openapi: 3.2.0 info: title: 'GTM API public contract: gtm.service.id Teams API' description: 'Identity, access and money: users, teams and members, API keys, OAuth clients and authorizations, billing products, subscriptions, transactions and payment methods, notifications, TLS certificates and support requests.' version: '1.0' contact: name: GTM API url: https://gtm-api.com email: support@gtm-api.com license: name: Proprietary url: https://gtm-api.com/license servers: - url: https://app.gtm-api.com/id/v4 description: Production, through the app.gtm-api.com gateway security: - BearerJwt: [] TeamSid: [] tags: - name: Teams description: Registry package `mcp.id/teams`, served on MCP mount `id.identity`. paths: /api/teams: post: operationId: create_team summary: Create team description: 'Create a new workspace. The caller becomes the owner AND the first member; the free "Sandbox" plan (forever free, 1 account slot, no card) is applied automatically where the owner does not already run a free workspace. Names are not unique: every call creates a new team (no dedup). Contract: - MCP tool `create_team`, registry package `mcp.id/teams`, mount `id.identity`. - Operation `create`, response envelope `create`. - Flags: none.' tags: - Teams requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateTeamRequest' responses: '200': description: '`create` success envelope.' content: application/json: schema: $ref: '#/components/schemas/CreateTeamResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: create_team x-gtm-mcp-mount: id.identity x-gtm-entity: teams x-gtm-operation: create x-gtm-envelope: create x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/teams/search: post: operationId: search_teams summary: Search teams description: 'List the caller''s teams ("my workspaces"): teams they are a member of, plus teams they own. Filter by status to find suspended workspaces, or by subscription_sid.is_null for teams with no capacity. q does an infix match on name. include[] hydrates subscription / owner / member counts. Returns a counts block. page_size:0 returns counts only. Contract: - MCP tool `search_teams`, registry package `mcp.id/teams`, mount `id.identity`. - Operation `search`, response envelope `search`. - Flags: read only.' tags: - Teams requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/SearchTeamsRequest' responses: '200': description: '`search` success envelope.' content: application/json: schema: $ref: '#/components/schemas/SearchTeamsResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: search_teams x-gtm-mcp-mount: id.identity x-gtm-entity: teams x-gtm-operation: search x-gtm-envelope: search x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/teams/{sid}: get: operationId: get_team summary: Get team description: 'Fetch a single team by sid, with optional includes (applied subscription, owner, member counts). Contract: - MCP tool `get_team`, registry package `mcp.id/teams`, mount `id.identity`. - Operation `get`, response envelope `get`. - Flags: read only.' tags: - Teams parameters: - name: sid in: path required: true description: Path segment `{sid}`. schema: type: string minLength: 18 maxLength: 18 pattern: ^ts_tm_ - name: include[] in: query required: false description: Query parameter `include`. style: form explode: true schema: type: array items: type: string enum: - subscription - owner - members_counts responses: '200': description: '`get` success envelope.' content: application/json: schema: $ref: '#/components/schemas/GetTeamResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: get_team x-gtm-mcp-mount: id.identity x-gtm-entity: teams x-gtm-operation: get x-gtm-envelope: get x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: trivial patch: operationId: update_team summary: Update team description: 'Rename a team or edit its config. Only name / config are mutable; owner_user_sid (transfer-ownership), status (derived), subscription_sid (apply/unapply) and limits (system) are read-only and silently rejected. At least one field required. Contract: - MCP tool `update_team`, registry package `mcp.id/teams`, mount `id.identity`. - Operation `update`, response envelope `update`. - Flags: none.' tags: - Teams parameters: - name: sid in: path required: true description: Team sid (ts_tm_…). schema: type: string minLength: 18 maxLength: 18 pattern: ^ts_tm_ description: Team sid (ts_tm_…). requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/UpdateTeamRequest' responses: '200': description: '`update` success envelope.' content: application/json: schema: $ref: '#/components/schemas/UpdateTeamResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: update_team x-gtm-mcp-mount: id.identity x-gtm-entity: teams x-gtm-operation: update x-gtm-envelope: update x-gtm-availability: ga x-gtm-dangerous: false x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical delete: operationId: delete_team summary: Delete team description: 'Cascade soft-delete a workspace and its owned rows (members, keys, sessions, oauth clients, certs). Owner-only. DESTRUCTIVE. Blocked (409 delete_blocked) while a paid applied subscription is live. Unapply/cancel it first; clear soft blockers (active keys / members) with acknowledge[]. Deleting the owner''s LAST workspace is allowed and leaves their ACCOUNT untouched: they are left with no workspace until their next sign-in provisions a replacement. Erasing an account is a separate deliberate act, never a side effect of this tool. There is no restore: the deleted workspace cannot be brought back, cascade.recovery_available_until is null, and its data is erased 30 days later. Contract: - MCP tool `delete_team`, registry package `mcp.id/teams`, mount `id.identity`. - Operation `delete`, response envelope `delete_cascade`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.' tags: - Teams parameters: - name: sid in: path required: true description: Path segment `{sid}`. schema: type: string minLength: 18 maxLength: 18 pattern: ^ts_tm_ - name: acknowledge[] in: query required: false description: Resolution codes for soft blockers the user confirmed. style: form explode: true schema: type: array items: type: string enum: - revoke_keys - remove_members description: Resolution codes for soft blockers the user confirmed. - name: next_default_team_sid in: query required: false description: Which of the caller's other live memberships becomes their working team afterwards; default is the oldest one. 422 if it is not an active membership of theirs in another live team. schema: type: string minLength: 18 maxLength: 18 pattern: ^ts_tm_ description: Which of the caller's other live memberships becomes their working team afterwards; default is the oldest one. 422 if it is not an active membership of theirs in another live team. responses: '200': description: '`delete_cascade` success envelope.' content: application/json: schema: $ref: '#/components/schemas/DeleteTeamResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: delete_team x-gtm-mcp-mount: id.identity x-gtm-entity: teams x-gtm-operation: delete x-gtm-envelope: delete_cascade x-gtm-availability: ga x-gtm-dangerous: true x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical /api/teams/{sid}/transfer-ownership: post: operationId: transfer_team_ownership summary: Transfer team ownership description: 'Move structural ownership of the team to another active member. Owner-only (an admin cannot transfer). Transferring to the current owner is a no-op. This is the only way to change owner_user_sid, and the prerequisite for the current owner to leave the team. Contract: - MCP tool `transfer_team_ownership`, registry package `mcp.id/teams`, mount `id.identity`. - Operation `action`, response envelope `action`. - Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.' tags: - Teams parameters: - name: sid in: path required: true description: Team sid (ts_tm_…). schema: type: string minLength: 18 maxLength: 18 pattern: ^ts_tm_ description: Team sid (ts_tm_…). requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/TransferTeamOwnershipRequest' responses: '200': description: '`action` success envelope.' content: application/json: schema: $ref: '#/components/schemas/TransferTeamOwnershipResponse' 4XX: $ref: '#/components/responses/McpClientError' 5XX: $ref: '#/components/responses/McpServerError' x-gtm-mcp-tool: transfer_team_ownership x-gtm-mcp-mount: id.identity x-gtm-entity: teams x-gtm-operation: action x-gtm-envelope: action x-gtm-availability: ga x-gtm-dangerous: true x-gtm-mass-action: false x-gtm-step-eligible: false x-gtm-schedule-required: false x-gtm-tool-class: typical components: schemas: TransferTeamOwnershipResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - action action: type: string description: kebab-case verb; matches the route segment. item: type: - object - 'null' properties: sid: type: string owner_user_sid: type: string subscription_sid: type: - string - 'null' name: type: string status: type: string enum: - active - suspended limits: type: object properties: accounts: type: number cloud_browser: type: number webhooks: type: number required: - accounts - cloud_browser - webhooks config: type: - object - 'null' properties: timezone: type: - string - 'null' description: IANA tz for team-scoped scheduling defaults. created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string data_deletion_at: type: - string - 'null' deletion_warned_at: type: - string - 'null' deleted_at: type: - string - 'null' required: - sid - owner_user_sid - subscription_sid - name - status - limits - config - created_by - created_at - updated_at - data_deletion_at - deletion_warned_at - deleted_at result: type: object additionalProperties: {} meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - action - item - result - meta TransferTeamOwnershipRequest: type: object description: Request body of `transfer_team_ownership`. properties: new_owner_user_sid: type: string minLength: 18 maxLength: 18 pattern: ^us_mb_ description: User sid (us_mb_…); must be an active member of this team. required: - new_owner_user_sid McpError: type: object properties: success: type: boolean enum: - false error: type: object properties: code: type: string enum: - validation_failed - nothing_to_update - not_found - relation_not_found - invalid_transition - limit_exceeded - payment_required - duplicate_rejected - conflict - delete_blocked - unauthorized - forbidden - rate_limited - internal_error - service_unavailable - not_implemented message: type: string recoverable: type: boolean suggestion: type: string field_errors: type: object additionalProperties: type: array items: type: object properties: rule: type: string message: type: string required: - rule - message blockers: type: array items: type: object properties: type: type: string description: Machine-readable blocker type (active_flow, pending_tasks, …). severity: type: string enum: - hard - soft description: hard = external action required; soft = acknowledge is enough. description: type: string entity_sid: type: - string - 'null' count: type: integer resolution: type: string description: 'Hard: tool name to call. Soft: code for acknowledge[].' resolution_hint: type: string required: - type - severity - description - entity_sid - resolution - resolution_hint context: type: object additionalProperties: {} required: - code - message - recoverable meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - error GetTeamResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - get item: type: object properties: sid: type: string owner_user_sid: type: string subscription_sid: type: - string - 'null' name: type: string status: type: string enum: - active - suspended limits: type: object properties: accounts: type: number cloud_browser: type: number webhooks: type: number required: - accounts - cloud_browser - webhooks config: type: - object - 'null' properties: timezone: type: - string - 'null' description: IANA tz for team-scoped scheduling defaults. created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string data_deletion_at: type: - string - 'null' deletion_warned_at: type: - string - 'null' deleted_at: type: - string - 'null' required: - sid - owner_user_sid - subscription_sid - name - status - limits - config - created_by - created_at - updated_at - data_deletion_at - deletion_warned_at - deleted_at included: type: object additionalProperties: {} includes: type: array items: type: string meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - included - includes - meta CreateTeamResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - create item: type: object properties: sid: type: string owner_user_sid: type: string subscription_sid: type: - string - 'null' name: type: string status: type: string enum: - active - suspended limits: type: object properties: accounts: type: number cloud_browser: type: number webhooks: type: number required: - accounts - cloud_browser - webhooks config: type: - object - 'null' properties: timezone: type: - string - 'null' description: IANA tz for team-scoped scheduling defaults. created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string data_deletion_at: type: - string - 'null' deletion_warned_at: type: - string - 'null' deleted_at: type: - string - 'null' required: - sid - owner_user_sid - subscription_sid - name - status - limits - config - created_by - created_at - updated_at - data_deletion_at - deletion_warned_at - deleted_at already_exists: type: boolean meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - already_exists - meta DeleteTeamResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - delete item: type: object additionalProperties: {} already_deleted: type: boolean soft_deleted: type: boolean cascade: type: - object - 'null' properties: summary: type: string details: type: array items: type: object properties: entity: type: string deleted: type: integer cancelled: type: integer required: - entity - deleted recovery_available_until: type: - string - 'null' required: - summary - details - recovery_available_until meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - already_deleted - soft_deleted - cascade - meta SearchTeamsRequest: type: object description: Request body of `search_teams`. properties: filter: type: object properties: sid: type: object properties: eq: type: string in: type: array items: type: string additionalProperties: false owner_user_sid: type: object properties: eq: type: string in: type: array items: type: string additionalProperties: false description: '"teams I own".' subscription_sid: type: object properties: eq: type: string in: type: array items: type: string is_null: type: boolean additionalProperties: false description: is_null:true = teams with no applied subscription. status: type: object properties: eq: type: string enum: - active - suspended ne: type: string enum: - active - suspended in: type: array items: type: string enum: - active - suspended additionalProperties: false q: type: string description: Full-text LIKE (prefix/infix) over team name. created_at: type: object properties: gte: type: string lte: type: string gt: type: string lt: type: string additionalProperties: false deleted_at: type: object properties: gte: type: string lte: type: string is_null: type: boolean additionalProperties: false description: 'Default scope is { is_null: true } (live rows).' include: type: array items: type: string enum: - subscription - owner - members_counts description: Relations to eager-load (see entity Includes). sort: type: object properties: field: type: string enum: - created_at - updated_at - name direction: type: string enum: - asc - desc description: Default desc. required: - field page_size: type: integer minimum: 0 maximum: 500 description: 0..500, default 50. page_size=0 = count-only, page_size=1 = getFirst. cursor: type: - string - 'null' description: Opaque forward cursor from a previous response pagination.next_cursor. UpdateTeamRequest: type: object description: Request body of `update_team`. properties: name: type: string minLength: 1 maxLength: 255 config: type: - object - 'null' properties: timezone: type: - string - 'null' description: IANA tz for team-scoped scheduling defaults. SearchTeamsResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - search items: type: array items: type: object properties: item: type: object properties: sid: type: string owner_user_sid: type: string subscription_sid: type: - string - 'null' name: type: string status: type: string enum: - active - suspended limits: type: object properties: accounts: type: number cloud_browser: type: number webhooks: type: number required: - accounts - cloud_browser - webhooks config: type: - object - 'null' properties: timezone: type: - string - 'null' description: IANA tz for team-scoped scheduling defaults. created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string data_deletion_at: type: - string - 'null' deletion_warned_at: type: - string - 'null' deleted_at: type: - string - 'null' required: - sid - owner_user_sid - subscription_sid - name - status - limits - config - created_by - created_at - updated_at - data_deletion_at - deletion_warned_at - deleted_at included: type: object additionalProperties: {} required: - item - included pagination: type: object properties: next_cursor: type: - string - 'null' has_more: type: boolean total_count: type: - integer - 'null' required: - next_cursor - has_more - total_count applied_filters: type: object additionalProperties: {} includes: type: array items: type: string meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms counts: type: object properties: total_count: type: number groups: type: object additionalProperties: {} required: - total_count - groups required: - success - operation - items - pagination - applied_filters - includes - meta UpdateTeamResponse: type: object properties: success: type: boolean enum: - true operation: type: string enum: - update item: type: object properties: sid: type: string owner_user_sid: type: string subscription_sid: type: - string - 'null' name: type: string status: type: string enum: - active - suspended limits: type: object properties: accounts: type: number cloud_browser: type: number webhooks: type: number required: - accounts - cloud_browser - webhooks config: type: - object - 'null' properties: timezone: type: - string - 'null' description: IANA tz for team-scoped scheduling defaults. created_by: type: object properties: actor_type: type: string enum: - user - support - api_key - system - agent actor_sid: type: - string - 'null' team_sid: type: string actor_name: type: - string - 'null' description: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job. oauth_client_sid: type: - string - 'null' description: The acting OAuth client (id_oc_*); null off the OAuth path. reason: type: - string - 'null' description: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise. permissions: type: object additionalProperties: {} description: 'Internal audit context: the grant set the actor held at write time. Not a contract.' cluster_id: type: - integer - 'null' description: 'Internal audit context: the cluster that served the write.' trace_id: type: - string - 'null' description: 'Internal audit context: the trace id of the request that wrote the row.' required: - actor_type - actor_sid - team_sid - permissions created_at: type: string updated_at: type: string data_deletion_at: type: - string - 'null' deletion_warned_at: type: - string - 'null' deleted_at: type: - string - 'null' required: - sid - owner_user_sid - subscription_sid - name - status - limits - config - created_by - created_at - updated_at - data_deletion_at - deletion_warned_at - deleted_at updated_fields: type: array items: type: string previous_values: type: object additionalProperties: {} meta: type: object properties: trace_id: type: string description: UUID v7; same 128-bit value as the X-Trace-Id header. span_id: type: string pattern: ^[0-9a-f]{16}$ description: 16 hex chars, root span of this request. timestamp: type: string description: ISO 8601 UTC (Y-m-dTH:i:sZ), response time. duration_ms: type: integer minimum: 0 description: Server-side wall clock. team_sid: type: - string - 'null' description: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends. actor_type: type: - string - 'null' description: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends. required: - trace_id - span_id - timestamp - duration_ms required: - success - operation - item - updated_fields - previous_values - meta CreateTeamRequest: type: object description: Request body of `create_team`. properties: name: type: string minLength: 1 maxLength: 255 config: type: - object - 'null' properties: timezone: type: - string - 'null' description: IANA tz for team-scoped scheduling defaults. description: Optional workspace settings; default null. required: - name responses: McpServerError: description: MCP error envelope with `error.code` internal_error or service_unavailable. content: application/json: schema: $ref: '#/components/schemas/McpError' McpClientError: description: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented. content: application/json: schema: $ref: '#/components/schemas/McpError' securitySchemes: BearerJwt: type: http scheme: bearer bearerFormat: JWT description: Access token issued by gtm.service.id. Its `access_identity` claim carries `team_sid`, `actor_sid` and `actor_type`, and that team scope is authoritative. TeamSid: type: apiKey in: header name: Team-SID description: Team scope for tokens that do not carry one. Ignored when the token already names a team.