Crevio Team API

openapi: 3.2.0
info:
  title: Crevio API V1 Team API
  version: 1.0.0
  description: 'API for the Crevio creator platform — a multi-tenant SaaS for digital product sales.

    Uses snake_case keys following Stripe conventions. All resource IDs are string IDs (e.g., "prod_abc123").


    Authentication is a bearer token: `Authorization: Bearer $CREVIO_API_KEY`.

    List endpoints are cursor-paginated with `limit` and `starting_after`.

    Writes accept an `Idempotency-Key` header and are safe to retry.


    Every response carries IETF RateLimit headers (`RateLimit`, `RateLimit-Policy`) so a client can

    self-throttle, and `Retry-After` on a 429. The quota is 600 requests per minute per credential.


    The API is versioned in the URL path (`/v1`). Nothing is removed without in-band warning: a

    deprecated operation is marked `"deprecated": true` here and serves `Deprecation` (RFC 9745),

    `Sunset` (RFC 8594) and `Link; rel="deprecation"` headers for at least six months before it

    stops answering. See https://crevio.co/docs/developer/guides/versioning.'
  contact:
    email: support@crevio.co
    name: Crevio Support
    url: https://crevio.co/docs
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  termsOfService: https://crevio.co/legal/terms-of-service
servers:
- url: https://api.crevio.co/v1
  description: Production
security:
- ApiKey: []
tags:
- name: Team
  description: Members, roles, credit limits and invitations
paths:
  /team:
    get:
      summary: Retrieve team settings
      description: What members without the admin role may do (`member_permissions`) and who may use the agent (`agent_access`). Both are changed in Settings → Team.
      operationId: getTeam
      x-crevio-sdk-method: get
      tags:
      - Team
      security:
      - ApiKey: []
      responses:
        '200':
          description: Team settings
          content:
            application/json:
              schema:
                type: object
                required:
                - object
                - member_permissions
                - agent_access
                properties:
                  object:
                    type: string
                    enum:
                    - team
                  member_permissions:
                    type: object
                    additionalProperties:
                      type: boolean
                    description: 'Switches for members without the admin role: `connect_integrations`, `edit_integrations`, `create_tasks`, `publish`.'
                  agent_access:
                    type: object
                    required:
                    - audience
                    - guests
                    - dm_scope
                    properties:
                      audience:
                        type: string
                        enum:
                        - everyone
                        - allowed
                        description: '`allowed`: only members on the agent''s allow list may use it.'
                      guests:
                        type: boolean
                        description: Whether people outside the team may use the agent in shared channels.
                      dm_scope:
                        type: string
                        enum:
                        - anyone
                        - team
                        description: Who may message the agent directly.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: allow
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.team.get();\n\n  console.log(result);\n}\n\nrun();"
  /team/members:
    get:
      summary: List team members
      description: 'Lists the account''s members: role, whether they count as a teammate, their place on the agent''s allow or block list and why the agent would refuse them, and each teammate''s credit limit and spend this billing cycle.'
      operationId: listTeamMembers
      x-crevio-sdk-method: listMembers
      tags:
      - Team
      security:
      - ApiKey: []
      responses:
        '200':
          description: Members
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponse_TeamMember'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: allow
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.team.listMembers();\n\n  console.log(result);\n}\n\nrun();"
  /team/members/{id}:
    patch:
      summary: Update a team member
      description: Changes a member's role or credit limit. `role` is `admin` or `member`; the owner keeps the admin role until ownership is transferred. `credit_cap` is the most credits the member's chats and tasks may use per billing cycle; `null` removes the limit. Only admins change the team, and an agent's call always asks the user first.
      operationId: updateTeamMember
      x-crevio-sdk-method: updateMember
      tags:
      - Team
      security:
      - ApiKey: []
      parameters:
      - name: id
        in: path
        required: true
        description: The member's user id (`user_...`) or email address.
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                role:
                  type: string
                  enum:
                  - admin
                  - member
                credit_cap:
                  type:
                  - integer
                  - 'null'
                  minimum: 0
                  description: Credits per billing cycle; null removes the limit.
      responses:
        '200':
          description: The updated member
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamMember'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: ask
      x-crevio-locked: true
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.team.updateMember({\n    id: \"<id>\",\n    requestBody: {},\n  });\n\n  console.log(result);\n}\n\nrun();"
    delete:
      summary: Remove a team member
      description: Removes a member from the account. The owner cannot be removed; transfer ownership first.
      operationId: removeTeamMember
      x-crevio-sdk-method: removeMember
      tags:
      - Team
      security:
      - ApiKey: []
      parameters:
      - name: id
        in: path
        required: true
        description: The member's user id (`user_...`) or email address.
        schema:
          type: string
      responses:
        '200':
          description: Member removed
          content:
            application/json:
              schema:
                type: object
                required:
                - id
                - object
                - deleted
                properties:
                  id:
                    type: string
                    description: The removed member's user id.
                  object:
                    type: string
                    enum:
                    - team_member
                  deleted:
                    type: boolean
                    enum:
                    - true
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: ask
      x-crevio-locked: true
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.team.removeMember({\n    id: \"<id>\",\n  });\n\n  console.log(result);\n}\n\nrun();"
  /team/members/{id}/transfer_ownership:
    post:
      summary: Transfer account ownership
      description: Makes another member the account owner. Only the current owner can do this, it cannot be undone by the caller, and it must be confirmed with the user first.
      operationId: transferOwnership
      x-crevio-sdk-method: transferOwnership
      tags:
      - Team
      security:
      - ApiKey: []
      parameters:
      - name: id
        in: path
        required: true
        description: The member's user id (`user_...`) or email address.
        schema:
          type: string
      - name: Idempotency-Key
        in: header
        required: false
        description: 'Makes this write safe to retry: a repeat with the same key replays the first response instead of creating a second resource. Scoped to the account, remembered for 24 hours; reusing a key with a different payload is an error.'
        schema:
          type: string
          maxLength: 255
        example: 1f7a4c2e-3b19-4a6d-9f0c-2ac81b5d7e33
      responses:
        '200':
          description: The new owner
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamMember'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: ask
      x-crevio-locked: true
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.team.transferOwnership({\n    id: \"<id>\",\n  });\n\n  console.log(result);\n}\n\nrun();"
  /team/invitations:
    get:
      summary: List pending invitations
      description: Lists invitations that have not been accepted yet.
      operationId: listTeamInvitations
      x-crevio-sdk-method: listInvitations
      tags:
      - Team
      security:
      - ApiKey: []
      responses:
        '200':
          description: Pending invitations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponse_TeamInvitation'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: allow
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.team.listInvitations();\n\n  console.log(result);\n}\n\nrun();"
    post:
      summary: Invite a team member
      description: 'Emails an invitation to join the account. Admin seats depend on the plan: a plan without team invitations answers 402. Only admins invite, and an agent''s call always asks the user first.'
      operationId: createTeamInvitation
      x-crevio-sdk-method: createInvitation
      tags:
      - Team
      security:
      - ApiKey: []
      parameters:
      - name: Idempotency-Key
        in: header
        required: false
        description: 'Makes this write safe to retry: a repeat with the same key replays the first response instead of creating a second resource. Scoped to the account, remembered for 24 hours; reusing a key with a different payload is an error.'
        schema:
          type: string
          maxLength: 255
        example: 1f7a4c2e-3b19-4a6d-9f0c-2ac81b5d7e33
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - email
              properties:
                email:
                  type: string
                  format: email
                role:
                  type: string
                  enum:
                  - admin
                  - member
                  default: member
      responses:
        '201':
          description: Invitation sent
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamInvitation'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '402':
          description: The plan does not include team invitations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: ask
      x-crevio-locked: true
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.team.createInvitation({\n    email: \"jane@example.com\",\n  });\n\n  console.log(result);\n}\n\nrun();"
  /team/invitations/{id}:
    delete:
      summary: Cancel an invitation
      description: Cancels a pending invitation, addressed by its email.
      operationId: deleteTeamInvitation
      x-crevio-sdk-method: deleteInvitation
      tags:
      - Team
      security:
      - ApiKey: []
      parameters:
      - name: id
        in: path
        required: true
        description: The invited email address.
        schema:
          type: string
      responses:
        '200':
          description: Invitation cancelled
          content:
            application/json:
              schema:
                type: object
                required:
                - email
                - object
                - deleted
                properties:
                  email:
                    type: string
                    description: The cancelled invitation's email.
                  object:
                    type: string
                    enum:
                    - team_invitation
                  deleted:
                    type: boolean
                    enum:
                    - true
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: ask
      x-crevio-locked: true
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.team.deleteInvitation({\n    id: \"<id>\",\n  });\n\n  console.log(result);\n}\n\nrun();"
  /team/invitations/{id}/resend:
    post:
      summary: Resend an invitation
      description: Emails a pending invitation again.
      operationId: resendTeamInvitation
      x-crevio-sdk-method: resendInvitation
      tags:
      - Team
      security:
      - ApiKey: []
      parameters:
      - name: id
        in: path
        required: true
        description: The invited email address.
        schema:
          type: string
      - name: Idempotency-Key
        in: header
        required: false
        description: 'Makes this write safe to retry: a repeat with the same key replays the first response instead of creating a second resource. Scoped to the account, remembered for 24 hours; reusing a key with a different payload is an error.'
        schema:
          type: string
          maxLength: 255
        example: 1f7a4c2e-3b19-4a6d-9f0c-2ac81b5d7e33
      responses:
        '200':
          description: Invitation resent
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamInvitation'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-crevio-approval: ask
      x-codeSamples:
      - lang: typescript
        label: Typescript (SDK)
        source: "import { Crevio } from \"@crevio/sdk\";\n\nconst crevio = new Crevio({\n  apiKey: process.env[\"CREVIO_API_KEY\"] ?? \"\",\n});\n\nasync function run() {\n  const result = await crevio.team.resendInvitation({\n    id: \"<id>\",\n  });\n\n  console.log(result);\n}\n\nrun();"
components:
  responses:
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: invalid_request_error
              code: forbidden
              message: You do not have permission to perform this action
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: invalid_request_error
              code: bad_request
              message: The request was malformed or contained invalid parameters
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
    Unauthorized:
      description: Authentication required
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: invalid_request_error
              code: authentication_required
              message: You did not provide an API key.
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: invalid_request_error
              code: resource_missing
              message: The requested resource was not found
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
    TooManyRequests:
      description: 'Rate limit exceeded — 600 requests per minute per owner on the free tier: every API key and OAuth token one person holds on an account shares one budget, and the account''s team keys share another. Retry after the number of seconds in `Retry-After`.'
      headers:
        Retry-After:
          $ref: '#/components/headers/RetryAfter'
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: invalid_request_error
              code: rate_limit_exceeded
              message: Too many requests. Please retry later.
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: api_error
              code: internal_error
              message: An unexpected error occurred
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
    UnprocessableEntity:
      description: Validation error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              type: validation_error
              code: validation_failed
              message: Email is required
              errors:
                email:
                - can't be blank
      headers:
        RateLimit:
          $ref: '#/components/headers/RateLimit'
        RateLimit-Policy:
          $ref: '#/components/headers/RateLimitPolicy'
        Request-Id:
          $ref: '#/components/headers/RequestId'
        Deprecation:
          $ref: '#/components/headers/Deprecation'
        Sunset:
          $ref: '#/components/headers/Sunset'
        Link:
          $ref: '#/components/headers/DeprecationLink'
  headers:
    Sunset:
      description: Present only on a deprecated operation. HTTP-date (RFC 8594) after which the operation stops responding. Always at least six months after `Deprecation`.
      schema:
        type: string
        examples:
        - Thu, 01 Oct 2026 00:00:00 GMT
    RequestId:
      description: Unique id for this request. Quote it when reporting a problem.
      schema:
        type: string
        examples:
        - 8fe045fe-cb8a-4407-a44d-5df60385e522
    DeprecationLink:
      description: Present only on a deprecated operation. `<url>; rel="deprecation"` pointing at the migration notes.
      schema:
        type: string
        examples:
        - <https://crevio.co/docs/developer/guides/versioning>; rel="deprecation"
    RetryAfter:
      description: Seconds to wait before retrying.
      schema:
        type: integer
        examples:
        - 11
    Deprecation:
      description: Present only on a deprecated operation. Structured-field date (RFC 9745) — `@` followed by the Unix timestamp at which the operation became deprecated.
      schema:
        type: string
        examples:
        - '@1775001600'
    RateLimit:
      description: 'Remaining quota for the current window, as an IETF structured field: `"default";r=<remaining>;t=<seconds until reset>`.'
      schema:
        type: string
        examples:
        - '"default";r=596;t=11'
    RateLimitPolicy:
      description: 'The quota this credential is subject to: `"default";q=<requests>;w=<window seconds>`.'
      schema:
        type: string
        examples:
        - '"default";q=600;w=60'
  schemas:
    TeamInvitation:
      type: object
      properties:
        object:
          type: string
        email:
          type: string
        role:
          type: string
        sent_at:
          type: string
      required:
      - object
      - email
      - role
      - sent_at
    ListResponse_TeamMember:
      type: object
      properties:
        object:
          type: string
          enum:
          - list
        data:
          type: array
          items:
            $ref: '#/components/schemas/TeamMember'
        has_more:
          type: boolean
        url:
          type: string
      required:
      - object
      - data
      - has_more
      - url
    TeamMember:
      type: object
      properties:
        object:
          type: string
        id:
          type: string
        email:
          type: string
        name:
          type:
          - string
          - 'null'
        role:
          type:
          - string
          - 'null'
        owner:
          type: boolean
        teammate:
          type: boolean
        agent_list:
          type:
          - string
          - 'null'
        agent_refusal:
          type:
          - string
          - 'null'
        credit_cap:
          type:
          - integer
          - 'null'
        credits_spent_this_cycle:
          type:
          - integer
          - 'null'
      required:
      - object
      - id
      - email
      - name
      - role
      - owner
      - teammate
      - agent_list
      - agent_refusal
      - credit_cap
      - credits_spent_this_cycle
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
              - api_error
              - invalid_request_error
              - validation_error
            code:
              type: string
            message:
              type: string
            param:
              type: string
            errors:
              type: object
            doc_url:
              type: string
          required:
          - type
          - message
      required:
      - error
    ListResponse_TeamInvitation:
      type: object
      properties:
        object:
          type: string
          enum:
          - list
        data:
          type: array
          items:
            $ref: '#/components/schemas/TeamInvitation'
        has_more:
          type: boolean
        url:
          type: string
      required:
      - object
      - data
      - has_more
      - url
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: Authorization
      description: 'API key in the format: Bearer {api_token}'
externalDocs:
  description: Crevio developer documentation
  url: https://crevio.co/docs/developer
x-mint:
  mcp:
    enabled: true
x-api-lifecycle:
  current_major_version: v1
  versioning_scheme: URL path
  deprecation_policy_url: https://crevio.co/docs/developer/guides/versioning
  minimum_notice_days: 183
  deprecation_headers:
  - Deprecation
  - Sunset
  - Link