/api/v1. All routes use a project-scoped API key -
Authorization: Bearer <api_key> - that must belong to the project in the
path. See Authentication for scopes.
Invite roles are
admin, member, or viewer. Creating and revoking invites
also applies the app’s project-role authorization rules; an API key alone does
not bypass them.
Update a member role with { "role": "admin" }, { "role": "member" }, or
{ "role": "viewer" }. Owner role changes and ownership transfer are not
available through REST or MCP; use the guarded app workflow. Member removal is
permanent and clients should confirm the user’s intent before calling it.
The generated OpenAPI document remains the
authoritative request and response schema.