Session-only operations

A catalogue of every SAQ API operation that exists only for the browser session, so integrators know the full surface and why API tokens are refused on it.

Written for
integration-developer
Roles
owner, admin, member, project-manager
Requires
Browser session; roles per row
Feature
api

Only the operations listed on API reference accept an API token. Everything below is called by the app with a cookie session. A Bearer request to any of these paths under /api/w/{slug} answers 403 forbidden with the message "This operation is not available to API keys"; a Bearer request outside /api/w/{slug} (for example /api/me) answers 403 forbidden with "API keys cannot access global account operations". Client management, billing configuration, members, settings, and token management are administrative surfaces that stay behind an interactive login on purpose. Automated provisioning of people uses SCIM instead.

Paths in the tables are relative to /api/w/{slug} unless they start with /api/. Every write here also fails with read_only (403) while the workspace is read-only, except removals of members and tokens, export, deletion, and the organisation billing operations.

Clients and people

Owner or Admin for every change. Workspace users may list clients and people; a client user sees only their own client.

Operation Contract Purpose
GET /clients?archived=true ClientSummary[] List clients
GET /people People People who may be mentioned or assigned
POST /clients ClientInput → ClientDetail Create a client
GET /clients/{id} ClientDetail Client with users, contacts, billing recipients, projects
PATCH /clients/{id} UpdateClient → ClientDetail Change name, currency, locale, timesheet layout, rounding
DELETE /clients/{id} Archive a client (never deleted)
POST /clients/{id}/users AddClientUser → ClientUser Add a client user (recent re-authentication)
PATCH /clients/{id}/users/{userId} { billingContact } Set the Billing contact flag (recent re-authentication)
DELETE /clients/{id}/users/{userId} Remove a client user (recent re-authentication)
POST /clients/{id}/contacts ContactInput → Contact Add or attach a contact
DELETE /clients/{id}/contacts/{contactId} Delete a contact
POST /clients/{id}/billing-recipients { email } → { id } Designate a timesheet recipient (recent re-authentication)
DELETE /clients/{id}/billing-recipients/{recipientId} Remove a recipient (recent re-authentication)

Workspaces, members, and invitations

Operation Contract Purpose
GET /api/workspaces Membership[] The workspaces the signed-in person belongs to
GET /api/w/{slug} WorkspaceSummary Workspace summary and the entry check (MFA, forced SSO)
GET /members MembersResponse Members and, for Owner or Admin, pending invitations
POST /invitations CreateInvitationRequest → Invitation Invite by email with a role; Owner or Admin, recent re-authentication, seat check
DELETE /invitations/{id} Revoke an invitation
PATCH /members/{id} UpdateMemberRequest Change a member's role (last_owner, owner_only rules)
DELETE /members/{id} Remove a member, or leave the workspace

Settings

Operation Contract Purpose
GET /settings/general, PATCH /settings/general GeneralSettings, UpdateGeneralSettings Name, ticket prefix, timezone, locale, currency, period length; Owner or Admin
GET /workflow changes and the kind, state, priority, label operations see Workflow Owner or Admin
GET /settings/auth AuthSettings Verified domains, SSO connection, SCIM settings; Owner or Admin
POST /settings/auth/domains, POST …/domains/{id}/verify, PATCH …/domains/{id}, DELETE …/domains/{id} Domain Domain verification and forced SSO
PUT /settings/auth/sso, POST /settings/auth/sso/deactivate, DELETE /settings/auth/sso SsoConnection The OpenID Connect connection
PUT /settings/auth/scim, POST /settings/auth/scim/tokens, DELETE /settings/auth/scim/tokens/{id} ScimSettings SCIM provisioning and its bearer tokens

Mail

Workspace users; connecting a mailbox is Owner or Admin with recent re-authentication.

Operation Purpose
GET /mail/health Mailbox connection status
POST /mail/connect Connect Microsoft 365 or IMAP/SMTP
GET /mail/messages Messages waiting in the Inbox or in restricted review
POST /mail/messages/{id}/route Route a message into a project as a new ticket
POST /mail/messages/{id}/merge Merge a message into an existing ticket at an audience
POST /mail/messages/{id}/retry Retry a paused message
POST /mail/sends/{id}/resolve Resolve a failed outbound send

Billing configuration and runs

Owner or Admin throughout. Billing runs, voids, period close, and redaction refuse every token in core as well as at the edge.

Operation Contract Purpose
GET /billing/categories, POST /billing/categories, PATCH /billing/categories/{id} CategoryList, CategoryInput, CategoryPatch Consultant categories
PUT /billing/members/{id}/category, PUT /projects/{id}/members/{identityId}/category { categoryId } Default and per-project category of a person
GET /settings/billing, PATCH /settings/billing BillingSettings, UpdateBillingSettings Workspace default policies per kind, period length, reopen window
GET /clients/{id}/rates, POST /clients/{id}/rates, DELETE /billing/client-rates/{id} RateCard, RateInput Client rate cards (hourlyRate in integer minor units)
POST /projects/{id}/rates, DELETE /billing/project-rates/{id} RateInput Project rate overrides
GET /clients/{id}/policies, PUT /clients/{id}/policies PolicyList, PolicyInput Billing policies per kind (paid, free, bank:<id>) at client or project level
GET /billing/bank-names?clientId= { banks: [{ id, name }] } Bank names for the ticket policy picker
GET /clients/{id}/banks, POST /clients/{id}/banks, PATCH /billing/banks/{id} BankList, BankInput, BankPatch Time banks
GET /billing/banks/{id}/ledger, POST /billing/banks/{id}/adjustments BankLedger, AdjustmentInput Ledger and manual adjustments
GET /billing/runs?clientId=, GET /billing/runs/{id} RunList, Run Billing runs
GET /billing/runs/preview?clientId=&periodId= RunPreview Blockers, lines, banks, totals before a run (20 per minute, shared with creation)
POST /billing/runs RunInput (clientId, periodId, idempotencyKey 8–200, confirmation) → { id, replayed } Create a run; recent re-authentication
POST /billing/runs/{id}/void { confirmation } → { ok, unresolvedDeliveries } Void a run; recent re-authentication
GET /clients/{id}/document-grants, PUT /clients/{id}/document-grants DocumentGrantList Client-wide document access for a workspace user
POST /tickets/{id}/redact { reason } Redact a ticket; see Tickets
GET /periods, GET /periods/{id}/preview, POST /periods/{id}/close, GET /reports see Periods and reports Period close and reports

Organisation

Owner only, except reading entitlements and the plan list (Owner or Admin).

Operation Contract Purpose
GET /organization Entitlements Plan, subscription state, seats used, features, API rate, read-only and deletion dates
GET /organization/plans Plan[] The plan catalogue
POST /organization/checkout CheckoutRequest → { url } Start a subscription (recent re-authentication)
PUT /organization/invoice InvoiceDetails Ask to be invoiced instead (recent re-authentication)
POST /organization/portal PortalRequest → { url } Open the billing portal
GET /audit WorkspaceAuditRow[] The 200 most recent audit rows
POST /export ExportWorkspaceResponse (key, url) Build the workspace export package (recent re-authentication, 3 per 10 minutes)
GET /export/file?key= NDJSON stream Download the latest export
POST /delete DeleteWorkspaceRequest → { deletedAt, purgeAfter } Schedule deletion after a recent export (typed slug, recent re-authentication)

Tickets and time, browser-only parts

Operation Purpose
POST /tickets/{ref}/archive, DELETE /tickets/{ref} Archive, restore, delete
POST /tickets/{ref}/viewers, DELETE /tickets/{ref}/viewers/{identityId}, POST /tickets/{ref}/visibility Sharing and the visibility preview
POST /render Markdown preview
GET /github/links Workspace-wide GitHub link list
DELETE /time/{id}, POST /time/{id}/corrections, POST /time/tickets/{id}/reattribute Delete, correct, re-attribute time
POST /projects, PATCH /projects/{key}, DELETE /projects/{key}, PUT /projects/{key}/members, DELETE /projects/{key}/members/{identityId} Project changes
GET /tokens, DELETE /tokens/{id}, GET /agents, POST /agents, POST /agents/{identityId}/rotate, GET /mcp Token registry, agent accounts, MCP setup

Account (/api/me)

Never reachable with a token.

Operation Contract Purpose
GET /api/me, PATCH /api/me Me, UpdateProfileRequest Profile: name, locale, timezone, notifications, weekly target
GET /api/me/sessions, DELETE /api/me/sessions/{id}, POST /api/me/sessions/revoke-others SessionList Active sessions
POST /api/me/reauth ReauthRequest Re-authenticate with the password (20 per minute per address)
POST /api/me/delete DeleteAccountRequest Delete the global account (typed email)
GET /api/me/sso-tests/{state} SsoTestResult Result of an SSO connection test
GET /api/me/tokens, POST /api/me/tokens, DELETE /api/me/tokens/{id} see API tokens and agents Personal tokens
  • API reference How the SAQ REST API reference is organised, which operations accept API tokens, where the live OpenAPI document is, and what every error code means.
  • API tokens and agents Mint, list, and revoke API tokens, manage agent accounts, and fetch MCP setup snippets through the SAQ REST API; all of these are browser-session only.
  • Authenticate with API tokens How to obtain a personal token or an agent account key, send it as a bearer token, and what scopes, project limits, address restrictions, expiry, and revocation do.
  • Connect an MCP client The MCP endpoint, how Claude Code and Cursor are configured, every tool with its arguments and result, error shapes, rate limits, and the context pack.
  • SCIM 2.0 reference Endpoints, attributes, filters, PATCH semantics, provisioning rules, error codes, and example requests for provisioning workspace users and groups from an identity provider.
  • Manage members and invitations Invite workspace users by email, set and change their role, remove them or let them leave, and understand how seats are counted.
  • Workspace settings The general settings of a workspace, name, address, ticket prefix, time zone, default language, default currency, and period length, and which of them lock after the first period close.
  • Run billing for a client Price a client's time for one closed period with the five-step run wizard, fix blockers, review billing descriptions and bank totals, commit, and void a run when needed.
  • Export or delete the workspace Download a complete NDJSON export of the workspace, and schedule the workspace for deletion with its 30-day restorable grace period.