OpenAPI Specification
openapi: 3.1.0
info:
title: LaserData Cloud Audit Account Invitations API
description: 'Tenant audit log and per-user activity feed.
Public REST API for the LaserData Cloud audit service.
## Authentication
Every endpoint accepts either of two auth methods:
- **API key** (machine / CI / SDK): send in the `ld-api-key` header. Cannot be used on `GET /audit/users/activity` which is session-only.
- **Session cookie** (browser / console): obtained from `POST /account/sign_in` on the control plane.
Audit endpoints are read-only and replay-safe by definition.
## Pagination
List endpoints return a `Paged<T>` body (`page`, `total_pages`, `total_results`, `items`) and a `link` header (RFC 8288) with `rel="first"`, `"prev"`, `"next"`, `"last"` when applicable.
## Errors
Error responses follow RFC 7807 `application/problem+json` with `type`, `title`, `code`, `reason`, `instance`, `status`, `retryable`, and optional `field` / `field_issues`. `retryable` is `true` for 408, 425, 429, 500, 502, 503, 504.
## Response headers
- `ld-request`: request ID. Include it when reporting issues.
- `link`: pagination relations.
- `retry-after`: wait hint on 429 / 503.'
termsOfService: https://laserdata.com/terms
contact:
name: LaserData Support
url: https://docs.laserdata.com
email: support@laserdata.com
license:
name: Proprietary
version: 0.0.66
x-logo:
url: https://assets.laserdata.com/laserdata_dark.png
altText: LaserData
href: https://laserdata.com
servers:
- url: https://api.laserdata.cloud
description: Production
security:
- ld_api_key: []
- session_cookie: []
tags:
- name: Invitations
description: Tenant invitations
paths:
/account/invitations:
get:
tags:
- Invitations
summary: List my invitations
description: 'Returns pending invitations addressed to the current user. Use to populate the console''s invitation inbox. Session-only: API keys are tenant-scoped and cannot list user invitations.'
operationId: get_invitations
parameters:
- name: page
in: query
required: false
schema:
type:
- integer
- 'null'
format: int64
minimum: 1
example: 1
- name: results
in: query
required: false
schema:
type:
- integer
- 'null'
format: int64
minimum: 1
example: 10
responses:
'200':
description: Paged invitations for current user
content:
application/json:
schema:
$ref: '#/components/schemas/Paged_InvitationInfo'
'401':
description: No active session
security:
- session_cookie: []
/account/invitations/{invitation_id}/accept:
put:
tags:
- Invitations
summary: Accept invitation
description: 'Accepts an invitation and creates the tenant membership. The user immediately has access according to the invitation''s role assignment. Session-only: API keys are tenant-scoped and cannot accept user invitations.'
operationId: accept_invitation
parameters:
- name: invitation_id
in: path
description: Invitation identifier
required: true
schema:
$ref: '#/components/schemas/InvitationId'
responses:
'201':
description: Invitation accepted
'404':
description: Invitation not found
'410':
description: Invitation expired
security:
- session_cookie: []
/account/invitations/{invitation_id}/reject:
put:
tags:
- Invitations
summary: Reject invitation
description: 'Declines an invitation. No membership is created. The inviter is notified. Session-only: API keys are tenant-scoped and cannot reject user invitations.'
operationId: reject_invitation
parameters:
- name: invitation_id
in: path
description: Invitation identifier
required: true
schema:
$ref: '#/components/schemas/InvitationId'
responses:
'201':
description: Invitation rejected
'404':
description: Invitation not found
security:
- session_cookie: []
/tenants/{tenant_id}/invitations:
get:
tags:
- Invitations
summary: List tenant invitations
description: Returns outstanding invitations sent from this tenant (pending / accepted / rejected). Filter via the underlying query params.
operationId: get_tenant_invitations
parameters:
- name: tenant_id
in: path
description: Tenant identifier
required: true
schema:
$ref: '#/components/schemas/TenantId'
- name: page
in: query
required: false
schema:
type:
- integer
- 'null'
format: int64
minimum: 1
example: 1
- name: results
in: query
required: false
schema:
type:
- integer
- 'null'
format: int64
minimum: 1
example: 10
responses:
'200':
description: Paged invitations for tenant
content:
application/json:
schema:
$ref: '#/components/schemas/Paged_TenantInvitationInfo'
'403':
description: Insufficient permissions
post:
tags:
- Invitations
summary: Invite member
description: Sends an invitation email. If the email already belongs to a registered user, the invitation appears in their /account/invitations list. Otherwise the invitee receives a sign-up link. Subject to tenant invitation policy (open / domain_only / block_external).
operationId: invite_member
parameters:
- name: tenant_id
in: path
description: Tenant identifier
required: true
schema:
$ref: '#/components/schemas/TenantId'
requestBody:
description: Email (required) + optional division scope + optional role ids
content:
application/json:
schema:
$ref: '#/components/schemas/InviteMember'
required: true
responses:
'201':
description: Invitation created
'400':
description: Invalid email, violates tenant invitation policy, already invited, or already a member
'403':
description: Insufficient permissions
/tenants/{tenant_id}/invitations/{invitation_id}:
delete:
tags:
- Invitations
summary: Delete invitation
description: Revokes an outstanding invitation. The invitee can no longer accept it. Use this to revoke before expiry if circumstances change.
operationId: delete_invitation
parameters:
- name: tenant_id
in: path
description: Tenant identifier
required: true
schema:
$ref: '#/components/schemas/TenantId'
- name: invitation_id
in: path
description: Invitation identifier
required: true
schema:
$ref: '#/components/schemas/InvitationId'
responses:
'204':
description: Invitation deleted
'403':
description: Insufficient permissions
'404':
description: Invitation not found
components:
schemas:
InvitationId:
type: integer
format: int64
example: 611298765432109070
minimum: 0
Paged_InvitationInfo:
type: object
required:
- total_pages
- total_results
- page
- items
properties:
items:
type: array
items:
type: object
required:
- id
- status
- tenant
- roles
properties:
id:
$ref: '#/components/schemas/InvitationId'
roles:
type: array
items:
type: string
description: 'Role names the invitee will receive on acceptance. System roles are `admin`,
`developer`, `viewer`, `billing`; tenants may also define custom roles via
`POST /tenants/{tenant_id}/roles`. Empty when the invitation grants no role.'
status:
$ref: '#/components/schemas/InvitationStatus'
tenant:
$ref: '#/components/schemas/TenantName'
example:
id: 7261845127892140000
status: pending
tenant: Acme
roles:
- developer
- billing
page:
type: integer
format: int64
example: 1
minimum: 1
total_pages:
type: integer
format: int64
example: 4
minimum: 0
total_results:
type: integer
format: int64
example: 137
minimum: 0
DivisionId:
type: integer
format: int64
example: 7261844974723780000
minimum: 0
RoleId:
type: integer
format: int64
example: 7261845001236500000
minimum: 0
TenantName:
type: string
example: acme-corp
InvitationStatus:
type: string
enum:
- pending
- accepted
- rejected
Paged_TenantInvitationInfo:
type: object
required:
- total_pages
- total_results
- page
- items
properties:
items:
type: array
items:
type: object
required:
- id
- status
- email
- roles
properties:
email:
$ref: '#/components/schemas/Email'
id:
$ref: '#/components/schemas/InvitationId'
roles:
type: array
items:
type: string
description: 'Role names the invitee will receive on acceptance. System roles are `admin`,
`developer`, `viewer`, `billing`; tenants may also define custom roles via
`POST /tenants/{tenant_id}/roles`. Empty when the invitation grants no role.'
status:
$ref: '#/components/schemas/InvitationStatus'
example:
id: 7261845127892140000
status: pending
email: invitee@acme.com
roles:
- developer
page:
type: integer
format: int64
example: 1
minimum: 1
total_pages:
type: integer
format: int64
example: 4
minimum: 0
total_results:
type: integer
format: int64
example: 137
minimum: 0
TenantId:
type: integer
format: int64
example: 7261845022003200001
minimum: 0
InviteMember:
type: object
required:
- email
properties:
division_id:
oneOf:
- type: 'null'
- $ref: '#/components/schemas/DivisionId'
email:
$ref: '#/components/schemas/Email'
roles:
type:
- array
- 'null'
items:
$ref: '#/components/schemas/RoleId'
Email:
type: string
example: alice@laserdata.com
securitySchemes:
ld_api_key:
type: apiKey
in: header
name: ld-api-key
description: Tenant API key sent in the ld-api-key request header. Scoped to tenant-level audit reads. Cannot be used on user-scope endpoints (`/audit/users/activity`).
session_cookie:
type: apiKey
in: cookie
name: session
description: Browser session cookie issued by POST /account/sign_in on core. Required for user-scope endpoints.
externalDocs:
url: https://docs.laserdata.com
description: LaserData Cloud documentation