Members

The Members endpoints list the people in your organization, change their roles, suspend or restore them, and remove them. They follow exactly the same rules as Settings → Members in the Console, described in Organizations & roles. Use them to sync membership with your HR system, to run quarterly access reviews, or to offboard someone from a script.

If your identity provider manages users through directory sync (SCIM), prefer that: it already keeps members in step with your directory. These endpoints are for organizations that do not use directory sync, and for reading membership in either case.

Endpoints

Adding people is done with invites. Authenticate with an admin key and send syntic-beta: admin-2026-11-01.

The member object

{
  "id": "user_01J9Y0A2C4E6G8J0L2N4",
  "type": "user",
  "email": "dana@example.com",
  "name": "Dana Lee",
  "role": "developer",
  "status": "active",
  "mfa_enabled": true,
  "workspaces": [{ "workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q", "role": "workspace_developer" }],
  "api_key_count": 3,
  "joined_at": "2026-02-10T14:00:00Z",
  "last_active_at": "2026-11-05T08:41:00Z"
}

List members

GET /v1/organizations/users

# Every active administrator and owner: a quick access review
for ROLE in primary_owner owner administrator; do
  curl -sS -G https://app.syntic.ai/v1/organizations/users \
    -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
    -H "syntic-beta: admin-2026-11-01" \
    --data-urlencode "role=$ROLE" | jq -r '.data[] | [.email, .role, .last_active_at] | @tsv'
done

async function* allMembers() {
  let after
  do {
    const qs = new URLSearchParams({ limit: '100', ...(after && { after_id: after }) })
    const res = await fetch(`https://app.syntic.ai/v1/organizations/users?${qs}`, {
      headers: { Authorization: `Bearer ${process.env.SYNTIC_ADMIN_KEY}`, 'syntic-beta': 'admin-2026-11-01' },
    })
    const page = await res.json()
    yield* page.data
    after = page.has_more ? page.last_id : undefined
  } while (after)
}
 
for await (const m of allMembers()) {
  if (!m.mfa_enabled) console.log('No second factor:', m.email)
}

import os, requests
 
H = {"Authorization": f"Bearer {os.environ['SYNTIC_ADMIN_KEY']}", "syntic-beta": "admin-2026-11-01"}
 
def all_members():
    params = {"limit": 100}
    while True:
        page = requests.get("https://app.syntic.ai/v1/organizations/users", headers=H, params=params).json()
        yield from page["data"]
        if not page["has_more"]:
            return
        params["after_id"] = page["last_id"]
 
for m in all_members():
    if not m["mfa_enabled"]:
        print("No second factor:", m["email"])

Change role or status

POST /v1/organizations/users/{user_id}

The rules are the Console’s:

• A key created by an Administrator can change a developer or custom member, including promoting them to administrator. Changing another Administrator’s role needs a key created by an Owner.
• Owners and the primary owner cannot be suspended, demoted or removed through the API.
• Suspending a member makes their inference keys fail with 403 org_membership_required at once; restoring them brings the keys back.

curl -sS -X POST https://app.syntic.ai/v1/organizations/users/user_01J9Y0A2C4E6G8J0L2N4 \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -H "syntic-beta: admin-2026-11-01" \
  -d '{"role": "administrator"}'

Changes are recorded as member.change_role, member.suspended or member.restored audit events.

Remove a member

DELETE /v1/organizations/users/{user_id} sets status to removed. The person loses access at once and their keys stop working, but nothing is deleted: a removed member can be restored with {"status": "active"}. Before removing someone, list their keys with API key management (created_by=<user_id>) and replace any that production depends on.

Response: the member object with status: "removed".

Errors

Errors use the error envelope.

Build notes for the platform team

• Wrap the existing organization admin, member status and seat functions, and share role logic with the shared org-role helper so the API and Console cannot disagree.
• last_active_at comes from the latest sign-in or authenticated request, updated at most once an hour.

Related

• Invites
• Workspaces
• Organizations & roles
• Audit feed