Which API endpoints does RevenueDot Enterprise add?

These endpoints exist only on a server that runs RevenueDot Enterprise: one started with REVENUEDOT_LICENSE_KEY, or with REVENUEDOT_EE_DEV=true for development. Each group also needs its feature in the licence; without it the route answers 403. The open-source build has none of them. Organization endpoints take a dashboard session (the rd_session cookie); secret API keys belong to one project and cannot call them. Writes from a browser must come from the dashboard's own site. The SCIM 2.0 service under /scim/v2 takes a SCIM token instead. The /sso endpoints take no credentials: browsers and identity providers call them during sign-in. Errors use the REST API v2 format, except under /scim/v2, which answers RFC 7644 errors. The examples also read ORG_ID and SCIM_TOKEN from your shell.

Base URL: your server, for example http://localhost:8787 or https://revenuedot.example.com. The examples read REVENUEDOT_URL, PUBLIC_KEY, SECRET_KEY and PROJECT_ID from your shell.

Operations on this page (65)#

• Enterprise: Licence state and features
• Organizations: Organizations you belong to, Create an organization, Get an organization, Update an organization, Delete an organization, Organization with SSO and SCIM counts, List members, Add an existing account, Change a member's organization role, Remove a member, or leave, List the organization's projects, Move a project into the organization, Move a project out, Set a project's data location, The organization audit log
• Custom roles: Scopes a custom role can hold, List custom roles, Create a custom role, Get a custom role, Update a custom role, Delete a custom role, A project's members with role names, Give a project member a built-in or custom role, List group role mappings, Map a group to a role in a project, Delete a group role mapping
• Single sign-on: List SSO connections, Create a SAML or OpenID Connect connection, Get an SSO connection, Update an SSO connection, Delete an SSO connection, List email domains, Add an email domain, Check the domain's TXT record, Remove an email domain, Does this address sign in with SSO?, Start a sign-in for an email address, Start a sign-in with one connection, SAML service provider metadata, SAML assertion consumer service, OpenID Connect redirect URI
• SCIM 2.0: List SCIM tokens, Create a SCIM token, Revoke a SCIM token, Groups the identity provider pushed, Service provider configuration, Resource types (User, Group), One resource type, Schemas (User, Group, enterprise User), One schema, List or find users, Create a user, Get a user, Replace a user, Change a user, Delete a user, List or find groups, Create a group, Get a group, Replace a group, Change a group, Delete a group
• Compliance exports: The public key exports are signed with, Download a signed audit log or access review

Enterprise#

Whether this server runs RevenueDot Enterprise, with which licence and features. See Enterprise.

Licence state and features#

GET /v2/enterprise · Auth: dashboard session · RevenueDot extension

Any signed-in user. The route exists only when the server was started with REVENUEDOT_LICENSE_KEY or REVENUEDOT_EE_DEV=true; the open-source build answers 404. With an invalid key it still answers, with mode: invalid and no features, and no other enterprise route exists.

Example request

curl -s "$REVENUEDOT_URL/v2/enterprise"

Responses

• 200: The licence state. Returns EnterpriseStatus.
• 401: No API key, or an unknown one. Returns V2Error.

Example 200 response:

{
  "object": "enterprise",
  "mode": "development",
  "features": [
    "organizations",
    "custom_roles",
    "sso",
    "scim",
    "data_location",
    "audit_retention",
    "compliance_exports"
  ],
  "licensee": null,
  "expires_at": null,
  "message": "Development mode: for development and testing only, not for production (ee/LICENSE)."
}

Organizations#

Organizations own projects and hold members with owner, admin and member roles, seats, data location, audit retention and the organization audit log. Dashboard session only. See Enterprise.

Organizations you belong to#

GET /v2/organizations · Auth: dashboard session · RevenueDot extension

Example request

curl -s "$REVENUEDOT_URL/v2/organizations"

Responses

• 200: Every organization where you are an active member, oldest first. Returns a list of Organization.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.

Example 200 response:

{
  "object": "list",
  "items": [
    {
      "object": "organization",
      "id": "org_k2m9q4x7z1a8",
      "name": "Acme Inc.",
      "your_role": "owner",
      "region": "us",
      "region_name": "United States",
      "selectable_regions": [
        "us",
        "eu"
      ],
      "region_enforced": false,
      "audit_retention_days": 365,
      "sso_enforced": true,
      "seats": {
        "purchased": 50,
        "used": 23
      },
      "billing_email": "finance@acme.com",
      "member_count": 23,
      "project_count": 3,
      "features": [
        "organizations",
        "custom_roles",
        "sso",
        "scim",
        "data_location",
        "audit_retention",
        "compliance_exports"
      ],
      "created_at": 1790800914012,
      "updated_at": 1790887314012
    }
  ],
  "next_page": null,
  "url": "/v2/organizations"
}

Create an organization#

POST /v2/organizations · Auth: dashboard session · RevenueDot extension

You become its owner. region defaults to this deployment's region. A licence with an organization limit answers 403 once the server has that many organizations.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations" \
  -H "Content-Type: application/json" -d '{"name":"Acme Inc."}'

Responses

• 201: The new organization. Returns Organization.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.

Example 201 response:

{
  "object": "organization",
  "id": "org_k2m9q4x7z1a8",
  "name": "Acme Inc.",
  "your_role": "owner",
  "region": "us",
  "region_name": "United States",
  "selectable_regions": [
    "us",
    "eu"
  ],
  "region_enforced": false,
  "audit_retention_days": 365,
  "sso_enforced": true,
  "seats": {
    "purchased": 50,
    "used": 23
  },
  "billing_email": "finance@acme.com",
  "member_count": 23,
  "project_count": 3,
  "features": [
    "organizations",
    "custom_roles",
    "sso",
    "scim",
    "data_location",
    "audit_retention",
    "compliance_exports"
  ],
  "created_at": 1790800914012,
  "updated_at": 1790887314012
}

Get an organization#

GET /v2/organizations/{org_id} · Auth: dashboard session · RevenueDot extension

Any active member of the organization. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID"

Responses

• 200: The organization. Returns Organization.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Example 200 response:

{
  "object": "organization",
  "id": "org_k2m9q4x7z1a8",
  "name": "Acme Inc.",
  "your_role": "owner",
  "region": "us",
  "region_name": "United States",
  "selectable_regions": [
    "us",
    "eu"
  ],
  "region_enforced": false,
  "audit_retention_days": 365,
  "sso_enforced": true,
  "seats": {
    "purchased": 50,
    "used": 23
  },
  "billing_email": "finance@acme.com",
  "member_count": 23,
  "project_count": 3,
  "features": [
    "organizations",
    "custom_roles",
    "sso",
    "scim",
    "data_location",
    "audit_retention",
    "compliance_exports"
  ],
  "created_at": 1790800914012,
  "updated_at": 1790887314012
}

Update an organization#

POST /v2/organizations/{org_id} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Changing audit_retention_days, seats or billing_email needs an owner. sso_enforced: true needs an enabled SSO connection and a verified domain (422 otherwise). region must be one of selectable_regions. Each field needs its feature in the licence (403 otherwise). Changes are recorded in the organization audit log as organization_updated.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID" \
  -H "Content-Type: application/json" -d '{"audit_retention_days":365,"sso_enforced":true}'

Responses

• 200: The updated organization. Returns Organization.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 422: The request is valid but cannot be done in this state or for this store. Returns V2Error.

Example 200 response:

{
  "object": "organization",
  "id": "org_k2m9q4x7z1a8",
  "name": "Acme Inc.",
  "your_role": "owner",
  "region": "us",
  "region_name": "United States",
  "selectable_regions": [
    "us",
    "eu"
  ],
  "region_enforced": false,
  "audit_retention_days": 365,
  "sso_enforced": true,
  "seats": {
    "purchased": 50,
    "used": 23
  },
  "billing_email": "finance@acme.com",
  "member_count": 23,
  "project_count": 3,
  "features": [
    "organizations",
    "custom_roles",
    "sso",
    "scim",
    "data_location",
    "audit_retention",
    "compliance_exports"
  ],
  "created_at": 1790800914012,
  "updated_at": 1790887314012
}

Delete an organization#

DELETE /v2/organizations/{org_id} · Auth: dashboard session · RevenueDot extension

Organization owners only. Move every project out first (422 otherwise). Its SSO connections, domains, SCIM tokens, custom roles, mappings and organization audit log are deleted.

Path parameters

Example request

curl -s -X DELETE "$REVENUEDOT_URL/v2/organizations/$ORG_ID"

Responses

• 200: Deleted.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 422: The request is valid but cannot be done in this state or for this store. Returns V2Error.

Example 200 response:

{
  "object": "organization",
  "id": "org_k2m9q4x7z1a8",
  "deleted_at": 1790887314012
}

Organization with SSO and SCIM counts#

GET /v2/organizations/{org_id}/overview · Auth: dashboard session · RevenueDot extension

Any active member of the organization. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/overview"

Responses

• 200: The organization plus counts.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

List members#

GET /v2/organizations/{org_id}/members · Auth: dashboard session · RevenueDot extension

Any active member of the organization. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Includes deactivated members (active: false).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/members"

Responses

• 200: Members, oldest first. Returns a list of OrganizationMember.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Add an existing account#

POST /v2/organizations/{org_id}/members · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Only owners add owners. The address must already have a RevenueDot account (404 otherwise); new people join through single sign-on, SCIM or a project invite. Owners and admins become Admins of every organization project; group role mappings apply at once.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/members" \
  -H "Content-Type: application/json" -d '{"email":"sam@acme.com","role":"admin"}'

Responses

• 201: The member. Returns OrganizationMember.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 409: It already exists, or it conflicts with another object. Returns V2Error.

Change a member's organization role#

POST /v2/organizations/{org_id}/members/{user_id} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Only owners make or unmake owners, and the last owner cannot be demoted (400). Promoting to admin or owner adds Admin access to every organization project; demoting removes the access that came from the organization role.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/members/$USER_ID" \
  -H "Content-Type: application/json" -d '{"role":"member"}'

Responses

• 200: The member. Returns OrganizationMember.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Remove a member, or leave#

DELETE /v2/organizations/{org_id}/members/{user_id} · Auth: dashboard session · RevenueDot extension

Admins remove members; only owners remove owners; anyone may remove themselves. The last owner cannot leave (422). The person loses every membership in the organization's projects, including ones added by hand.

Path parameters

Example request

curl -s -X DELETE "$REVENUEDOT_URL/v2/organizations/$ORG_ID/members/$USER_ID"

Responses

• 200: Removed.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 422: The request is valid but cannot be done in this state or for this store. Returns V2Error.

List the organization's projects#

GET /v2/organizations/{org_id}/projects · Auth: dashboard session · RevenueDot extension

Any active member of the organization. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/projects"

Responses

• 200: Projects with their region and member count. Returns a list of OrganizationProject.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Move a project into the organization#

POST /v2/organizations/{org_id}/projects · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). You must also be an Admin of the project (403 otherwise). A project belongs to one organization at a time (409). The project is recorded in this deployment's region; no data moves. Everyone on the project becomes an organization member, and organization owners and admins become its Admins.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/projects" \
  -H "Content-Type: application/json" -d '{"project_id":"proj18pzzkao"}'

Responses

• 201: The project.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 409: It already exists, or it conflicts with another object. Returns V2Error.

Move a project out#

DELETE /v2/organizations/{org_id}/projects/{project_id} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Memberships stay. Members with a custom role become Viewers, because the organization's roles no longer apply there.

Path parameters

Example request

curl -s -X DELETE "$REVENUEDOT_URL/v2/organizations/$ORG_ID/projects/$PROJECT_ID"

Responses

• 200: Moved out.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Set a project's data location#

POST /v2/organizations/{org_id}/projects/{project_id}/region · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Needs the data_location feature. On a deployment that enforces regions, a project stays in the region where its data is (422 with the other region's dashboard address, or "not available yet"); moving stored data is a support job. Elsewhere the region is recorded.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/projects/$PROJECT_ID/region" \
  -H "Content-Type: application/json" -d '{"region":"eu"}'

Responses

• 200: The project's region.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 422: The request is valid but cannot be done in this state or for this store. Returns V2Error.

The organization audit log#

GET /v2/organizations/{org_id}/audit_logs · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Newest first. Project audit logs stay at GET /v2/projects/{project_id}/audit_logs.

Path parameters

Query parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/audit_logs"

Responses

• 200: A page of entries. Returns a list of OrganizationAuditLog.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Custom roles#

Roles built from API v2 scopes, their assignment to project members, and group role mappings for SSO and SCIM groups. See Enterprise.

Scopes a custom role can hold#

GET /v2/organizations/{org_id}/scopes · Auth: dashboard session · RevenueDot extension

Any active member of the organization. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/scopes"

Responses

• 200: 33 scopes in 5 groups.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Example 200 response:

{
  "object": "scope_catalogue",
  "groups": [
    {
      "group": "Customers",
      "scopes": [
        {
          "scope": "customer_information:customers:read",
          "label": "View customers"
        }
      ]
    }
  ]
}

List custom roles#

GET /v2/organizations/{org_id}/roles · Auth: dashboard session · RevenueDot extension

Any active member of the organization. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/roles"

Responses

• 200: Roles, oldest first. Returns a list of CustomRole.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Example 200 response:

{
  "object": "list",
  "items": [
    {
      "object": "custom_role",
      "id": "role_8f2kq0x1m3zv",
      "name": "Support agent",
      "description": "Refunds and customer lookups, no catalog changes.",
      "scopes": [
        "customer_information:customers:read",
        "customer_information:purchases:read_write",
        "customer_information:subscriptions:read_write"
      ],
      "project_id": null,
      "member_count": 4,
      "created_at": 1790800914012,
      "updated_at": 1790800914012
    }
  ],
  "next_page": null,
  "url": "/v2/organizations/org_k2m9q4x7z1a8/roles"
}

Create a custom role#

POST /v2/organizations/{org_id}/roles · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Unknown scopes and project_configuration:api_keys:read_write are refused (400). A name already used in the organization answers 409.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/roles" \
  -H "Content-Type: application/json" -d '{"name":"Support agent","description":"Refunds and customer lookups, no catalog changes.","scopes":["customer_information:customers:read","customer_information:purchases:read_write","customer_information:subscriptions:read_write"]}'

Responses

• 201: The role. Returns CustomRole.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 409: It already exists, or it conflicts with another object. Returns V2Error.

Example 201 response:

{
  "object": "custom_role",
  "id": "role_8f2kq0x1m3zv",
  "name": "Support agent",
  "description": "Refunds and customer lookups, no catalog changes.",
  "scopes": [
    "customer_information:customers:read",
    "customer_information:purchases:read_write",
    "customer_information:subscriptions:read_write"
  ],
  "project_id": null,
  "member_count": 4,
  "created_at": 1790800914012,
  "updated_at": 1790800914012
}

Get a custom role#

GET /v2/organizations/{org_id}/roles/{role_id} · Auth: dashboard session · RevenueDot extension

Any active member of the organization. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/roles/$ROLE_ID"

Responses

• 200: The role. Returns CustomRole.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Example 200 response:

{
  "object": "custom_role",
  "id": "role_8f2kq0x1m3zv",
  "name": "Support agent",
  "description": "Refunds and customer lookups, no catalog changes.",
  "scopes": [
    "customer_information:customers:read",
    "customer_information:purchases:read_write",
    "customer_information:subscriptions:read_write"
  ],
  "project_id": null,
  "member_count": 4,
  "created_at": 1790800914012,
  "updated_at": 1790800914012
}

Update a custom role#

POST /v2/organizations/{org_id}/roles/{role_id} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). New scopes apply to everyone with the role on their next request. A role in use cannot change its project (400).

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/roles/$ROLE_ID" \
  -H "Content-Type: application/json" -d '{"scopes":["customer_information:customers:read","customer_information:purchases:read"]}'

Responses

• 200: The role. Returns CustomRole.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 409: It already exists, or it conflicts with another object. Returns V2Error.

Example 200 response:

{
  "object": "custom_role",
  "id": "role_8f2kq0x1m3zv",
  "name": "Support agent",
  "description": "Refunds and customer lookups, no catalog changes.",
  "scopes": [
    "customer_information:customers:read",
    "customer_information:purchases:read_write",
    "customer_information:subscriptions:read_write"
  ],
  "project_id": null,
  "member_count": 4,
  "created_at": 1790800914012,
  "updated_at": 1790800914012
}

Delete a custom role#

DELETE /v2/organizations/{org_id}/roles/{role_id} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Everyone with the role becomes a Viewer, and group role mappings that gave it are deleted.

Path parameters

Example request

curl -s -X DELETE "$REVENUEDOT_URL/v2/organizations/$ORG_ID/roles/$ROLE_ID"

Responses

• 200: Deleted.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

A project's members with role names#

GET /v2/organizations/{org_id}/projects/{project_id}/members · Auth: dashboard session · RevenueDot extension

Any active member of the organization. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/projects/$PROJECT_ID/members"

Responses

• 200: The project's members. Returns a list of OrganizationProjectMember.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Give a project member a built-in or custom role#

POST /v2/organizations/{org_id}/projects/{project_id}/members/{user_id} · Auth: dashboard session · RevenueDot extension

Organization admins, or Admins of the project. The person must already be a member of the project (404). The role must be admin, developer, viewer, or a custom role of the organization for every project or for this one (400). The last Admin and the project owner stay Admins. A role set here is never changed by group role mappings.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/projects/$PROJECT_ID/members/$USER_ID" \
  -H "Content-Type: application/json" -d '{"role":"role_8f2kq0x1m3zv"}'

Responses

• 200: The membership.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 422: The request is valid but cannot be done in this state or for this store. Returns V2Error.

Example 200 response:

{
  "object": "project_member",
  "user_id": "usr_8f2kq0x1m3zv7a2b",
  "project_id": "proj18pzzkao",
  "role": "role_8f2kq0x1m3zv",
  "role_name": "Support agent"
}

List group role mappings#

GET /v2/organizations/{org_id}/role_mappings · Auth: dashboard session · RevenueDot extension

Any active member of the organization. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/role_mappings"

Responses

• 200: Mappings by group. Returns a list of RoleMapping.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Example 200 response:

{
  "object": "list",
  "items": [
    {
      "object": "role_mapping",
      "id": "map_4f8k2m9q1x7z",
      "group": "RevenueDot Support",
      "project_id": "proj18pzzkao",
      "project_name": "Scanner",
      "role": "role_8f2kq0x1m3zv",
      "role_name": "Support agent",
      "created_at": 1790800914012
    }
  ],
  "next_page": null,
  "url": "/v2/organizations/org_k2m9q4x7z1a8/role_mappings"
}

Map a group to a role in a project#

POST /v2/organizations/{org_id}/role_mappings · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). One mapping per group and project: saving the same pair again replaces its role (200). Every member's access is re-applied at once; memberships_changed counts the changes.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/role_mappings" \
  -H "Content-Type: application/json" -d '{"group":"RevenueDot Support","project_id":"proj18pzzkao","role":"role_8f2kq0x1m3zv"}'

Responses

• 200: Replaced.
• 201: Created.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Delete a group role mapping#

DELETE /v2/organizations/{org_id}/role_mappings/{mapping_id} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Memberships that the mapping created are removed or lowered at once.

Path parameters

Example request

curl -s -X DELETE "$REVENUEDOT_URL/v2/organizations/$ORG_ID/role_mappings/$MAPPING_ID"

Responses

• 200: Deleted.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Single sign-on#

SAML 2.0 and OpenID Connect connections, verified email domains, and the public sign-in endpoints the browser and the identity provider call. See Single sign-on.

List SSO connections#

GET /v2/organizations/{org_id}/sso/connections · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/sso/connections"

Responses

• 200: Connections, oldest first. Returns a list of SsoConnection.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Create a SAML or OpenID Connect connection#

POST /v2/organizations/{org_id}/sso/connections · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Send saml for a SAML connection or oidc for OpenID Connect. A connection starts turned off unless enabled is true. The answer's sp holds the values to enter in the identity provider.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/sso/connections" \
  -H "Content-Type: application/json" -d '{"kind":"oidc","name":"Google Workspace","oidc":{"issuer":"https://accounts.google.com","client_id":"1234567890-abc.apps.googleusercontent.com","client_secret":"GOCSPX-..."}}'

Responses

• 201: The connection. Returns SsoConnection.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Example 201 response:

{
  "object": "sso_connection",
  "id": "ssoc_p3k8x2m4q9z1",
  "org_id": "org_k2m9q4x7z1a8",
  "kind": "saml",
  "name": "Okta",
  "enabled": true,
  "jit": true,
  "created_at": 1790800914012,
  "updated_at": 1790800914012,
  "saml": {
    "idp_entity_id": "http://www.okta.com/exk1a2b3c4d5",
    "idp_sso_url": "https://acme.okta.com/app/acme_revenuedot_1/exk1a2b3c4d5/sso/saml",
    "idp_certificates": [
      "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"
    ],
    "allow_idp_initiated": false,
    "email_attribute": null,
    "first_name_attribute": null,
    "last_name_attribute": null,
    "groups_attribute": "groups"
  },
  "sp": {
    "entity_id": "https://app.revenuedot.app/sso/saml/ssoc_p3k8x2m4q9z1/metadata",
    "acs_url": "https://app.revenuedot.app/sso/saml/ssoc_p3k8x2m4q9z1/acs",
    "metadata_url": "https://app.revenuedot.app/sso/saml/ssoc_p3k8x2m4q9z1/metadata",
    "start_url": "https://app.revenuedot.app/sso/connections/ssoc_p3k8x2m4q9z1/start"
  }
}

Get an SSO connection#

GET /v2/organizations/{org_id}/sso/connections/{connection_id} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/sso/connections/$CONNECTION_ID"

Responses

• 200: The connection. Returns SsoConnection.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Example 200 response:

{
  "object": "sso_connection",
  "id": "ssoc_p3k8x2m4q9z1",
  "org_id": "org_k2m9q4x7z1a8",
  "kind": "saml",
  "name": "Okta",
  "enabled": true,
  "jit": true,
  "created_at": 1790800914012,
  "updated_at": 1790800914012,
  "saml": {
    "idp_entity_id": "http://www.okta.com/exk1a2b3c4d5",
    "idp_sso_url": "https://acme.okta.com/app/acme_revenuedot_1/exk1a2b3c4d5/sso/saml",
    "idp_certificates": [
      "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"
    ],
    "allow_idp_initiated": false,
    "email_attribute": null,
    "first_name_attribute": null,
    "last_name_attribute": null,
    "groups_attribute": "groups"
  },
  "sp": {
    "entity_id": "https://app.revenuedot.app/sso/saml/ssoc_p3k8x2m4q9z1/metadata",
    "acs_url": "https://app.revenuedot.app/sso/saml/ssoc_p3k8x2m4q9z1/acs",
    "metadata_url": "https://app.revenuedot.app/sso/saml/ssoc_p3k8x2m4q9z1/metadata",
    "start_url": "https://app.revenuedot.app/sso/connections/ssoc_p3k8x2m4q9z1/start"
  }
}

Update an SSO connection#

POST /v2/organizations/{org_id}/sso/connections/{connection_id} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Fields you leave out keep their value. An organization that requires SSO cannot turn off its last enabled connection (422).

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/sso/connections/$CONNECTION_ID" \
  -H "Content-Type: application/json" -d '{"enabled":true}'

Responses

• 200: The connection. Returns SsoConnection.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 422: The request is valid but cannot be done in this state or for this store. Returns V2Error.

Example 200 response:

{
  "object": "sso_connection",
  "id": "ssoc_p3k8x2m4q9z1",
  "org_id": "org_k2m9q4x7z1a8",
  "kind": "saml",
  "name": "Okta",
  "enabled": true,
  "jit": true,
  "created_at": 1790800914012,
  "updated_at": 1790800914012,
  "saml": {
    "idp_entity_id": "http://www.okta.com/exk1a2b3c4d5",
    "idp_sso_url": "https://acme.okta.com/app/acme_revenuedot_1/exk1a2b3c4d5/sso/saml",
    "idp_certificates": [
      "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----"
    ],
    "allow_idp_initiated": false,
    "email_attribute": null,
    "first_name_attribute": null,
    "last_name_attribute": null,
    "groups_attribute": "groups"
  },
  "sp": {
    "entity_id": "https://app.revenuedot.app/sso/saml/ssoc_p3k8x2m4q9z1/metadata",
    "acs_url": "https://app.revenuedot.app/sso/saml/ssoc_p3k8x2m4q9z1/acs",
    "metadata_url": "https://app.revenuedot.app/sso/saml/ssoc_p3k8x2m4q9z1/metadata",
    "start_url": "https://app.revenuedot.app/sso/connections/ssoc_p3k8x2m4q9z1/start"
  }
}

Delete an SSO connection#

DELETE /v2/organizations/{org_id}/sso/connections/{connection_id} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). An organization that requires SSO cannot delete its last enabled connection (422).

Path parameters

Example request

curl -s -X DELETE "$REVENUEDOT_URL/v2/organizations/$ORG_ID/sso/connections/$CONNECTION_ID"

Responses

• 200: Deleted.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 422: The request is valid but cannot be done in this state or for this store. Returns V2Error.

List email domains#

GET /v2/organizations/{org_id}/sso/domains · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/sso/domains"

Responses

• 200: Domains, oldest first. Returns a list of SsoDomain.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Add an email domain#

POST /v2/organizations/{org_id}/sso/domains · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Answers the TXT record to publish. Public mail providers such as gmail.com are refused (400). A domain another organization verified answers 409; an unverified claim by another organization does not block you. Adding a domain you already have answers 200.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/sso/domains" \
  -H "Content-Type: application/json" -d '{"domain":"acme.com"}'

Responses

• 200: Already added. Returns SsoDomain.
• 201: The domain, not verified yet. Returns SsoDomain.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 409: It already exists, or it conflicts with another object. Returns V2Error.

Check the domain's TXT record#

POST /v2/organizations/{org_id}/sso/domains/{domain}/actions/verify · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Looks up _revenuedot-sso.<domain> with DNS over HTTPS (Cloudflare's resolver). At most 10 checks a minute per organization (429). A verified domain stays verified if a later check fails.

Path parameters

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/sso/domains/acme.com/actions/verify"

Responses

• 200: The domain, with the TXT values found.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.
• 429: Too many requests. Retry later. Returns V2Error.

Example 200 response:

{
  "object": "sso_domain",
  "domain": "acme.com",
  "verified": true,
  "verified_at": 1790801000000,
  "txt_record": {
    "type": "TXT",
    "name": "_revenuedot-sso.acme.com",
    "value": "revenuedot-sso-verification=3f9a1c0e7b2d4a6f8e1c3b5a7d9f0e2c"
  },
  "last_checked_at": 1790801000000,
  "last_error": null,
  "created_at": 1790800914012,
  "found": {
    "txt": [
      "revenuedot-sso-verification=3f9a1c0e7b2d4a6f8e1c3b5a7d9f0e2c"
    ]
  }
}

Remove an email domain#

DELETE /v2/organizations/{org_id}/sso/domains/{domain} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise).

Path parameters

Example request

curl -s -X DELETE "$REVENUEDOT_URL/v2/organizations/$ORG_ID/sso/domains/acme.com"

Responses

• 200: Removed.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Does this address sign in with SSO?#

POST /sso/lookup · Auth: none · RevenueDot extension

No session. True when the address is on a domain an organization verified and that organization has an enabled connection.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/sso/lookup" \
  -H "Content-Type: application/json" -d '{"email":"sam@acme.com"}'

Responses

• 200: The answer.

Example 200 response:

{
  "sso": true,
  "url": "/sso/start?email=sam%40acme.com"
}

Start a sign-in for an email address#

GET /sso/start · Auth: none · RevenueDot extension

Opens in the browser. Finds the organization that verified the address's domain and sends the browser to its first enabled connection (oldest first). At most 30 starts a minute per IP address. Failures redirect to /login?sso_error=<code>, one of failed, connection_off, rate_limited, not_set_up, domain_not_verified, access_removed, not_a_member, other_browser or idp_error; the sign-in page shows the message for the code, and the exact reason goes to the organization audit log as sso_sign_in_failed.

Query parameters

Example request

curl -s "$REVENUEDOT_URL/sso/start"

Responses

• 303: To the identity provider, or to /login?sso_error=....

Start a sign-in with one connection#

GET /sso/connections/{id}/start · Auth: none · RevenueDot extension

The start_url of a connection. Failures redirect to /login?sso_error=<code>, one of failed, connection_off, rate_limited, not_set_up, domain_not_verified, access_removed, not_a_member, other_browser or idp_error; the sign-in page shows the message for the code, and the exact reason goes to the organization audit log as sso_sign_in_failed.

Path parameters

Query parameters

Example request

curl -s "$REVENUEDOT_URL/sso/connections/$ID/start"

Responses

• 303: To the identity provider, or to /login?sso_error=....

SAML service provider metadata#

GET /sso/saml/{id}/metadata · Auth: none · RevenueDot extension

This URL is also the connection's entity ID.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/sso/saml/$ID/metadata"

Responses

• 200: The metadata.
• 404: No SAML connection with this id.

SAML assertion consumer service#

POST /sso/saml/{id}/acs · Auth: none · RevenueDot extension

The identity provider posts the SAML response here (HTTP-POST binding). RevenueDot checks the assertion's signature, audience, recipient, destination, issuer, validity times (60 seconds of leeway) and that the answer belongs to a sign-in this browser started; each assertion is accepted once. Responses without an InResponseTo are IdP-initiated and are refused unless the connection allows them. On success it sets the session cookie. Failures redirect to /login?sso_error=<code>, one of failed, connection_off, rate_limited, not_set_up, domain_not_verified, access_removed, not_a_member, other_browser or idp_error; the sign-in page shows the message for the code, and the exact reason goes to the organization audit log as sso_sign_in_failed.

Path parameters

Request body (application/x-www-form-urlencoded)

Example request

curl -s -X POST "$REVENUEDOT_URL/sso/saml/$ID/acs"

Responses

• 303: To the page the person started from, or to /login?sso_error=....

OpenID Connect redirect URI#

GET /sso/oidc/{id}/callback · Auth: none · RevenueDot extension

The identity provider sends the browser back here. RevenueDot checks the state against the browser that started the sign-in, exchanges the code with PKCE, and verifies the ID token (issuer, audience, expiry, nonce, azp). The token must have an email claim, and email_verified must not be false. Failures redirect to /login?sso_error=<code>, one of failed, connection_off, rate_limited, not_set_up, domain_not_verified, access_removed, not_a_member, other_browser or idp_error; the sign-in page shows the message for the code, and the exact reason goes to the organization audit log as sso_sign_in_failed.

Path parameters

Query parameters

Example request

curl -s "$REVENUEDOT_URL/sso/oidc/$ID/callback"

Responses

• 303: To the page the person started from, or to /login?sso_error=....

SCIM 2.0#

SCIM tokens and groups in the dashboard API, and the SCIM 2.0 service (RFC 7643, RFC 7644) that Okta, Microsoft Entra ID and other identity providers call with a SCIM token. Bodies and errors use application/scim+json. See SCIM.

List SCIM tokens#

GET /v2/organizations/{org_id}/scim/tokens · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Never returns the secret.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/scim/tokens"

Responses

• 200: Tokens, revoked ones included. Returns a list of ScimToken.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Create a SCIM token#

POST /v2/organizations/{org_id}/scim/tokens · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). The answer holds the token (rdscim_ and 64 hex characters) once; RevenueDot stores only its SHA-256. base_url is the SCIM base URL for the identity provider.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v2/organizations/$ORG_ID/scim/tokens" \
  -H "Content-Type: application/json" -d '{"name":"Okta"}'

Responses

• 201: The token, shown once.
• 400: The request is invalid. Returns V2Error.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Example 201 response:

{
  "object": "scim_token",
  "id": "sct_m3k9q2x8z1a4",
  "name": "Okta",
  "prefix": "rdscim_4f8a1c",
  "created_by": "usr_8f2kq0x1m3zv7a2b",
  "created_at": 1790800914012,
  "last_used_at": null,
  "revoked_at": null,
  "token": "rdscim_4f8a1c…",
  "base_url": "https://app.revenuedot.app/scim/v2"
}

Revoke a SCIM token#

DELETE /v2/organizations/{org_id}/scim/tokens/{token_id} · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). Requests with the token answer 401 at once. Revoking twice answers the token again.

Path parameters

Example request

curl -s -X DELETE "$REVENUEDOT_URL/v2/organizations/$ORG_ID/scim/tokens/$TOKEN_ID"

Responses

• 200: The revoked token. Returns ScimToken.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Groups the identity provider pushed#

GET /v2/organizations/{org_id}/scim/groups · Auth: dashboard session · RevenueDot extension

Organization owners and admins. When the organization requires single sign-on, people on its verified domains other than owners need a session that began with its SSO (403 otherwise). For picking groups in the role mapping editor.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v2/organizations/$ORG_ID/scim/groups"

Responses

• 200: Groups by name.
• 401: No API key, or an unknown one. Returns V2Error.
• 403: The key lacks a permission, or a public key was used. Returns V2Error.
• 404: Not found in this project (another project's ids also answer 404). Returns V2Error.

Service provider configuration#

GET /scim/v2/ServiceProviderConfig · Auth: SCIM token · RevenueDot extension

PATCH, filters (at most 200 results) and ETags are supported. Bulk, sorting and password changes are not.

Example request

curl -s "$REVENUEDOT_URL/scim/v2/ServiceProviderConfig" -H "Authorization: Bearer $SCIM_TOKEN"

Responses

• 200: RFC 7643 §5.
• 401: No token, or a revoked or unknown one. Returns ScimError.

Resource types (User, Group)#

GET /scim/v2/ResourceTypes · Auth: SCIM token · RevenueDot extension

Example request

curl -s "$REVENUEDOT_URL/scim/v2/ResourceTypes" -H "Authorization: Bearer $SCIM_TOKEN"

Responses

• 200: A ListResponse of User and Group. Returns ScimListResponse.
• 401: No token, or a revoked or unknown one. Returns ScimError.

One resource type#

GET /scim/v2/ResourceTypes/{name} · Auth: SCIM token · RevenueDot extension

Path parameters

Example request

curl -s "$REVENUEDOT_URL/scim/v2/ResourceTypes/$NAME" -H "Authorization: Bearer $SCIM_TOKEN"

Responses

• 200: The resource type.
• 401: No token, or a revoked or unknown one. Returns ScimError.
• 404: Not found in the token's organization. Returns ScimError.

Schemas (User, Group, enterprise User)#

GET /scim/v2/Schemas · Auth: SCIM token · RevenueDot extension

Example request

curl -s "$REVENUEDOT_URL/scim/v2/Schemas" -H "Authorization: Bearer $SCIM_TOKEN"

Responses

• 200: A ListResponse of schemas. Returns ScimListResponse.
• 401: No token, or a revoked or unknown one. Returns ScimError.

One schema#

GET /scim/v2/Schemas/{id} · Auth: SCIM token · RevenueDot extension

Path parameters

Example request

curl -s "$REVENUEDOT_URL/scim/v2/Schemas/$ID" -H "Authorization: Bearer $SCIM_TOKEN"

Responses

• 200: The schema.
• 401: No token, or a revoked or unknown one. Returns ScimError.
• 404: Not found in the token's organization. Returns ScimError.

List or find users#

GET /scim/v2/Users · Auth: SCIM token · RevenueDot extension

Okta and Entra look a user up with filter=userName eq "..." before creating them.

Query parameters

Example request

curl -s "$REVENUEDOT_URL/scim/v2/Users" -H "Authorization: Bearer $SCIM_TOKEN"

Responses

• 200: A ListResponse of Users. Returns ScimListResponse.
• 400: The request, filter or PATCH is invalid. Returns ScimError.
• 401: No token, or a revoked or unknown one. Returns ScimError.

Example 200 response:

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 1,
  "startIndex": 1,
  "itemsPerPage": 1,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "id": "scu_9x2k4m8q1z7a3b5c",
      "externalId": "00u1a2b3c4d5",
      "userName": "sam@acme.com",
      "name": {
        "givenName": "Sam",
        "familyName": "Lee"
      },
      "emails": [
        {
          "value": "sam@acme.com",
          "type": "work",
          "primary": true
        }
      ],
      "active": true,
      "groups": [
        {
          "value": "scg_4k8m2q9x1z7a3b5c",
          "display": "RevenueDot Support"
        }
      ],
      "meta": {
        "resourceType": "User",
        "created": "2026-10-01T09:12:00.000Z",
        "lastModified": "2026-10-01T09:12:00.000Z",
        "location": "https://app.revenuedot.app/scim/v2/Users/scu_9x2k4m8q1z7a3b5c",
        "version": "W/\"1\""
      }
    }
  ]
}

Create a user#

POST /scim/v2/Users · Auth: SCIM token · RevenueDot extension

The email (primary, else work, else first address, else an email-shaped userName) must be on a domain the organization verified. An existing RevenueDot account with that address is linked; otherwise an account without a password is created. The person becomes an active organization member and their group role mappings apply. password is ignored.

Query parameters

Request body (application/scim+json)

Example request

curl -s -X POST "$REVENUEDOT_URL/scim/v2/Users" -H "Authorization: Bearer $SCIM_TOKEN" \
  -H "Content-Type: application/scim+json" -d '{"schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],"userName":"sam@acme.com","name":{"givenName":"Sam","familyName":"Lee"},"emails":[{"value":"sam@acme.com","type":"work","primary":true}],"active":true}'

Responses

• 201: The user. Returns ScimUser.
• 400: The request, filter or PATCH is invalid. Returns ScimError.
• 401: No token, or a revoked or unknown one. Returns ScimError.
• 409: The userName, email or group name is taken. Returns ScimError.
• 413: The body is larger than 1 MB. Returns ScimError.

Example 201 response:

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "scu_9x2k4m8q1z7a3b5c",
  "externalId": "00u1a2b3c4d5",
  "userName": "sam@acme.com",
  "name": {
    "givenName": "Sam",
    "familyName": "Lee"
  },
  "emails": [
    {
      "value": "sam@acme.com",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "groups": [
    {
      "value": "scg_4k8m2q9x1z7a3b5c",
      "display": "RevenueDot Support"
    }
  ],
  "meta": {
    "resourceType": "User",
    "created": "2026-10-01T09:12:00.000Z",
    "lastModified": "2026-10-01T09:12:00.000Z",
    "location": "https://app.revenuedot.app/scim/v2/Users/scu_9x2k4m8q1z7a3b5c",
    "version": "W/\"1\""
  }
}

Get a user#

GET /scim/v2/Users/{id} · Auth: SCIM token · RevenueDot extension

Path parameters

Query parameters

Headers

Example request

curl -s "$REVENUEDOT_URL/scim/v2/Users/$ID" -H "Authorization: Bearer $SCIM_TOKEN"

Responses

• 200: The user. Returns ScimUser.
• 304: Not modified.
• 401: No token, or a revoked or unknown one. Returns ScimError.
• 404: Not found in the token's organization. Returns ScimError.

Example 200 response:

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "scu_9x2k4m8q1z7a3b5c",
  "externalId": "00u1a2b3c4d5",
  "userName": "sam@acme.com",
  "name": {
    "givenName": "Sam",
    "familyName": "Lee"
  },
  "emails": [
    {
      "value": "sam@acme.com",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "groups": [
    {
      "value": "scg_4k8m2q9x1z7a3b5c",
      "display": "RevenueDot Support"
    }
  ],
  "meta": {
    "resourceType": "User",
    "created": "2026-10-01T09:12:00.000Z",
    "lastModified": "2026-10-01T09:12:00.000Z",
    "location": "https://app.revenuedot.app/scim/v2/Users/scu_9x2k4m8q1z7a3b5c",
    "version": "W/\"1\""
  }
}

Replace a user#

PUT /scim/v2/Users/{id} · Auth: SCIM token · RevenueDot extension

active: false deprovisions: the person loses every membership in the organization's projects and every session ends. active: true again restores group-mapped access. A new email, or a reactivation, must be on a verified domain. The organization's last owner cannot be deactivated (400).

Path parameters

Query parameters

Headers

Request body (application/scim+json)

Example request

curl -s -X PUT "$REVENUEDOT_URL/scim/v2/Users/$ID" -H "Authorization: Bearer $SCIM_TOKEN" \
  -H "Content-Type: application/scim+json" -d '{"schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],"userName":"sam@acme.com","name":{"givenName":"Sam","familyName":"Lee"},"emails":[{"value":"sam@acme.com","type":"work","primary":true}],"active":true}'

Responses

• 200: The user. Returns ScimUser.
• 400: The request, filter or PATCH is invalid. Returns ScimError.
• 401: No token, or a revoked or unknown one. Returns ScimError.
• 404: Not found in the token's organization. Returns ScimError.
• 409: The userName, email or group name is taken. Returns ScimError.
• 412: If-Match does not match the current version. Returns ScimError.
• 413: The body is larger than 1 MB. Returns ScimError.

Example 200 response:

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User"
  ],
  "id": "scu_9x2k4m8q1z7a3b5c",
  "externalId": "00u1a2b3c4d5",
  "userName": "sam@acme.com",
  "name": {
    "givenName": "Sam",
    "familyName": "Lee"
  },
  "emails": [
    {
      "value": "sam@acme.com",
      "type": "work",
      "primary": true
    }
  ],
  "active": true,
  "groups": [
    {
      "value": "scg_4k8m2q9x1z7a3b5c",
      "display": "RevenueDot Support"
    }
  ],
  "meta": {
    "resourceType": "User",
    "created": "2026-10-01T09:12:00.000Z",
    "lastModified": "2026-10-01T09:12:00.000Z",
    "location": "https://app.revenuedot.app/scim/v2/Users/scu_9x2k4m8q1z7a3b5c",
    "version": "W/\"1\""
  }
}

Change a user#

PATCH /scim/v2/Users/{id} · Auth: SCIM token · RevenueDot extension

RFC 7644 PATCH. Also accepts Okta's replace without a path and Entra's capitalised op values, "False" strings and dotted keys. Same effects as PUT.

Path parameters

Query parameters

Headers

Request body (application/scim+json)

Example request

curl -s -X PATCH "$REVENUEDOT_URL/scim/v2/Users/$ID" -H "Authorization: Bearer $SCIM_TOKEN" \
  -H "Content-Type: application/scim+json" -d '{"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"replace","path":"active","value":false}]}'