Users
The tenant's staff roster (team members). Read-only listing for assignee pickers and team views; readable by any authenticated staff member. Member management (role / status / removal) is admin-only.
List staff (team roster)
Lists the current tenant's staff for assignee pickers and team views. Readable by ANY authenticated staff member (agents included) — assignment itself stays supervisor/admin. Defaults to ACTIVE staff only unless a `status` filter is given. Tenant-isolated; never exposes secrets.
Change a member's role (admin only)
Changes a team member's role. ADMIN-ONLY. The workspace owner's seat cannot be demoted below admin, and the last active admin cannot be demoted (422 with a `role` field error).
List custom roles (admin only)
The tenant's custom roles (RB-2) with their member counts. ADMIN-ONLY.
Create a custom role (admin only)
Create a custom role (admin only)
Update a custom role (admin only)
Update a custom role (admin only)
Delete a custom role (admin only)
Deletes a custom role. Its members are moved to the role named by `reassign_to` (another custom role), or detached to their built-in base defaults when it is omitted.
Set a member's permission overrides (admin only)
Sets a team member's per-user permission overrides (grant/revoke on top of their role). ADMIN-ONLY. Admin-reserved permissions (e.g. members.manage) are silently dropped from grants so no one can be escalated; a permission in both lists is treated as revoked.
The permission catalogue (admin only)
Every granular permission with its UI group and admin-reserved flag, for the team permission editor.
The feature and permission catalogue with plan availability (admin only)
Every feature with its group, dependencies, related quota keys and plan
How automatic distribution treats a member
Whether the member receives routed work, their own cap on open
Enable or disable a member (admin only)
Toggles a team member between `active` and `disabled`. ADMIN-ONLY. Disabling syncs the membership directory so the account can no longer log into this tenant. The owner and the last active admin are protected (422).
Remove a member (admin only) — they become a former member
ADMIN-ONLY. The seat is NOT deleted (doc 100): it becomes a former member (status `removed`) so messages, notes and calls keep their author, while sign-in, tokens, devices, permissions, departments, routing and the seat on the plan all go, and the workspace leaves the account's switcher. The owner and the last active admin are protected (422). `mailbox_action` decides the member's personal mailbox: `archive` (default — switched off and sealed: nobody sees it, admins included, until the workspace owner hands it over or deletes it), `hand_over` (to `mailbox_target_user_id`, an active member without a mailbox; 422 on that field otherwise), or `delete` (the mailbox and its conversations; the real mailbox at the provider is untouched). A former member is never route-bound, so a second DELETE is 404.
Hand over or delete a former member's archived mailbox (owner only)
The only way out of a sealed (archived) personal mailbox, and the WORKSPACE OWNER's alone (403 for anyone else). `hand_over` gives it, switched back on, to an active member without a mailbox of their own — the owner included; `delete` removes it and its conversations.