Organization

Organization details, API keys, and member management

GET `/organization` Get current organization details

Responses

200 Organization detail

Property Type Required Description

data Organization

Property	Type	Required
`id`	string	required
`name`	string	required
`plan`	enum `sandbox` `growth` `enterprise`	required
`charger_count`	integer
`socket_count`	integer
`created_at`	stringformat: date-time	required

401 Missing or invalid API key application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

Request example

curl -X GET "https://api.ampr.dev/v1/organization" \
  -H "Authorization: Bearer $AMPR_API_KEY"

const res = await fetch('https://api.ampr.dev/v1/organization', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.AMPR_API_KEY}`,
  },
});
const data = await res.json();

Note

This endpoint requires an API key. Send it as a Bearer token in the Authorization header.

GET `/organization/members` List organization members

List members of the caller's org (viewer+).

Responses

200 Member list

Property Type Required Description

data array<OrgMember>

Property	Type	Required	Description
`user_id`	string	required
`email`	stringformat: email	required
`name`	stringnullable
`role`	OrgRole `owner` `admin` `operator` `viewer`	required	Ordinal organization role — `owner > admin > operator > viewer`.
`created_at`	stringformat: date-time	required

401 Missing or invalid API key application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

403 Authenticated but not authorized for this action (insufficient role) application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

Request example

curl -X GET "https://api.ampr.dev/v1/organization/members" \
  -H "Authorization: Bearer $AMPR_API_KEY"

const res = await fetch('https://api.ampr.dev/v1/organization/members', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.AMPR_API_KEY}`,
  },
});
const data = await res.json();

Note

This endpoint requires an API key. Send it as a Bearer token in the Authorization header.

POST `/organization/members` Add a member

Add an existing user to the caller's org (admin+). Enforces the role-grant ceiling: a caller cannot assign a role above their own, and only an owner may grant an owner-level membership. An unknown email returns an identical 404 (no cross-account existence oracle).

Parameters

Name	In	Type	Required	Description
`X-CSRF-Token`	header	string	required	Signed, session-bound CSRF token (from the `__Secure-ampr_csrf` cookie). Required on session-authenticated `POST`/`PATCH`/`DELETE`. API-key callers are exempt.

Request body

Property	Type	Required	Description
`email`	stringformat: email	required
`role`	OrgRole `owner` `admin` `operator` `viewer`	required	Ordinal organization role — `owner > admin > operator > viewer`.

Responses

201 Member added

Property Type Required Description

data OrgMember A member of an organization (member-management list entry).

Property	Type	Required	Description
`user_id`	string	required
`email`	stringformat: email	required
`name`	stringnullable
`role`	OrgRole `owner` `admin` `operator` `viewer`	required	Ordinal organization role — `owner > admin > operator > viewer`.
`created_at`	stringformat: date-time	required

400 Invalid request parameters application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

403 Authenticated but not authorized for this action (insufficient role) application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

404 Resource not found application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

409 Resource conflict (e.g., duplicate serial, active session) application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

Request example

curl -X POST "https://api.ampr.dev/v1/organization/members" \
  -H "Authorization: Bearer $AMPR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "string",
    "role": "admin"
  }'

const res = await fetch('https://api.ampr.dev/v1/organization/members', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.AMPR_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "email": "string",
    "role": "admin"
  }),
});
const data = await res.json();

Note

This endpoint requires an API key. Send it as a Bearer token in the Authorization header.

DELETE `/organization/members/{user_id}` Remove a member

Remove a member (admin+; only an owner removes an owner; last-owner guard). Revokes that user's sessions scoped to this org. Cross-org member → 404.

Parameters

Name	In	Type	Required	Description
`user_id`	path	string	required
`X-CSRF-Token`	header	string	required	Signed, session-bound CSRF token (from the `__Secure-ampr_csrf` cookie). Required on session-authenticated `POST`/`PATCH`/`DELETE`. API-key callers are exempt.

Responses

204 Member removed

403 Authenticated but not authorized for this action (insufficient role) application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

404 Resource not found application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

409 Resource conflict (e.g., duplicate serial, active session) application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

Request example

curl -X DELETE "https://api.ampr.dev/v1/organization/members/usr_example" \
  -H "Authorization: Bearer $AMPR_API_KEY"

const res = await fetch('https://api.ampr.dev/v1/organization/members/usr_example', {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${process.env.AMPR_API_KEY}`,
  },
});
const data = await res.json();

Note

This endpoint requires an API key. Send it as a Bearer token in the Authorization header.

PATCH `/organization/members/{user_id}` Change a member's role

Change a member's role (admin+). Enforces the role-grant ceiling (admin cannot promote to/self-promote to owner) and the last-owner guard. A member of another org returns an identical 404 (BOLA).

Parameters

Name	In	Type	Required	Description
`user_id`	path	string	required
`X-CSRF-Token`	header	string	required	Signed, session-bound CSRF token (from the `__Secure-ampr_csrf` cookie). Required on session-authenticated `POST`/`PATCH`/`DELETE`. API-key callers are exempt.

Request body

Property	Type	Required	Description
`role`	OrgRole `owner` `admin` `operator` `viewer`	required	Ordinal organization role — `owner > admin > operator > viewer`.

Responses

200 Role updated

Property Type Required Description

data object

Property	Type	Required	Description
`user_id`	string
`role`	OrgRole `owner` `admin` `operator` `viewer`		Ordinal organization role — `owner > admin > operator > viewer`.

403 Authenticated but not authorized for this action (insufficient role) application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

404 Resource not found application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

409 Resource conflict (e.g., duplicate serial, active session) application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

Request example

curl -X PATCH "https://api.ampr.dev/v1/organization/members/usr_example" \
  -H "Authorization: Bearer $AMPR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "role": "admin"
  }'

const res = await fetch('https://api.ampr.dev/v1/organization/members/usr_example', {
  method: 'PATCH',
  headers: {
    Authorization: `Bearer ${process.env.AMPR_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "role": "admin"
  }),
});
const data = await res.json();

Note

This endpoint requires an API key. Send it as a Bearer token in the Authorization header.

POST `/organization/members/{user_id}/erase` Erase a user's account (GDPR)

GDPR erasure (Ampr as controller of account PII). Cascades the user's memberships + sessions and anonymises the `users` row in place with a per-user-unique sentinel (`erased+<userId>@invalid`). Admin+; only an owner may erase an owner. Cross-org / nonexistent → identical 404 (BOLA).

Parameters

Name	In	Type	Required	Description
`user_id`	path	string	required
`X-CSRF-Token`	header	string	required	Signed, session-bound CSRF token (from the `__Secure-ampr_csrf` cookie). Required on session-authenticated `POST`/`PATCH`/`DELETE`. API-key callers are exempt.

Responses

200 Account erased

Property Type Required Description

data object

Property	Type	Required	Description
`user_id`	string
`status`	enum `erased`

403 Authenticated but not authorized for this action (insufficient role) application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

404 Resource not found application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

Request example

curl -X POST "https://api.ampr.dev/v1/organization/members/usr_example/erase" \
  -H "Authorization: Bearer $AMPR_API_KEY"

const res = await fetch('https://api.ampr.dev/v1/organization/members/usr_example/erase', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.AMPR_API_KEY}`,
  },
});
const data = await res.json();

Note

This endpoint requires an API key. Send it as a Bearer token in the Authorization header.

GET `/organization/members/{user_id}/export` Export a user's account data (GDPR)

GDPR Right of Access / Portability. Machine-readable export of the user row, their org membership, and their session/login history, scoped to the caller's org (admin+). Cross-org / nonexistent → identical 404 (BOLA).

Parameters

Name	In	Type	Required	Description
`user_id`	path	string	required

Responses

200 Account data export

Property Type Required Description

data UserExport Machine-readable GDPR account-data export (Right of Access / Portability).

Property Type Required Description

user User required

Property	Type	Required	Description
`id`	string	required
`email`	stringformat: email	required
`name`	stringnullable
`email_verified`	boolean	required	Whether the account's email has been verified. Login is gated on this in V1.
`created_at`	stringformat: date-time

memberships array<Membership> required

Property	Type	Required	Description
`org_id`	string	required
`org_name`	string
`role`	OrgRole `owner` `admin` `operator` `viewer`	required	Ordinal organization role — `owner > admin > operator > viewer`.

sessions array<object> required Session / login history — `ip`, `user_agent`, and timestamps are PII.

Property	Type	Required	Description
`ip`	stringnullable
`user_agent`	stringnullable
`created_at`	stringformat: date-time
`last_seen_at`	stringnullableformat: date-time
`expires_at`	stringformat: date-time
`revoked_at`	stringnullableformat: date-time

403 Authenticated but not authorized for this action (insufficient role) application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

404 Resource not found application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

Request example

curl -X GET "https://api.ampr.dev/v1/organization/members/usr_example/export" \
  -H "Authorization: Bearer $AMPR_API_KEY"

const res = await fetch('https://api.ampr.dev/v1/organization/members/usr_example/export', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.AMPR_API_KEY}`,
  },
});
const data = await res.json();

Note

This endpoint requires an API key. Send it as a Bearer token in the Authorization header.

GET `/api-keys` List API keys (masked)

Responses

200 API key list

Property Type Required Description

data array<ApiKey>

Property	Type	Required	Description
`id`	string	required
`key`	stringnullable		Full key value — only returned on creation
`key_prefix`	string		Masked key for display (e.g., key_...b9x4)
`label`	stringnullable	required
`last_used_at`	stringnullableformat: date-time
`created_at`	stringformat: date-time	required

401 Missing or invalid API key application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

Request example

curl -X GET "https://api.ampr.dev/v1/api-keys" \
  -H "Authorization: Bearer $AMPR_API_KEY"

const res = await fetch('https://api.ampr.dev/v1/api-keys', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.AMPR_API_KEY}`,
  },
});
const data = await res.json();

Note

This endpoint requires an API key. Send it as a Bearer token in the Authorization header.

POST `/api-keys` Create an API key

Request body

Property	Type	Required	Description
`label`	stringnullable

Responses

201 API key created (full key shown only once)

Property Type Required Description

data ApiKey

Property	Type	Required	Description
`id`	string	required
`key`	stringnullable		Full key value — only returned on creation
`key_prefix`	string		Masked key for display (e.g., key_...b9x4)
`label`	stringnullable	required
`last_used_at`	stringnullableformat: date-time
`created_at`	stringformat: date-time	required

401 Missing or invalid API key application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

Request example

curl -X POST "https://api.ampr.dev/v1/api-keys" \
  -H "Authorization: Bearer $AMPR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "string"
  }'

const res = await fetch('https://api.ampr.dev/v1/api-keys', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.AMPR_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "label": "string"
  }),
});
const data = await res.json();

Note

This endpoint requires an API key. Send it as a Bearer token in the Authorization header.

DELETE `/api-keys/{key_id}` Revoke an API key

Parameters

Name	In	Type	Required	Description
`key_id`	path	string	required

Responses

204 Key revoked

401 Missing or invalid API key application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

404 Resource not found application/problem+json

Property	Type	Required
`type`	stringformat: uri	required
`title`	string	required
`status`	integer	required
`detail`	stringnullable
`instance`	stringnullable

Request example

curl -X DELETE "https://api.ampr.dev/v1/api-keys/key_example" \
  -H "Authorization: Bearer $AMPR_API_KEY"

const res = await fetch('https://api.ampr.dev/v1/api-keys/key_example', {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${process.env.AMPR_API_KEY}`,
  },
});
const data = await res.json();

Note

This endpoint requires an API key. Send it as a Bearer token in the Authorization header.

Organization

GET /organization Get current organization details

Responses

Request example

GET /organization/members List organization members

Responses

Request example

POST /organization/members Add a member

Parameters

Request body

Responses

Request example

DELETE /organization/members/{user_id} Remove a member

Parameters

Responses

Request example

PATCH /organization/members/{user_id} Change a member's role

Parameters

Request body

Responses

Request example

POST /organization/members/{user_id}/erase Erase a user's account (GDPR)

Parameters

Responses

Request example

GET /organization/members/{user_id}/export Export a user's account data (GDPR)

Parameters

Responses

Request example

GET /api-keys List API keys (masked)

Responses

Request example

POST /api-keys Create an API key

Request body

Responses

Request example

DELETE /api-keys/{key_id} Revoke an API key

Parameters

Responses

Request example

GET `/organization` Get current organization details

GET `/organization/members` List organization members

POST `/organization/members` Add a member

DELETE `/organization/members/{user_id}` Remove a member

PATCH `/organization/members/{user_id}` Change a member's role

POST `/organization/members/{user_id}/erase` Erase a user's account (GDPR)

GET `/organization/members/{user_id}/export` Export a user's account data (GDPR)

GET `/api-keys` List API keys (masked)

POST `/api-keys` Create an API key

DELETE `/api-keys/{key_id}` Revoke an API key