OpenAPI Specification
openapi: 3.1.0
info:
title: LaserData Cloud Audit Account Members API
description: 'Tenant audit log and per-user activity feed.
Public REST API for the LaserData Cloud audit service.
## Authentication
Every endpoint accepts either of two auth methods:
- **API key** (machine / CI / SDK): send in the `ld-api-key` header. Cannot be used on `GET /audit/users/activity` which is session-only.
- **Session cookie** (browser / console): obtained from `POST /account/sign_in` on the control plane.
Audit endpoints are read-only and replay-safe by definition.
## Pagination
List endpoints return a `Paged<T>` body (`page`, `total_pages`, `total_results`, `items`) and a `link` header (RFC 8288) with `rel="first"`, `"prev"`, `"next"`, `"last"` when applicable.
## Errors
Error responses follow RFC 7807 `application/problem+json` with `type`, `title`, `code`, `reason`, `instance`, `status`, `retryable`, and optional `field` / `field_issues`. `retryable` is `true` for 408, 425, 429, 500, 502, 503, 504.
## Response headers
- `ld-request`: request ID. Include it when reporting issues.
- `link`: pagination relations.
- `retry-after`: wait hint on 429 / 503.'
termsOfService: https://laserdata.com/terms
contact:
name: LaserData Support
url: https://docs.laserdata.com
email: support@laserdata.com
license:
name: Proprietary
version: 0.0.66
x-logo:
url: https://assets.laserdata.com/laserdata_dark.png
altText: LaserData
href: https://laserdata.com
servers:
- url: https://api.laserdata.cloud
description: Production
security:
- ld_api_key: []
- session_cookie: []
tags:
- name: Members
description: Tenant members
paths:
/tenants/{tenant_id}/members:
get:
tags:
- Members
summary: List members
description: Returns paginated tenant members with role + permission summary per member. Filter by active status via the `active` query parameter.
operationId: get_members
parameters:
- name: tenant_id
in: path
description: Tenant identifier
required: true
schema:
$ref: '#/components/schemas/TenantId'
- name: active
in: query
required: false
schema:
type:
- boolean
- 'null'
- name: page
in: query
required: false
schema:
type:
- integer
- 'null'
format: int64
minimum: 1
example: 1
- name: results
in: query
required: false
schema:
type:
- integer
- 'null'
format: int64
minimum: 1
example: 10
responses:
'200':
description: Paged members
content:
application/json:
schema:
$ref: '#/components/schemas/Paged_MemberDetails'
'403':
description: Insufficient permissions
/tenants/{tenant_id}/members/all:
get:
tags:
- Members
summary: List all members
description: Returns every tenant member at once with minimal fields (id, email, name). Use for member picker UIs. For tenants with many members, prefer the paginated GET /tenants/{id}/members.
operationId: get_all_members
parameters:
- name: tenant_id
in: path
description: Tenant identifier
required: true
schema:
$ref: '#/components/schemas/TenantId'
responses:
'200':
description: All members
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/MemberInfo'
'403':
description: Insufficient permissions
/tenants/{tenant_id}/members/permissions:
get:
tags:
- Members
summary: Get permissions catalog
description: Returns the full catalog of permissions available in this tenant, grouped by scope (tenant / division / environment). Use to populate role-permission selectors.
operationId: get_permissions
parameters:
- name: tenant_id
in: path
description: Tenant identifier
required: true
schema:
$ref: '#/components/schemas/TenantId'
responses:
'200':
description: Available tenant permissions catalog
content:
application/json:
schema:
$ref: '#/components/schemas/TenantPermissions'
'403':
description: Insufficient permissions
/tenants/{tenant_id}/members/{member_id}:
put:
tags:
- Members
summary: Update member
description: Toggle active status or replace the member's role assignment. Setting `active = false` keeps the membership record but blocks sign-in to the tenant. Setting `roles` replaces the full set atomically.
operationId: update_member
parameters:
- name: tenant_id
in: path
description: Tenant identifier
required: true
schema:
$ref: '#/components/schemas/TenantId'
- name: member_id
in: path
description: Member user identifier
required: true
schema:
$ref: '#/components/schemas/UserId'
requestBody:
description: Partial update. Null or missing fields are unchanged
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateMember'
required: true
responses:
'204':
description: Member updated
'400':
description: Cannot update self or tenant owner
'403':
description: Insufficient permissions
'404':
description: Member not found
delete:
tags:
- Members
summary: Remove member
description: Removes the member's tenant membership. Cannot remove the tenant owner or yourself - use DELETE /tenants/{tenant_id}/membership for self-removal.
operationId: delete_member
parameters:
- name: tenant_id
in: path
description: Tenant identifier
required: true
schema:
$ref: '#/components/schemas/TenantId'
- name: member_id
in: path
description: Member user identifier
required: true
schema:
$ref: '#/components/schemas/UserId'
responses:
'204':
description: Member removed
'400':
description: Cannot delete yourself or the tenant owner
'403':
description: Insufficient permissions
'404':
description: Member not found
components:
schemas:
MemberInfo:
type: object
required:
- id
- email
- name
properties:
email:
$ref: '#/components/schemas/Email'
id:
$ref: '#/components/schemas/UserId'
name:
$ref: '#/components/schemas/FullName'
RoleId:
type: integer
format: int64
example: 7261845001236500000
minimum: 0
PermissionInfo:
type: object
required:
- key
- name
- resource
- description
properties:
description:
type: string
key:
type: string
name:
type: string
resource:
type: string
FullName:
type: string
example: Alice Doe
UpdateMember:
type: object
properties:
active:
type:
- boolean
- 'null'
roles:
type:
- array
- 'null'
items:
$ref: '#/components/schemas/RoleId'
TenantId:
type: integer
format: int64
example: 7261845022003200001
minimum: 0
Paged_MemberDetails:
type: object
required:
- total_pages
- total_results
- page
- items
properties:
items:
type: array
items:
type: object
required:
- id
- email
- name
- active
- roles
- created_at
properties:
active:
type: boolean
created_at:
type: string
format: date-time
description: Resource creation timestamp (RFC 3339 UTC).
example: '2026-05-20T10:00:00Z'
email:
$ref: '#/components/schemas/Email'
id:
$ref: '#/components/schemas/UserId'
name:
$ref: '#/components/schemas/FullName'
roles:
type: array
items:
type: string
description: 'Role names assigned to this member. System roles are `admin`, `developer`, `viewer`,
`billing`; tenants may also define custom roles via `POST /tenants/{tenant_id}/roles`.'
example:
id: 611298765432109069
email: alice@acme.com
name: Alice Doe
active: true
roles:
- developer
- billing
created_at: '2026-05-20T10:00:00Z'
page:
type: integer
format: int64
example: 1
minimum: 1
total_pages:
type: integer
format: int64
example: 4
minimum: 0
total_results:
type: integer
format: int64
example: 137
minimum: 0
UserId:
type: integer
format: int64
example: 7261844898910240000
minimum: 0
TenantPermissions:
type: object
required:
- tenant
- division
- environment
properties:
division:
type: array
items:
$ref: '#/components/schemas/PermissionInfo'
environment:
type: array
items:
$ref: '#/components/schemas/PermissionInfo'
tenant:
type: array
items:
$ref: '#/components/schemas/PermissionInfo'
Email:
type: string
example: alice@laserdata.com
securitySchemes:
ld_api_key:
type: apiKey
in: header
name: ld-api-key
description: Tenant API key sent in the ld-api-key request header. Scoped to tenant-level audit reads. Cannot be used on user-scope endpoints (`/audit/users/activity`).
session_cookie:
type: apiKey
in: cookie
name: session
description: Browser session cookie issued by POST /account/sign_in on core. Required for user-scope endpoints.
externalDocs:
url: https://docs.laserdata.com
description: LaserData Cloud documentation