Organisations
Organisation and member management
List organisations the current user can switch into
List organisations the current user can switch into. Each row is an organisation the caller holds an ACTIVE membership for, and the acting tenant's organisation comes first. Organisations in tenants that are not ACTIVE are omitted — including the acting one: PLT-477 gates both membership resolvers on tenant status, so a non-ACTIVE tenant can no longer be acted in at all and the earlier acting-tenant exemption is gone. The list is empty when the acting tenant contributes no visible organisation, even if other tenants did produce rows, so a foreign tenant can never occupy the first position. The payload is deliberately the switch-target projection (`id` and `name` only); use `GET /api/organisations/{id}` for the full organisation record.
Create a new organisation
Create a new organisation
Get organisation details
Get organisation details. This is the full organisation record, and the endpoint to use for the fields `GET /api/organisations` does not return — that list is the switch-target projection (`id` and `name` only). Access is the same audience as that list: the handler gates on an ACTIVE membership in the organisation (`resolveOrgAccess`), and the list only ever returns organisations you are an ACTIVE member of — so every caller affected by the narrowing can call this. The `org.settings.view` marker below describes the intended administrative permission; the GET handler does not currently enforce it.
Update organisation name
Update organisation name. Slug lives on identity.tenants and logo is not yet wired, so only the name field is persisted by this endpoint.
List organisation members
List organisation members
Add a member to the organisation
Add a member to the organisation
Remove a member from the organisation
Remove a member from the organisation
List roles in the organisation
List roles in the organisation. Requires an active membership; permissions and roles are resolved against that membership's TENANT, not the path organisation id, which the Directory schema does not guarantee to be equal. Callers with `org.roles.manage` receive full role objects (including permissions). Callers with only `org.invitations.manage` receive a minimal `{id, name}` projection suitable for role assignment in invitation flows.
Create a custom role
Create a custom role
Update a role (name, description, and/or permissions)
Update a role (name, description, and/or permissions)
Delete a non-system role
Delete a non-system role
List invitations for the organisation
List invitations for the organisation
Send an invitation
Send an invitation. With a `projectId` this invites an external collaborator onto that one project, accepts either `projects.collaborators.manage` or `org.invitations.manage`, and additionally requires that the caller can reach the project. Without a `projectId` it adds a member to the organisation and requires `org.invitations.manage` alone.
Revoke a pending invitation
Revoke a pending invitation