Skip to main content

API Overview

The Management API lets you automate the operations you would otherwise perform in the console’s team pages — inviting members, changing roles, issuing and rotating API keys, and reading usage — without a browser session. Use it for onboarding/offboarding automation, key-rotation pipelines, and usage reporting.

API Sections

Team

Read team info and rename the team (owner only).

API Keys

List, create, rotate and revoke API keys — read endpoints never return the key value.

Members

Read the roster, change roles, remove members.

Invitations

Invite by email, list invitations, revoke pending ones.

Usage

Quota snapshot and per-model consumption over a period.
Deliberately not available: creating or deleting teams, transferring ownership, and changing billing — these remain console-only, human-confirmed operations.

Usage Notes

Response format, pagination and error codes are covered in Overview and Errors. Three things are worth knowing about these endpoints:

Permissions

Endpoints document their required permission as resource:action (for example member:invite). The key acts with its creator’s role — a key created by a team admin can do what that admin can do. If the creator loses a permission (or leaves the team), their keys lose it too. A key that authenticates but lacks the permission gets 403 with ACCESS_DENIED.

Idempotency

Write endpoints accept an optional Idempotency-Key header (any unique string, e.g. a UUID). Retrying with the same value replays the first result instead of repeating the side effect — for key rotation this is the difference between “got the same new key again” and “invalidated the key I just saved”. Replays carry an Idempotency-Replayed: true response header. Rate-limit rejections (429) are never replayed, so a backoff-and-retry loop works with a stable key.

Rate Limits

Next Steps

Team

Start with GET /team — read your team and your key’s role

Authentication

Obtain an API key and make your first request