Members API
REST endpoints for members in SKUFlow: 4 operations with parameters, request and response fields, permissions and curl examples.
Base URL: https://app.skuflow.ai/api. Every call needs Authorization: Bearer skf_… (Authentication); {organizationId} ($ORGANIZATION_ID in the examples) is your business's id.
| Operation | Endpoint | Risk |
|---|---|---|
| List the team (members and roles) | GET /organizations/{organizationId}/team | read |
| Invite someone to the team with a role | POST /organizations/{organizationId}/team/invitations | sensitive |
| Change a team member's role | PATCH /organizations/{organizationId}/team/{userId} | sensitive |
| Remove a team member | DELETE /organizations/{organizationId}/team/{userId} | sensitive |
List the team (members and roles)
GET /organizations/{organizationId}/team
Everyone in the organization with their role (owner, admin, staff, member), for any caller including API keys and AI apps. Each person's role is Base316's live one; someone removed elsewhere drops off. Emails only for callers with members.manage (else null, except your own). Use the user ids with team.changeRole and team.remove (from a key, team.changeRole waits for the person's approval). Read-only.
| Permission | members.read (Owner, Admin, Staff, Member) |
| Risk | read, OAuth scope skuflow.read. Read: reads only. |
| MCP tool | team_members (toolset team) |
Example
curl "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/team" \
-H "Authorization: Bearer $SKUFLOW_API_KEY"Response
200: the answer's fields
| Field | Type | Description |
|---|---|---|
members | array of object | |
members[].userId | string | |
members[].name | string or null | |
members[].email | string or null | |
members[].image | string or null | |
members[].role | object | |
members[].role.key | string | Base316 role key: owner, admin, staff or member. |
members[].role.name | string | |
members[].joinedAt | string | |
members[].isYou | boolean | Whether this member is the caller. |
Invite someone to the team with a role
POST /organizations/{organizationId}/team/invitations
Grants access: brings email into the organization with role. Makes a Base316 invitation, emails its acceptance link to the person from SKUFlow and returns the link once (emailed, else emailReason). An API key or AI app's call waits for the person's approval in SKUFlow first (428 APPROVAL_REQUIRED); once approved it makes the new person's account at once with the role (status ADDED, no email: send them url), and an email that already has an account is refused (409: a person invites existing accounts from Settings → Members). Only an owner can bring in an owner. Every person takes one of the plan's users (402 PLAN_LIMIT_REACHED when none is left).
| Permission | members.manage (Owner, Admin) |
| Risk | sensitive, OAuth scope skuflow.sensitive. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access. |
| MCP tool | team_invite (toolset team) |
| Approval | Waits for your approval in SKUFlow when called with an API key or a connected app: the first call answers 428 APPROVAL_REQUIRED; once you approve it, repeat the call with the X-SKUFlow-Approval header. See Approvals. |
Request body
| Field | Type | Required | Description |
|---|---|---|---|
email | string (email) | Yes | Who to invite. Up to 254 characters. |
role | enum | No | owner: Everything, including billing ownership and deleting the organization. admin: Everything except billing ownership and deleting the organization. staff: Runs the day: customers, requests, quotes, invoices, recording payments, products, online stores, designs and artwork, orders and the production board, stock and messages. No refunds, settings, supplier credentials or team changes. member: Read-only: sees the work, but not payments, settings or the activity log. One of owner, admin, staff, member. Default member. |
name | string | No | Their name, for a new account (API keys and AI apps). Up to 200 characters. |
Example
curl -X POST "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/team/invitations" \
-H "Authorization: Bearer $SKUFLOW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"email":"dana@example.com"}'Response
201: the answer's fields
| Field | Type | Description |
|---|---|---|
status | enum | Invited: a Base316 invitation was made (signed-in person); url is its acceptance link, returned once. ADDED: an API key or AI app made a new account for the email and added it with the role; url is where they sign in (with a sign-in link or Forgot password). One of INVITED, ADDED. |
email | string | |
role | string | The role they join with. |
userId | string or null | The new member's user id (ADDED), else null until they accept. |
invitationId | string or null | |
url | string | Invited: the acceptance link, also emailed to the person. ADDED: where they sign in; nothing is emailed, so send it yourself. |
expiresAt | string or null | When the invitation link expires (INVITED). |
emailed | boolean | Whether SKUFlow emailed the acceptance link to the invited address (from SKUFlow, with the business's name and the role). |
emailReason | string or null | Why it was not emailed (then send url yourself); null when it was. |
Change a team member's role
PATCH /organizations/{organizationId}/team/{userId}
Grants or revokes access: gives the member another role, which changes what they may do at once (their sessions, API keys and AI apps follow within seconds). Only an owner can grant or take away owner; nobody changes their own role. An API key or AI app's call waits for the person's approval in SKUFlow first (428 APPROVAL_REQUIRED). Get user ids from team.members. Returns the member.
| Permission | members.manage (Owner, Admin) |
| Risk | sensitive, OAuth scope skuflow.sensitive. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access. |
| MCP tool | team_changeRole (toolset team) |
| Approval | Waits for your approval in SKUFlow when called with an API key or a connected app: the first call answers 428 APPROVAL_REQUIRED; once you approve it, repeat the call with the X-SKUFlow-Approval header. See Approvals. |
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
userId | path | string | Yes | The member's user id (from GET …/members). Up to 200 characters. |
Request body
| Field | Type | Required | Description |
|---|---|---|---|
role | enum | Yes | owner: Everything, including billing ownership and deleting the organization. admin: Everything except billing ownership and deleting the organization. staff: Runs the day: customers, requests, quotes, invoices, recording payments, products, online stores, designs and artwork, orders and the production board, stock and messages. No refunds, settings, supplier credentials or team changes. member: Read-only: sees the work, but not payments, settings or the activity log. One of owner, admin, staff, member. |
Example
curl -X PATCH "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/team/{userId}" \
-H "Authorization: Bearer $SKUFLOW_API_KEY" \
-H "Content-Type: application/json" \
-d '{"role":"owner"}'Response
200: the answer's fields
| Field | Type | Description |
|---|---|---|
userId | string | |
name | string or null | |
email | string or null | |
image | string or null | |
role | object | |
role.key | string | Base316 role key: owner, admin, staff or member. |
role.name | string | |
joinedAt | string | |
isYou | boolean | Whether this member is the caller. |
Remove a team member
DELETE /organizations/{organizationId}/team/{userId}
Revokes access: removes the person from the organization (their account and other organizations stay; their API keys and AI apps here stop working). Only an owner can remove an owner; nobody removes themselves this way. Their records (notes, jobs, time) stay. Get user ids from team.members.
| Permission | members.manage (Owner, Admin) |
| Risk | sensitive, OAuth scope skuflow.sensitive. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access. |
| MCP tool | team_remove (toolset team) |
| Approval | Over MCP, this tool always waits for your approval in SKUFlow. See Approvals. |
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
userId | path | string | Yes | The member's user id (from GET …/members). Up to 200 characters. |
Example
curl -X DELETE "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/team/{userId}" \
-H "Authorization: Bearer $SKUFLOW_API_KEY"Response
200: the answer's fields
| Field | Type | Description |
|---|---|---|
ok | true | |
userId | string |