API reference / Operations by tag

auth

62 operations. Base URL https://api.metrixed.com/v1; see authentication, errors and pagination.

Operations

Method	Path	Summary
GET	`/auth/accounts`	Portal users: the partner or advertiser accounts the user belongs to in this network (current = the account the session acts for)
GET	`/auth/api-keys`	List ApiKeys
POST	`/auth/api-keys`	Create ApiKey
GET	`/auth/api-keys/{id}`	Get ApiKey
PATCH	`/auth/api-keys/{id}`	Update ApiKey
DELETE	`/auth/api-keys/{id}`	Delete ApiKey
POST	`/auth/api-keys/{id}/rotate`	Rotate an API key (grace period)
POST	`/auth/api-keys/bulk/apply`	Bulk edit apply
POST	`/auth/api-keys/bulk/preview`	Bulk edit preview
POST	`/auth/api-keys/search`	Search ApiKeys (advanced)
GET	`/auth/impersonate`	Public: redeem a log-in-as link on the portal host (sets the session cookie, 302 to /)
POST	`/auth/invitations/accept`	Accept an invitation (creates user + membership)
POST	`/auth/login`	Login
POST	`/auth/logout`	Logout
GET	`/auth/me`	Current principal
POST	`/auth/mfa`	Verify MFA code
POST	`/auth/mfa/backup-codes`	Regenerate backup codes
POST	`/auth/mfa/confirm`	Confirm TOTP enrolment, returns backup codes
POST	`/auth/mfa/disable`	Disable MFA
POST	`/auth/mfa/enroll`	Start TOTP enrolment (secret + QR)
POST	`/auth/password/change`	Change own password
POST	`/auth/password/forgot`	Request password reset email
POST	`/auth/password/reset`	Reset password with emailed token
GET	`/auth/platform-impersonate`	Public: redeem a one-time platform impersonation link on the partner / advertiser portal host (sets the session cookie, 302 to /)
GET	`/auth/sessions`	List own active sessions
DELETE	`/auth/sessions/{id}`	Revoke a session
POST	`/auth/sessions/revoke-others`	Revoke all other sessions
POST	`/auth/sso/{id}/acs`	SAML assertion consumer service
GET	`/auth/sso/{id}/callback`	OIDC callback
GET	`/auth/sso/{id}/metadata`	SAML SP metadata
GET	`/auth/sso/{id}/start`	Begin SSO login (redirect to IdP)
GET	`/auth/sso/discover`	Enabled SSO connections for a tenant slug
POST	`/auth/switch-account`	Portal users: make this session act for another of the user's accounts (API keys and MCP tokens stay bound to the account they were created in)
GET	`/invitations`	List invitations
POST	`/invitations`	Invite a user (employee/partner/advertiser); the invitee is emailed a link to their own portal
DELETE	`/invitations/{id}`	Revoke invitation
POST	`/invitations/{id}/resend`	Resend invitation
GET	`/me/account-scope`	The caller's manager scope: restricted (role restricted to assigned accounts) and, when restricted, how many partners / advertisers / offers it sees
GET	`/me/api-keys`	Own API keys
POST	`/me/api-keys`	Create own API key
DELETE	`/me/api-keys/{id}`	Revoke own API key
DELETE	`/me/known-browsers/{id}`	Forget a known browser: the next sign-in from it sends the alert again
GET	`/me/notification-prefs`	Staff: my own email switches per notification kind (on top of the tenant matrix)
PUT	`/me/notification-prefs`	Staff: switch notification emails on or off for myself
GET	`/me/permissions`	Effective permission matrix + actions for UI gating
GET	`/me/sign-in-alerts`	New-browser sign-in alerts: whether the caller gets the email and the browsers already known (id is a short hash; current = this browser)
PUT	`/me/sign-in-alerts`	Turn the new-browser sign-in email on or off for the caller
GET	`/public/notify/unsubscribe`	Public: unsubscribe confirmation page for one kind of email (HTML; asks first so link scanners change nothing)
POST	`/public/notify/unsubscribe`	Public: one-click unsubscribe (RFC 8058 List-Unsubscribe-Post): switches the kind off in the recipient's own preferences (partner category, advertiser user kind, staff kind); 400 for security mail or a bad token, 404 when the recipient is unknown
GET	`/roles/meta`	Resources and special actions available to roles
GET	`/security/ip-allowlist`	Admin sign-in IP allow-list (empty = every address) and the caller's IP
PUT	`/security/ip-allowlist`	Replace the admin sign-in IP allow-list (max 100, normalised; refused when it would exclude the caller's own IP). Enforced at employee login and on every employee session
GET	`/security/logins`	Login history: every sign-in session of the workspace (staff, partner and advertiser users) with device, IP, method and status, newest first
GET	`/security/policy`	Tenant security policy
PATCH	`/security/policy`	Update tenant security policy
DELETE	`/security/sessions/{id}`	Revoke a user's active session (signs them out; audited as session.revoked)
GET	`/security/sso`	SSO connections
POST	`/security/sso`	Create SSO connection (SAML/OIDC)
PATCH	`/security/sso/{id}`	Update SSO connection
DELETE	`/security/sso/{id}`	Delete SSO connection
GET	`/team/members`	Employee members with role and MFA state
PATCH	`/team/members/{userId}`	Change member role/status

`GET /auth/accounts`

Portal users: the partner or advertiser accounts the user belongs to in this network (current = the account the session acts for)

Operation getAuthAccounts. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json PortalAccounts
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/accounts' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "principal_type": "",
  "current": "",
  "switchable": false,
  "data": [
    {}
  ]
}

`GET /auth/api-keys`

List ApiKeys List ApiKeys. WP-67: naturally small; returns at most 500 rows and capped: true when that cap is hit.

Operation getAuthApiKeys. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`page`	query	integer	no
`page_size`	query	integer	no
`sort`	query	string	no	field or -field
`include`	query	string	no	comma-separated relationships
`filter`	query	object (free-form)	no
`q`	query	string	no	free-text search

Status	Description	Body
200	ok	application/json ApiKeyList
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/api-keys?page=1&page_size=50' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "data": [
    {}
  ],
  "page": {}
}

`POST /auth/api-keys`

Create ApiKey

Operation postAuthApiKeys. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): ApiKeyCreate

Field	Type	Flags
`principal_type`	string
`principal_id`	string
`name`	string	required
`scopes`	array of string	required
`ip_allowlist`	array of string
`rate_limit_per_minute`	integer
`expires_at`	string (date-time)
`status`	string

Status	Description	Body
201	ok	application/json ApiKey
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/api-keys' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{"name":"","scopes":[""]}'

Example 201 response:

json

{
  "external_ref": ""
}

`GET /auth/api-keys/{id}`

Get ApiKey

Operation getAuthApiKeysId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json ApiKey
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/api-keys/<id>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "external_ref": ""
}

`PATCH /auth/api-keys/{id}`

Update ApiKey

Operation patchAuthApiKeysId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Request body (application/json, required): ApiKeyUpdate

Field	Type	Flags	Description
`principal_type`	string
`principal_id`	string
`name`	string
`scopes`	array of string
`ip_allowlist`	array of string
`rate_limit_per_minute`	integer
`expires_at`	string (date-time)
`status`	string

Status	Description	Body
200	ok	application/json ApiKey
default	error	application/json Error

bash

curl -X PATCH 'https://api.metrixed.com/v1/auth/api-keys/<id>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{"principal_type":"","principal_id":"","name":"","scopes":[""]}'

Example 200 response:

json

{
  "external_ref": ""
}

`DELETE /auth/api-keys/{id}`

Delete ApiKey

Operation deleteAuthApiKeysId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
204	ok	application/json Ok
default	error	application/json Error

bash

curl -X DELETE 'https://api.metrixed.com/v1/auth/api-keys/<id>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 204 response:

json

{
  "ok": false
}

`POST /auth/api-keys/{id}/rotate`

Rotate an API key (grace period)

Operation postAuthApiKeysIdRotate. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/api-keys/<id>/rotate' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/api-keys/bulk/apply`

Bulk edit apply

Operation postAuthApiKeysBulkApply. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): BulkPatch

Field	Type	Flags	Description
`ids`	array of string	required
`patches`	array of object	required

Status	Description	Body
200	ok	application/json BulkPreview
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/api-keys/bulk/apply' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{"ids":[""],"patches":[{"field":"","value":{}}]}'

Example 200 response:

json

{
  "affected": 0,
  "changes": [
    {}
  ],
  "warnings": [
    ""
  ],
  "token": ""
}

`POST /auth/api-keys/bulk/preview`

Bulk edit preview

Operation postAuthApiKeysBulkPreview. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): BulkPatch

Field	Type	Flags	Description
`ids`	array of string	required
`patches`	array of object	required

Status	Description	Body
200	ok	application/json BulkPreview
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/api-keys/bulk/preview' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{"ids":[""],"patches":[{"field":"","value":{}}]}'

Example 200 response:

json

{
  "affected": 0,
  "changes": [
    {}
  ],
  "warnings": [
    ""
  ],
  "token": ""
}

`POST /auth/api-keys/search`

Search ApiKeys (advanced)

Operation postAuthApiKeysSearch. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): SearchRequest

Field	Type	Flags	Description
`filters`	array of object
`search`	string
`sort`	array of object (free-form)
`page`	integer
`page_size`	integer
`include`	array of string

Status	Description	Body
200	ok	application/json ApiKeyList
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/api-keys/search' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{"filters":[{}],"search":"","sort":[{}],"page":0}'

Example 200 response:

json

{
  "data": [
    {}
  ],
  "page": {}
}

`GET /auth/impersonate`

Public: redeem a log-in-as link on the portal host (sets the session cookie, 302 to /)

Operation getAuthImpersonate. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`token`	query	string	yes

Status	Description	Body
302	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/impersonate' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

`POST /auth/invitations/accept`

Accept an invitation (creates user + membership)

Operation postAuthInvitationsAccept. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/invitations/accept' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/login`

Operation postAuthLogin. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): LoginRequest

Field	Type	Flags
`email`	string	required
`password`	string	required
`tenant_slug`	string

Status	Description	Body
200	ok	application/json LoginResult
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/login' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{"email":"","password":""}'

Example 200 response:

json

{
  "mfa_required": false,
  "session_token": "",
  "user": {},
  "memberships": [
    {}
  ]
}

`POST /auth/logout`

Logout

Operation postAuthLogout. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/logout' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`GET /auth/me`

Current principal

Operation getAuthMe. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json LoginResult
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/me' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "mfa_required": false,
  "session_token": "",
  "user": {},
  "memberships": [
    {}
  ]
}

`POST /auth/mfa`

Verify MFA code

Operation postAuthMfa. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): LoginRequest

Field	Type	Flags
`email`	string	required
`password`	string	required
`tenant_slug`	string

Status	Description	Body
200	ok	application/json LoginResult
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/mfa' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{"email":"","password":""}'

Example 200 response:

json

{
  "mfa_required": false,
  "session_token": "",
  "user": {},
  "memberships": [
    {}
  ]
}

`POST /auth/mfa/backup-codes`

Regenerate backup codes

Operation postAuthMfaBackupCodes. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/mfa/backup-codes' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/mfa/confirm`

Confirm TOTP enrolment, returns backup codes

Operation postAuthMfaConfirm. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/mfa/confirm' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/mfa/disable`

Disable MFA

Operation postAuthMfaDisable. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/mfa/disable' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/mfa/enroll`

Start TOTP enrolment (secret + QR)

Operation postAuthMfaEnroll. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/mfa/enroll' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/password/change`

Change own password

Operation postAuthPasswordChange. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/password/change' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/password/forgot`

Request password reset email

Operation postAuthPasswordForgot. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/password/forgot' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/password/reset`

Reset password with emailed token

Operation postAuthPasswordReset. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/password/reset' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`GET /auth/platform-impersonate`

Public: redeem a one-time platform impersonation link on the partner / advertiser portal host (sets the session cookie, 302 to /)

Operation getAuthPlatformImpersonate. Auth: none (public endpoint).

Parameter	In	Type	Required	Description
`token`	query	string	yes

Status	Description	Body
302	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/platform-impersonate' \
  -H 'Accept: application/json'

`GET /auth/sessions`

List own active sessions

Operation getAuthSessions. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/sessions' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`DELETE /auth/sessions/{id}`

Revoke a session

Operation deleteAuthSessionsId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X DELETE 'https://api.metrixed.com/v1/auth/sessions/<id>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/sessions/revoke-others`

Revoke all other sessions

Operation postAuthSessionsRevokeOthers. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/sessions/revoke-others' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/sso/{id}/acs`

SAML assertion consumer service

Operation postAuthSsoIdAcs. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/sso/<id>/acs' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`GET /auth/sso/{id}/callback`

OIDC callback

Operation getAuthSsoIdCallback. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/sso/<id>/callback' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`GET /auth/sso/{id}/metadata`

SAML SP metadata

Operation getAuthSsoIdMetadata. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/sso/<id>/metadata' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`GET /auth/sso/{id}/start`

Begin SSO login (redirect to IdP)

Operation getAuthSsoIdStart. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/sso/<id>/start' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`GET /auth/sso/discover`

Enabled SSO connections for a tenant slug

Operation getAuthSsoDiscover. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/auth/sso/discover' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /auth/switch-account`

Portal users: make this session act for another of the user's accounts (API keys and MCP tokens stay bound to the account they were created in)

Operation postAuthSwitchAccount. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): SwitchAccountRequest

Field	Type	Flags	Description
`account_id`	string	required	account id or display id

Status	Description	Body
200	ok	application/json SwitchAccountResult
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/auth/switch-account' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{"account_id":""}'

Example 200 response:

json

{
  "current": "",
  "account": {}
}

`GET /invitations`

List invitations List invitations. WP-67: paged; q matches the email; state pending|expired|accepted|revoked; counts per state.

Operation getInvitations. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required
`q`	query	string	no
`page`	query	string	no
`page_size`	query	string	no
`sort`	query	string	no
`state`	query	string	no
`principal_type`	query	string	no

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/invitations?page=1&page_size=50' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /invitations`

Invite a user (employee/partner/advertiser); the invitee is emailed a link to their own portal

Operation postInvitations. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): InvitationCreate

Field	Type	Flags	Description
`email`	string (email)	required
`principal_type`	enum: `employee`, `partner`, `advertiser`
`principal_id`	string		partner or advertiser id (portal users)
`role_key`	string
`name`	string

Status	Description	Body
201	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/invitations' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{"email":"user@example.com"}'

Example 201 response:

json

{
  "ok": false
}

`DELETE /invitations/{id}`

Revoke invitation

Operation deleteInvitationsId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X DELETE 'https://api.metrixed.com/v1/invitations/<id>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /invitations/{id}/resend`

Resend invitation

Operation postInvitationsIdResend. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/invitations/<id>/resend' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`GET /me/account-scope`

The caller's manager scope: restricted (role restricted to assigned accounts) and, when restricted, how many partners / advertisers / offers it sees

Operation getMeAccountScope. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json AccountScope
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/me/account-scope' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "restricted": false,
  "employee_id": "",
  "partners": 0,
  "advertisers": 0
}

`GET /me/api-keys`

Own API keys

Operation getMeApiKeys. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/me/api-keys' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /me/api-keys`

Create own API key

Operation postMeApiKeys. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/me/api-keys' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`DELETE /me/api-keys/{id}`

Revoke own API key

Operation deleteMeApiKeysId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X DELETE 'https://api.metrixed.com/v1/me/api-keys/<id>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`DELETE /me/known-browsers/{id}`

Forget a known browser: the next sign-in from it sends the alert again

Operation deleteMeKnownBrowsersId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
204	ok	application/json Ok
default	error	application/json Error

bash

curl -X DELETE 'https://api.metrixed.com/v1/me/known-browsers/<id>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 204 response:

json

{
  "ok": false
}

`GET /me/notification-prefs`

Staff: my own email switches per notification kind (on top of the tenant matrix)

Operation getMeNotificationPrefs. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json MyNotificationPrefs
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/me/notification-prefs' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{}

`PUT /me/notification-prefs`

Staff: switch notification emails on or off for myself

Operation putMeNotificationPrefs. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): MyNotificationPrefsUpdate

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X PUT 'https://api.metrixed.com/v1/me/notification-prefs' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{}'

Example 200 response:

json

{
  "ok": false
}

`GET /me/permissions`

Effective permission matrix + actions for UI gating

Operation getMePermissions. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/me/permissions' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`GET /me/sign-in-alerts`

New-browser sign-in alerts: whether the caller gets the email and the browsers already known (id is a short hash; current = this browser)

Operation getMeSignInAlerts. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json SignInAlerts
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/me/sign-in-alerts' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "enabled": false,
  "browsers": [
    {}
  ]
}

`PUT /me/sign-in-alerts`

Turn the new-browser sign-in email on or off for the caller

Operation putMeSignInAlerts. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): SignInAlertsUpdate

Field	Type	Flags	Description
`enabled`	boolean	required

Status	Description	Body
200	ok	application/json SignInAlerts
default	error	application/json Error

bash

curl -X PUT 'https://api.metrixed.com/v1/me/sign-in-alerts' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{"enabled":false}'

Example 200 response:

json

{
  "enabled": false,
  "browsers": [
    {}
  ]
}

`GET /public/notify/unsubscribe`

Public: unsubscribe confirmation page for one kind of email (HTML; asks first so link scanners change nothing)

Operation getPublicNotifyUnsubscribe. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`t`	query	string	yes	sealed unsubscribe token from the email

Status	Description	Body
200	HTML page	text/html string
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/public/notify/unsubscribe' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

`POST /public/notify/unsubscribe`

Public: one-click unsubscribe (RFC 8058 List-Unsubscribe-Post): switches the kind off in the recipient's own preferences (partner category, advertiser user kind, staff kind); 400 for security mail or a bad token, 404 when the recipient is unknown

Operation postPublicNotifyUnsubscribe. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`t`	query	string	yes	sealed unsubscribe token from the email

Status	Description	Body
200	HTML page	text/html string
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/public/notify/unsubscribe' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

`GET /roles/meta`

Resources and special actions available to roles

Operation getRolesMeta. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/roles/meta' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`GET /security/ip-allowlist`

Admin sign-in IP allow-list (empty = every address) and the caller's IP

Operation getSecurityIpAllowlist. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json AdminIPAllowlist
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/security/ip-allowlist' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{}

`PUT /security/ip-allowlist`

Replace the admin sign-in IP allow-list (max 100, normalised; refused when it would exclude the caller's own IP). Enforced at employee login and on every employee session

Operation putSecurityIpAllowlist. Auth: API key (Bearer) or session cookie.

Request body (application/json, required): AdminIPAllowlist

Status	Description	Body
200	ok	application/json AdminIPAllowlist
default	error	application/json Error

bash

curl -X PUT 'https://api.metrixed.com/v1/security/ip-allowlist' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  --data-raw '{}'

Example 200 response:

json

{}

`GET /security/logins`

Login history: every sign-in session of the workspace (staff, partner and advertiser users) with device, IP, method and status, newest first

Operation getSecurityLogins. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required
`principal_type`	query	enum: `all`, `employee`, `partner`, `advertiser`	no
`q`	query	string	no
`status`	query	enum: `all`, `active`	no
`limit`	query	integer	no

Status	Description	Body
200	ok	application/json LoginSessionList
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/security/logins' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "data": [
    {}
  ]
}

`GET /security/policy`

Tenant security policy

Operation getSecurityPolicy. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/security/policy' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`PATCH /security/policy`

Update tenant security policy

Operation patchSecurityPolicy. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X PATCH 'https://api.metrixed.com/v1/security/policy' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`DELETE /security/sessions/{id}`

Revoke a user's active session (signs them out; audited as session.revoked)

Operation deleteSecuritySessionsId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
204	ok	application/json Ok
default	error	application/json Error

bash

curl -X DELETE 'https://api.metrixed.com/v1/security/sessions/<id>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 204 response:

json

{
  "ok": false
}

`GET /security/sso`

SSO connections

Operation getSecuritySso. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/security/sso' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`POST /security/sso`

Create SSO connection (SAML/OIDC)

Operation postSecuritySso. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X POST 'https://api.metrixed.com/v1/security/sso' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`PATCH /security/sso/{id}`

Update SSO connection

Operation patchSecuritySsoId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X PATCH 'https://api.metrixed.com/v1/security/sso/<id>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`DELETE /security/sso/{id}`

Delete SSO connection

Operation deleteSecuritySsoId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`id`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X DELETE 'https://api.metrixed.com/v1/security/sso/<id>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`GET /team/members`

Employee members with role and MFA state

Operation getTeamMembers. Auth: API key (Bearer) or session cookie.

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl 'https://api.metrixed.com/v1/team/members' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}

`PATCH /team/members/{userId}`

Change member role/status

Operation patchTeamMembersUserId. Auth: API key (Bearer) or session cookie.

Parameter	In	Type	Required	Description
`userId`	path	string	yes

Status	Description	Body
200	ok	application/json Ok
default	error	application/json Error

bash

curl -X PATCH 'https://api.metrixed.com/v1/team/members/<userId>' \
  -H "Authorization: Bearer $DT_API_KEY" \
  -H 'Accept: application/json'

Example 200 response:

json

{
  "ok": false
}