Codiumai API reference API

openapi: 3.2.0
info:
  title: Qodo API reference API
  version: '2026-09-03'
  description: Use the User management API to list, invite, update, and remove members in your Qodo organization.
servers:
- url: https://qodo-platform.{tenant}.st.qodo.ai
  description: Your Qodo single-tenant API host
  variables:
    tenant:
      default: your-tenant
      description: Replace this value with your Qodo tenant subdomain before sending a request.
security:
- bearerAuth: []
tags:
- name: API reference
  description: Manage registered users and pending invitations. Organization owner access is required.
paths:
  /platform/v1/admin/users:
    get:
      tags:
      - API reference
      summary: List organization members
      description: Lists registered users and pending invitations in the caller's workspace.
      operationId: listOrganizationMembers
      parameters:
      - $ref: '#/components/parameters/RequestId'
      - name: page
        in: query
        description: 1-based page number.
        schema:
          type: integer
          minimum: 1
          default: 1
      - name: page_size
        in: query
        description: Number of members per page.
        schema:
          type: integer
          minimum: 1
          maximum: 100
          default: 50
      - name: search
        in: query
        description: Filter by enterprise user name or email address.
        schema:
          type: string
          default: ''
      - name: team_id
        in: query
        description: Filter by team ID.
        schema:
          type: string
      - name: member_type
        in: query
        description: Filter by registered users or pending invitations.
        schema:
          $ref: '#/components/schemas/MemberType'
      responses:
        '200':
          description: A paginated list of members.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MemberPage'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/PortalRedirect'
        '422':
          $ref: '#/components/responses/ValidationError'
        '501':
          $ref: '#/components/responses/NotSupported'
        '503':
          $ref: '#/components/responses/Unavailable'
  /platform/v1/admin/users/{member_id}:
    parameters:
    - name: member_id
      in: path
      required: true
      description: The user's email address or the pending invitation ID.
      schema:
        type: string
    - $ref: '#/components/parameters/RequestId'
    get:
      tags:
      - API reference
      summary: Get a single member
      description: Returns a registered user or pending invitation in the caller's workspace.
      operationId: getOrganizationMember
      responses:
        '200':
          description: The requested member.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Member'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/PortalRedirect'
        '501':
          $ref: '#/components/responses/NotSupported'
        '503':
          $ref: '#/components/responses/Unavailable'
    patch:
      tags:
      - API reference
      summary: Update a member's role or team
      description: Updates a registered member's organization role, team role, or team. Send at least one field. Send `organization_permission` and `team_id` in separate requests. A team must belong to the caller's workspace, and a pending invitation cannot be updated. The last organization owner cannot be demoted.
      operationId: updateOrganizationMember
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateMemberRequest'
            examples:
              changeOrganizationRole:
                summary: Change the organization role
                value:
                  organization_permission: owner
              moveToTeam:
                summary: Move a member to a team
                value:
                  team_id: team-123
                  permission: user
      responses:
        '200':
          description: The changes applied to the member.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateMemberResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/PortalRedirect'
        '422':
          $ref: '#/components/responses/ValidationError'
        '501':
          $ref: '#/components/responses/NotSupported'
        '503':
          $ref: '#/components/responses/Unavailable'
    delete:
      tags:
      - API reference
      summary: Remove a member
      description: 'Removes a registered user or pending invitation from the caller''s workspace. In organizations that allow domain-based sign-up, a removed user can join again at the next sign-in.


        API-key revocation is not yet part of this operation. Do not use this endpoint as the only step in an automated offboarding workflow until Qodo confirms that API-key revocation is enabled for your deployment.'
      operationId: removeOrganizationMember
      responses:
        '200':
          description: Confirmation that the member was removed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoveMemberResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/PortalRedirect'
        '501':
          $ref: '#/components/responses/NotSupported'
        '503':
          $ref: '#/components/responses/Unavailable'
  /platform/v1/admin/invites:
    post:
      tags:
      - API reference
      summary: Invite users to the organization
      description: Creates one or more organization invitations. Each email domain must be registered to the organization. If you provide a team ID, the team must belong to the caller's workspace. Requests with more than two email addresses are processed in the background.
      operationId: inviteUsersToOrganization
      parameters:
      - $ref: '#/components/parameters/RequestId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InviteUsersRequest'
            example:
              emails:
              - developer@example.com
              - reviewer@example.com
              team_id: team-123
      responses:
        '200':
          description: The invitations were accepted for processing.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InviteUsersResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/PortalRedirect'
        '422':
          $ref: '#/components/responses/ValidationError'
        '501':
          $ref: '#/components/responses/NotSupported'
        '503':
          $ref: '#/components/responses/Unavailable'
components:
  schemas:
    InviteUsersResponse:
      type: object
      properties:
        message:
          type: string
        data:
          type: array
          items:
            type: object
      required:
      - message
      - data
    ValidationError:
      type: object
      properties:
        detail:
          type: array
          items:
            $ref: '#/components/schemas/ValidationErrorDetail'
      required:
      - detail
    GitProvider:
      type: string
      enum:
      - github
      - gitlab
      - bitbucket
      - azure
    TeamPermission:
      type: string
      enum:
      - owner
      - user
    OrganizationPermission:
      type: string
      enum:
      - owner
      - user
    MemberPage:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Member'
        total:
          type: integer
          minimum: 0
        page:
          type: integer
          minimum: 1
        size:
          type: integer
          minimum: 1
          maximum: 100
        pages:
          type: integer
          minimum: 0
      required:
      - items
      - total
      - page
      - size
      - pages
    HttpError:
      type: object
      properties:
        detail:
          oneOf:
          - type: string
          - type: object
            additionalProperties: true
      required:
      - detail
    MemberType:
      type: string
      enum:
      - user
      - invite
      description: Whether the member is a registered user or a pending invitation.
    ValidationErrorDetail:
      type: object
      properties:
        type:
          type: string
        loc:
          type: array
          items:
            oneOf:
            - type: string
            - type: integer
        msg:
          type: string
      required:
      - type
      - loc
      - msg
    RemoveMemberResponse:
      type: object
      properties:
        member_id:
          type: string
        message:
          type: string
      required:
      - member_id
      - message
    Team:
      type: object
      properties:
        id:
          type: string
        name:
          type:
          - string
          - 'null'
      required:
      - id
    UpdateMemberRequest:
      type: object
      description: Provide at least one field. Send `organization_permission` and `team_id` in separate requests.
      minProperties: 1
      additionalProperties: false
      not:
        type: object
        properties:
          organization_permission: {}
          team_id: {}
        required:
        - organization_permission
        - team_id
      properties:
        organization_permission:
          $ref: '#/components/schemas/OrganizationPermission'
        permission:
          $ref: '#/components/schemas/TeamPermission'
        team_id:
          type: string
          minLength: 1
          pattern: ^(?!\s*$)(?!\s*-\s*$).+
          description: A team in the caller's workspace.
    PortalRedirectError:
      type: object
      properties:
        detail:
          type: object
          properties:
            redirectTo:
              type: string
              format: uri
          required:
          - redirectTo
      required:
      - detail
    InviteUsersRequest:
      type: object
      properties:
        emails:
          type: array
          items:
            type: string
            format: email
          minItems: 1
          maxItems: 200
        team_id:
          type:
          - string
          - 'null'
          pattern: ^(?!\s*$)(?!\s*-\s*$).+
          description: A team in the caller's workspace.
      required:
      - emails
    Member:
      type: object
      properties:
        member_id:
          type: string
          description: Use this value in the get, update, and remove member endpoints.
        email:
          type: string
          format: email
        name:
          type:
          - string
          - 'null'
        type:
          $ref: '#/components/schemas/MemberType'
        last_login:
          type:
          - string
          - 'null'
          format: date-time
        team:
          type:
          - object
          - 'null'
          allOf:
          - $ref: '#/components/schemas/Team'
        team_role:
          type:
          - string
          - 'null'
          allOf:
          - $ref: '#/components/schemas/TeamPermission'
        is_organization_owner:
          type: boolean
        linked_git_accounts:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/GitProvider'
        enterprise_user_name:
          type:
          - string
          - 'null'
        baseUrl:
          type:
          - string
          - 'null'
      required:
      - member_id
      - email
      - type
      - team_role
      - is_organization_owner
    UpdateMemberResponse:
      type: object
      properties:
        member_id:
          type: string
        organization_permission:
          type:
          - string
          - 'null'
          allOf:
          - $ref: '#/components/schemas/OrganizationPermission'
        permission:
          type:
          - string
          - 'null'
          allOf:
          - $ref: '#/components/schemas/TeamPermission'
        team_id:
          type:
          - string
          - 'null'
      required:
      - member_id
  responses:
    PortalRedirect:
      description: The single-tenant identity flow returned another Qodo tenant host. Inspect `detail.redirectTo`, but do not forward credentials automatically.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PortalRedirectError'
    Unauthorized:
      description: The bearer credential or authenticated identity is invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HttpError'
    Forbidden:
      description: The caller is not an organization owner, lacks workspace context, or API access is not enabled for the organization.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HttpError'
    BadRequest:
      description: The requested member operation is not supported in the member's current state.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HttpError'
    ValidationError:
      description: Request validation failed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationError'
    Unavailable:
      description: API availability or authorization could not be verified.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HttpError'
    NotFound:
      description: The member or team was not found in the caller's workspace.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HttpError'
    NotSupported:
      description: The User management API is not supported for this deployment.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HttpError'
  parameters:
    RequestId:
      name: request-id
      in: header
      required: false
      description: A unique request ID generated by the client for request tracing.
      schema:
        type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: sk-
      description: 'A personal `sk-` API key that belongs to an organization owner. Send it as `Authorization: Bearer sk-...`. See [Set up the User management API](/account-management/user-management-api).'