Currents Organizations API

openapi: 3.2.0
info:
  title: Currents Dev Organizations API
  version: 1.0.0
  contact:
    name: Currents Support
    url: https://currents.dev
  description: 'Operations tagged Organizations across 2 of this provider''s published API definitions: currents-dev-openapi.json, currents-dev-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.currents.dev/v1
  description: Production API
- url: https://api-staging.currents.dev/v1
  description: Staging API
- url: http://localhost:4000/v1
  description: Local development
security:
- BearerAuth: []
tags:
- name: Organizations
  description: 'The organizations the authenticated user belongs to.


    Answers for the person an OAuth access token or personal access token was issued to, not for the organization. Organization API keys identify no user and are refused.'
paths:
  /me/organizations:
    get:
      summary: List my organizations
      description: 'List the organizations the authenticated user is a member of, with the user''s own role in each. The organization the token was issued for is marked `current`. Returns the organizations the OAuth organization selection screen offers, plus the token''s own organization: current memberships only, never another member''s. Membership is read on every request, so leaving an organization or a role change shows on the next call.


        Requires an OAuth access token or a personal access token. An organization API key identifies no user and is refused with 403 and code `user_credential_required`.'
      operationId: listMyOrganizations
      security:
      - BearerAuth: []
      - OAuth2:
        - projects:read
      tags:
      - Organizations
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MyOrganizationsResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
    servers:
    - url: https://api.currents.dev/v1
      description: Production API
    - url: https://api-staging.currents.dev/v1
      description: Staging API
    - url: http://localhost:4000/v1
      description: Local development
components:
  schemas:
    ErrorResponse:
      type: object
      required:
      - status
      - error
      properties:
        status:
          type: string
          enum:
          - FAILED
        error:
          type: string
          description: Error message
        code:
          type: string
          description: Stable machine-readable discriminator, present on refusals a client is expected to branch on (for example `AI_CONSENT_REQUIRED`). The `error` text is free-form; branch on `code`.
        candidates:
          type: array
          description: 'With `code: ambiguous_target`: the runs, spec files or tests the request matched. Send one of their IDs.'
          items:
            type: object
            properties:
              runId:
                type: string
              ciBuildId:
                type: string
              instanceId:
                type: string
              groupId:
                type: string
              spec:
                type: string
              machineId:
                type:
                - string
                - 'null'
              testId:
                type: string
              title:
                type: array
                items:
                  type: string
    MyOrganizationsResponse:
      type: object
      required:
      - status
      - data
      properties:
        status:
          type: string
          enum:
          - OK
        data:
          type: array
          description: Sorted by name.
          items:
            $ref: '#/components/schemas/MyOrganization'
    MyOrganization:
      type: object
      required:
      - orgId
      - name
      - role
      - current
      properties:
        orgId:
          type: string
          description: Organization ID. The same value as the `org_id` claim of an OAuth access token.
        name:
          type: string
          description: Organization display name
        role:
          type: string
          enum:
          - admin
          - actions_admin
          - member
          - guest
          description: The authenticated user's role in this organization. The same values as the `org_role` claim of an OAuth access token.
        current:
          type: boolean
          description: True for the organization the presented token was issued for.
  responses:
    Forbidden:
      description: 'The credential authenticated but is not permitted to use this endpoint. Five refusals share the status: a `read` API key on an endpoint that writes, an OAuth token that was not granted the scope the endpoint needs (`insufficient_scope`), an OAuth token that was granted it but whose holder no longer has a role permitting it (`insufficient_role`), an OAuth token on an endpoint that accepts an API key and nothing else (`api_key_required`), and an API key on an endpoint that answers for a user (`user_credential_required`). Discriminate on `code` rather than on the message, which is free-form. The first refusal predates the codes and sets none. Only `insufficient_scope` carries the challenge header, because it is the only one a client can act on by re-authorizing.'
      headers:
        WWW-Authenticate:
          description: 'Present on the `insufficient_scope` refusal only, naming the scope to re-authorize for (RFC 6750 3.1): `Bearer error="insufficient_scope", scope="webhooks:read"`. Absent on `insufficient_role`, where the scope is already granted, and on `api_key_required` and `user_credential_required`, where no scope would help.'
          schema:
            type: string
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            apiKeyIsReadOnly:
              summary: A read API key on an endpoint that writes
              value:
                status: FAILED
                error: 'Insufficient permissions: write access required'
            scopeNotGranted:
              summary: An OAuth token missing the endpoint's scope
              value:
                status: FAILED
                error: 'Insufficient permissions: this endpoint requires the webhooks:read scope'
                code: insufficient_scope
            scopeAboveRole:
              summary: An OAuth token holding the scope, whose holder was since demoted
              value:
                status: FAILED
                error: 'Insufficient permissions: the webhooks:write scope requires the admin role in this organization'
                code: insufficient_role
            apiKeyRequired:
              summary: An OAuth token on an endpoint that takes an API key
              value:
                status: FAILED
                error: This endpoint accepts an API key, not an OAuth access token
                code: api_key_required
            userCredentialRequired:
              summary: An API key on an endpoint that answers for a user
              value:
                status: FAILED
                error: This endpoint requires an OAuth access token or a personal access token; an API key belongs to an organization, not a user
                code: user_credential_required
    Unauthorized:
      description: Authentication failed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            status: FAILED
            error: Invalid authentication credentials
  securitySchemes:
    RecordKey:
      type: apiKey
      in: header
      name: x-currents-key
      description: An organization's record key, the one a reporter sends. Accepted only by the two attachment routes under `/runs`, `POST /runs/{runId}/context-links`, `POST /sessions`, `POST /sessions/{sessionId}/attachments` and, for a session, `POST /share`, so a CI job can attach files, link its failed and flaky tests, record a session and share it with the key it already has.
    BearerAuth:
      type: http
      scheme: bearer
      description: 'An organization API key, sent as `Authorization: Bearer <key>`. A key carries one scope for the whole API: a `read` key reaches the GET endpoints, a `write` key reaches all of them. A `crnts_pat_` personal access token is accepted as a Bearer while its owner remains an eligible administrator in its active organization. Each operation requires the corresponding scope stored on that token.'
    OAuth2:
      type: oauth2
      description: 'An access token from the Currents authorization server, for an application acting as a user in one organization. Unlike an API key it is confined per endpoint: the operation lists the scope it needs, and a token that was not granted that scope gets 403.


        **The endpoints below are production''s.** They are written out so this specification can be exercised against production, and they are wrong for every other deployment — a token minted by `id.currents.dev` is refused by a staging or on-premise API, whose `OAUTH_ISSUER` and `OAUTH_API_AUDIENCE` are its own. Against anything but production, and in a client generated from this document, discover them instead: `GET {api origin}/.well-known/oauth-protected-resource`, then the `authorization_servers[0]` document.


        **The audience named here is the REST API''s.** `POST /mcp` is a second resource server on the same origin, identified by `{api origin}/mcp` and described by its own document at `/.well-known/oauth-protected-resource/mcp`. Every operation below refuses a token minted for it, and it refuses every token minted for these, so a client of this specification wants the audience above and not that one.'
      flows:
        authorizationCode:
          authorizationUrl: https://id.currents.dev/api/auth/oauth2/authorize
          tokenUrl: https://id.currents.dev/api/auth/oauth2/token
          refreshUrl: https://id.currents.dev/api/auth/oauth2/token
          scopes:
            projects:read: See which projects exist and their names
            projects:write: Change project configuration, including a project's tags
            results:read: See runs, specs and failure detail — errors, stacks and artifacts
            analytics:read: 'See aggregate metrics: flake and failure rates, error counts, durations and trends'
            actions:read: See quarantine and skip rules, and the tests they affect
            actions:write: Create, edit, enable, disable and archive quarantine and skip rules
            issues:write: Create and link issues in a connected issue tracker, and list its projects and issue types
            runs:write: Cancel and reset runs, and permanently delete runs and their artifacts
            webhooks:read: See webhook configuration, including destination URLs and headers
            webhooks:write: Create, edit and delete webhooks
            shares:write: Create public links to test results that anyone with the link can open until they expire
x-refined-from:
- currents-dev-openapi.json
- currents-dev-openapi.yml