb_…). requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/UpdateTeamMemberRequest' responses: '200': description: '`update` success envelope.' content: application/json: schema: $ref: '#/components/schemas/UpdateTeamMemberResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: update_team_member x-gtm-mcp-mount: id.identity x-gtm-entity: team_members x-gtm-operation: update x-gtm-envelope: update x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical delete: operationId: delete_team_member summary: Remove team member description: 'Remove a pending invite OR kick an active member: one tool, soft-delete. DESTRUCTIVE. The structural owner is protected (409 conflict, owner_cannot_be_removed); move ownership via transfer_team_ownership first. Kicking a member revokes their sessions in this team only. Contract: - MCP tool `delete_team_member`, registry package `mcp.id/team_members`, mount `id.identity`. - Operation `delete`, response envelope `delete_simple`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.' tags: - team_members parameters: - name: sid in: path required: true description: Path segment `{sid}`. schema: type: string minLength: 18 maxLength: 18 pattern: ^ts_mb_ responses: '200': description: '`delete_simple` success envelope.' content: application/json: schema: $ref: '#/components/schemas/DeleteTeamMemberResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: delete_team_member x-gtm-mcp-mount: id.identity x-gtm-entity: team_members x-gtm-operation: delete x-gtm-envelope: delete_simple x-gtm-availability: ga x-gtm-dangerous: true x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/team-members/{sid}/resend-invitation: post: operationId: resend_team_member_invitation summary: Resend team-member invitation description: 'Re-roll the one-time code on a pending invite, push its expiry (+7d), and re-send the invite email. Only valid on a status=invited row (else 409 invalid_transition). Contract: - MCP tool `resend_team_member_invitation`, registry package `mcp.id/team_members`, mount `id.identity`. - Operation `action`, response envelope `action`. - Flags: none.' tags: - team_members parameters: - name: sid in: path required: true description: Team-member (membership/invite) sid (ts_mb_…). schema: type: string minLength: 18 maxLength: 18 pattern: ^ts_mb_ description: Team-member (membership/invite) sid (ts_mb_…). responses: '200': description: '`action` success envelope.' content: application/json: schema: $ref: '#/components/schemas/ResendTeamMemberInvitationResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: resend_team_member_invitation x-gtm-mcp-mount: id.identity x-gtm-entity: team_members x-gtm-operation: action x-gtm-envelope: action x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: trivial components: schemas: McpError: type: object properties: success: type: boolean enum: - false error: type: object properties: code: type: string enum: - validation_failed - nothing_to_update - not_found - relation_not_found - invalid_transition - limit_exceeded - payment_required - duplicate_rejected - conflict - delete_blocked - unauthorized - forbidden - rate_limited - internal_error - service_unavailable - not_implemented message: type: string recoverable: type: boolean suggestion: type: string field_errors: type: object additionalProperties: type: array items: type: object properties: rule: type: string message: type: string required: - rule - message blockers: type: array items: type: object properties: type: type: string description: Machine-readable blocker type (active_flow, pending_tasks, …). severity: type: string enum: - hard - soft description: hard = external action required; soft = acknowledge is enough. description: type: string entity_sid: type: - string - 'null' count: type: integer resolution: type: string description: 'Hard: tool name to call. Soft: code for acknowledge[].' resolution_hint: type: string required: - type - severity - description - entity_sid - resolution - resolution_hint context: type: object additionalProperties: {} required: - code - message - recoverable meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - error DeleteTeamMemberResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - delete item: type: object additionalProperties: {} already_deleted: type: boolean soft_deleted: type: boolean retained: type: array items: type: string meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - already_deleted - soft_deleted - retained - meta SearchTeamMembersResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - search items: type: array items: type: object properties: item: type: object properties: sid: type: string team_sid: type: string user_sid: type: - string - 'null' email: type: string status: type: string enum: - invited - active - revoked permissions: type: array items: type: string account_sids: type: - array - 'null' items: type: string created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - user_sid - email - status - permissions - account_sids - created_by - created_at - updated_at - deleted_at included: type: object additionalProperties: {} required: - item - included pagination: type: object properties: next_cursor: type: - string - 'null' has_more: type: boolean total_count: type: - integer - 'null' required: - next_cursor - has_more - total_count applied_filters: type: object additionalProperties: {} includes: type: array items: type: string meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms counts: type: object properties: total_count: type: number groups: type: object additionalProperties: {} required: - total_count - groups required: - success - operation - items - pagination - applied_filters - includes - meta SearchTeamMembersRequest: type: object description: Request body of `search_team_members`. properties: filter: type: object properties: sid: type: object properties: eq: type: string in: type: array items: type: string additionalProperties: false user_sid: type: object properties: eq: type: string in: type: array items: type: string is_null: type: boolean additionalProperties: false description: is_null:true = pending invites (not yet accepted). email: type: object properties: eq: type: string in: type: array items: type: string additionalProperties: false status: type: object properties: eq: type: string enum: - invited - active - revoked ne: type: string enum: - invited - active - revoked in: type: array items: type: string enum: - invited - active - revoked nin: type: array items: type: string enum: - invited - active - revoked additionalProperties: false created_at: type: object properties: gte: type: string lte: type: string gt: type: string lt: type: string additionalProperties: false deleted_at: type: object properties: gte: type: string lte: type: string is_null: type: boolean additionalProperties: false description: 'Default scope is { is_null: true } (live rows).' q: type: string description: Full-text LIKE (prefix/infix) over member email. include: type: array items: type: string enum: - user description: Relations to eager-load (see entity Includes). sort: type: object properties: field: type: string enum: - created_at - updated_at - email direction: type: string enum: - asc - desc description: Default desc. required: - field page_size: type: integer minimum: 0 maximum: 500 description: 0..500, default 50. page_size=0 = count-only, page_size=1 = getFirst. cursor: type: - string - 'null' description: Opaque forward cursor from a previous response pagination.next_cursor. AcceptTeamMemberInvitationResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - action action: type: string description: kebab-case verb; matches the route segment. item: type: - object - 'null' properties: sid: type: string team_sid: type: string user_sid: type: - string - 'null' email: type: string status: type: string enum: - invited - active - revoked permissions: type: array items: type: string account_sids: type: - array - 'null' items: type: string created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - user_sid - email - status - permissions - account_sids - created_by - created_at - updated_at - deleted_at result: type: object additionalProperties: {} meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - action - item - result - meta ResendTeamMemberInvitationResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - action action: type: string description: kebab-case verb; matches the route segment. item: type: - object - 'null' properties: sid: type: string team_sid: type: string user_sid: type: - string - 'null' email: type: string status: type: string enum: - invited - active - revoked permissions: type: array items: type: string account_sids: type: - array - 'null' items: type: string created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - user_sid - email - status - permissions - account_sids - created_by - created_at - updated_at - deleted_at result: type: object additionalProperties: {} meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - action - item - result - meta CreateTeamMemberRequest: type: object description: Request body of `create_team_member`. properties: email: type: string maxLength: 255 format: email permissions: type: array items: type: string enum: - can_view_teams - can_manage_teams - can_view_team_members - can_manage_team_members - can_view_api_keys - can_manage_api_keys - can_view_oauth_clients - can_manage_oauth_clients - can_view_sessions - can_manage_sessions - can_view_account_shares - can_manage_account_shares - can_manage_account_transfers - can_view_billing - can_manage_billing - can_view_ssl_certificates - can_manage_ssl_certificates - can_view_notifications - can_manage_notifications - can_view_support_requests - can_manage_support_requests - can_view_linkedin_connections - can_act_linkedin_connections - can_view_linkedin_messages - can_act_linkedin_messages - can_act_linkedin_engagements - can_view_linkedin_searches - can_act_linkedin_searches - can_view_linkedin_enrichment - can_act_linkedin_enrichment - can_view_linkedin_accounts - can_update_linkedin_accounts - can_manage_linkedin_accounts - can_open_cloud_browser - can_change_proxy - can_edit_schedule - can_manage_smart_limits - can_manage_cloud_browser_external_links - can_share_vendor_profiles - can_act_linkedin_custom_requests - can_view_mass_actions - can_manage_mass_actions - can_view_webhooks - can_manage_webhooks - can_view_email_accounts - can_update_email_accounts - can_manage_email_accounts - can_view_email_messages - can_act_email_messages - can_view_email_engagements - can_view_email_suppressions - can_manage_email_suppressions - can_view_email_tracking_domains - can_manage_email_tracking_domains - can_view_email_sending_domains - can_manage_email_sending_domains - '*' description: Unified catalog tokens; the can_view_teams floor is always unioned in. account_sids: type: - array - 'null' items: type: string minLength: 18 maxLength: 18 pattern: ^ln_ac_ description: 'Connected-account sid (ln_ac_…): a member profile-slice entry.' minItems: 1 description: Profile slice; null/omitted = all team profiles. An empty list is refused (422). required: - email - permissions AcceptTeamMemberInvitationRequest: type: object description: Request body of `accept_team_member_invitation`. properties: code: type: string minLength: 1 maxLength: 255 description: Raw one-time invite code from the email link. required: - code CreateTeamMemberResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - create item: type: object properties: sid: type: string team_sid: type: string user_sid: type: - string - 'null' email: type: string status: type: string enum: - invited - active - revoked permissions: type: array items: type: string account_sids: type: - array - 'null' items: type: string created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - user_sid - email - status - permissions - account_sids - created_by - created_at - updated_at - deleted_at already_exists: type: boolean meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - already_exists - meta UpdateTeamMemberResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - update item: type: object properties: sid: type: string team_sid: type: string user_sid: type: - string - 'null' email: type: string status: type: string enum: - invited - active - revoked permissions: type: array items: type: string account_sids: type: - array - 'null' items: type: string created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string deleted_at: type: - string - 'null' required: - sid - team_sid - user_sid - email - status - permissions - account_sids - created_by - created_at - updated_at - deleted_at updated_fields: type: array items: type: string previous_values: type: object additionalProperties: {} meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - updated_fields - previous_values - meta UpdateTeamMemberRequest: type: object description: Request body of `update_team_member`. properties: permissions: type: array items: type: string enum: - can_view_teams - can_manage_teams - can_view_team_members - can_manage_team_members - can_view_api_keys - can_manage_api_keys - can_view_oauth_clients - can_manage_oauth_clients - can_view_sessions - can_manage_sessions - can_view_account_shares - can_manage_account_shares - can_manage_account_transfers - can_view_billing - can_manage_billing - can_view_ssl_certificates - can_manage_ssl_certificates - can_view_notifications - can_manage_notifications - can_view_support_requests - can_manage_support_requests - can_view_linkedin_connections - can_act_linkedin_connections - can_view_linkedin_messages - can_act_linkedin_messages - can_act_linkedin_engagements - can_view_linkedin_searches - can_act_linkedin_searches - can_view_linkedin_enrichment - can_act_linkedin_enrichment - can_view_linkedin_accounts - can_update_linkedin_accounts - can_manage_linkedin_accounts - can_open_cloud_browser - can_change_proxy - can_edit_schedule - can_manage_smart_limits - can_manage_cloud_browser_external_links - can_share_vendor_profiles - can_act_linkedin_custom_requests - can_view_mass_actions - can_manage_mass_actions - can_view_webhooks - can_manage_webhooks - can_view_email_accounts - can_update_email_accounts - can_manage_email_accounts - can_view_email_messages - can_act_email_messages - can_view_email_engagements - can_view_email_suppressions - can_manage_email_suppressions - can_view_email_tracking_domains - can_manage_email_tracking_domains - can_view_email_sending_domains - can_manage_email_sending_domains - '*' description: Full replacement; the can_view_teams floor is always unioned in. account_sids: type: - array - 'null' items: type: string minLength: 18 maxLength: 18 pattern: ^ln_ac_ description: 'Connected-account sid (ln_ac_…): a member profile-slice entry.' minItems: 1 description: null resets to "all profiles"; an empty list is refused (422). responses: McpServerError: description: MCP error envelope with `error.code` internal_error or service_unavailable. content: application/json: schema: $ref: '#/components/schemas/McpError' McpClientError: description: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented. content: application/json: schema: $ref: '#/components/schemas/McpError' securitySchemes: BearerJwt: type: http scheme: bearer bearerFormat: JWT description: Access token issued by gtm.service.id. Its `access_identity` claim carries `team_sid`, `actor_sid` and `actor_type`, and that team scope is authoritative. TeamSid: type: apiKey in: header name: Team-SID description: Team scope for tokens that do not carry one. Ignored when the token already names a team.