Team Members API

Invite collaborators to the account. Every member works in the account owner's organization. Their role and service allowlist limit their access.

Roles

• readonly - can read organization data and use approved service connections. Cannot connect, disconnect, or grant access to services.
• standard - can use approved service connections and manage service access. Cannot manage team members. This is the default role.
• admin - can manage team members, identity settings, and service access. Cannot regenerate the account owner's API key.

Each API route applies its own access rule. Every role also respects the member's allowed_connections list. Requests that use another service return 403.

• null - unrestricted access to every current and future connection
• [] - no service connection access
• ["scon_..."] - access only to those active connections on this account

Seat Limits

Seats include the account owner. An invitation fails with 403when the account has no available seat.

• Free - 2 seats
• Developer ($19/mo) - 3 seats, up to 5 with add-ons
• Pro ($99/mo) - 5 seats, up to 10 with add-ons
• Business ($349/mo) - 25 seats, unlimited with add-ons
• Enterprise - unlimited

Extra seats cost $15 per month.

Invite a Team Member

POST /v1/team/members

curl -X POST https://api.getstack.run/v1/team/members \
  -H "Authorization: Bearer $STACK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "developer@example.com",
    "name": "Jane Developer",
    "role": "standard",
    "allowed_connections": ["scon_slack_prod", "scon_github_ops"]
  }'

• email (string, required) - valid email address
• name (string, required) - display name, 1-100 characters
• role (enum, optional) - "readonly", "standard", or "admin". Default: "standard".
• allowed_connections (string[] | null, optional) - omit it or use null for unrestricted access; use [] for no service access; otherwise provide active connection IDs from this account.

Returns 201 with the invited member.

{
  "id": "mem_abc123",
  "operator_id": "op_xyz",
  "email": "developer@example.com",
  "name": "Jane Developer",
  "role": "standard",
  "status": "invited",
  "allowed_connections": ["scon_slack_prod", "scon_github_ops"],
  "invited_at": "2026-04-15T10:00:00Z",
  "joined_at": null,
  "revoked_at": null
}

List Team Members

GET /v1/team/members

Returns a bare array of member objects.

curl https://api.getstack.run/v1/team/members \
  -H "Authorization: Bearer $STACK_API_KEY"

Update a Team Member

PATCH /v1/team/members/:id

Change the role or replace the service allowlist. Changes apply immediately.

curl -X PATCH https://api.getstack.run/v1/team/members/mem_abc123 \
  -H "Authorization: Bearer $STACK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "role": "admin",
    "allowed_connections": ["scon_slack_prod", "scon_github_ops"]
  }'

• role (enum, optional) - "readonly", "standard", or "admin"
• allowed_connections (string[] | null, optional) - replacement allowlist. Use null for unrestricted access, [] for no service access, or omit the field to leave it unchanged.

Revoke a Team Member

DELETE /v1/team/members/:id

Revoke the member. Their dashboard session and OAuth refresh tokens stop working; prior audit attribution remains.

curl -X DELETE https://api.getstack.run/v1/team/members/mem_abc123 \
  -H "Authorization: Bearer $STACK_API_KEY"

{ "success": true }

Accept an Invitation

STACK emails the member a single-use link. Opening it activates the membership, creates a browser session, and opens the Console. The invitation endpoint is used by that page; it does not return an API key.

Connection Tracking

A service connection created by a member includes their member ID in connected_by.

Member Statuses

• invited - waiting for the member to accept
• active - accepted and able to authenticate
• revoked - access removed