Users

The tenant's staff roster (team members). Read-only listing for assignee pickers and team views; readable by any authenticated staff member. Member management (role / status / removal) is admin-only.

📄️List staff (team roster)

Lists the current tenant's staff for assignee pickers and team views. Readable by ANY authenticated staff member (agents included) — assignment itself stays supervisor/admin. Defaults to ACTIVE staff only unless a `status` filter is given. Tenant-isolated; never exposes secrets.

📄️Change a member's role (admin only)

Changes a team member's role. ADMIN-ONLY. The workspace owner's seat cannot be demoted below admin, and the last active admin cannot be demoted (422 with a `role` field error).

📄️List custom roles (admin only)

The tenant's custom roles (RB-2) with their member counts. ADMIN-ONLY.

📄️Create a custom role (admin only)

Create a custom role (admin only)

📄️Update a custom role (admin only)

Update a custom role (admin only)

📄️Delete a custom role (admin only)

Deletes a custom role. Its members are moved to the role named by `reassign_to` (another custom role), or detached to their built-in base defaults when it is omitted.

📄️Set a member's permission overrides (admin only)

Sets a team member's per-user permission overrides (grant/revoke on top of their role). ADMIN-ONLY. Admin-reserved permissions (e.g. members.manage) are silently dropped from grants so no one can be escalated; a permission in both lists is treated as revoked.

📄️The permission catalogue (admin only)

Every granular permission with its UI group and admin-reserved flag, for the team permission editor.

📄️The feature and permission catalogue with plan availability (admin only)

Every feature with its group, dependencies, related quota keys and plan

📄️How automatic distribution treats a member

Whether the member receives routed work, their own cap on open

📄️Enable or disable a member (admin only)

Toggles a team member between `active` and `disabled`. ADMIN-ONLY. Disabling syncs the membership directory so the account can no longer log into this tenant. The owner and the last active admin are protected (422).

📄️Remove a member (admin only) — they become a former member

ADMIN-ONLY. The seat is NOT deleted (doc 100): it becomes a former member (status `removed`) so messages, notes and calls keep their author, while sign-in, tokens, devices, permissions, departments, routing and the seat on the plan all go, and the workspace leaves the account's switcher. The owner and the last active admin are protected (422). `mailbox_action` decides the member's personal mailbox: `archive` (default — switched off and sealed: nobody sees it, admins included, until the workspace owner hands it over or deletes it), `hand_over` (to `mailbox_target_user_id`, an active member without a mailbox; 422 on that field otherwise), or `delete` (the mailbox and its conversations; the real mailbox at the provider is untouched). A former member is never route-bound, so a second DELETE is 404.

📄️Hand over or delete a former member's archived mailbox (owner only)

The only way out of a sealed (archived) personal mailbox, and the WORKSPACE OWNER's alone (403 for anyone else). `hand_over` gives it, switched back on, to an active member without a mailbox of their own — the owner included; `delete` removes it and its conversations.