/api/v1. Routes accept a project-scoped API key that
belongs to the project in the path or a personal access token. See
Authentication for scopes.
Invite roles are
admin, member, or viewer. Creating and revoking invites
also applies the app’s project-role authorization rules; an API key alone does
not bypass them.
Update a member role with { "role": "admin" }, { "role": "member" }, or
{ "role": "viewer" }. Owner role changes and ownership transfer are not
available through REST or MCP; use the guarded app workflow. Member removal is
permanent and clients should confirm the user’s intent before calling it.
The generated
OpenAPI JSON remains the
machine-readable source of truth for request and response schemas.