Organisation API
If an administrator can do it in the organisation host, an API user with the organisation scope can do it over HTTPS. This is still that tenant — not Casewelt’s own operators, and not a recipient. Secrets are shown once. Later reads return flags, never the password.
Prefer minting this client from the console, then using it from your practice system. A files-only bot should not hold organisation. Scope usage is enough to read metres.
| Job | Where to call |
|---|---|
| People | GET · POST /v1/organisations/members — invite, disable. You cannot remove the last owner. |
| Sign-in methods | GET · PUT /v1/organisations/identity — keep password, or federation only. |
| Workspaces | /v1/organisations/workspaces — create and configure file areas, including governed rooms. |
| Groups | /v1/organisations/groups — membership, then grant folders to the group. |
| Roles | /v1/organisations/roles, /permissions, /role-assignments — custom roles on Business and above. |
| Matters and walls | /v1/organisations/matters, /ethical-walls — extra restriction on top of the folder. |
| Legal holds | GET · PUT /v1/organisations/holds — freeze; delete stays blocked until lift. |
| Share policy | /v1/organisations/share-policy — default and ceiling for downloads. |
| Job | Where to call |
|---|---|
/v1/organisations/smtp — your mailbox or Casewelt’s. GET never echoes the password. Test send is a separate action. | |
| Domain | /v1/organisations/hosting — prove a name; certificates follow verification. |
| Branding | /v1/organisations/branding — mark and colours on staff and recipient doors. |
| Job | Where to call |
|---|---|
| Storage | /v1/organisations/storage — attach your store, or leave empty. Flags and endpoint, never keys. |
| Quotas | /v1/organisations/quotas — organisation and per-person ceilings. |
| Usage | GET /v1/organisations/usage — seats, storage, signatures, credits. Scope usage is enough to read. |
| Reports | /v1/reports — dashboard facts, PDF / CSV / JSON export. Not the audit chain. Scope reports. |
| Billing | /v1/organisations/billing — plan and subscription. |
| Assistance packs | /v1/organisations/ai — credits. The assistant itself is /v1/ai with scope ai. |
| Reveal a secret | POST /v1/secrets/reveal — explicit, audited, permissioned. Configuration GET stays empty. |
/v1/organisations/members
{
"members": [
{ "status": "ACTIVE", "roles": ["MEMBER"] }
]
}Invite with a login name they already have, or disable without erasing history. 409 last_org_admin if you try to disable the last owner.
/v1/office/sessions
Opens Casewelt’s browser editor for a named version. This is not a Microsoft 365 licence. The editor talks back through Casewelt — still no storage URL for the client.
Devices and machine certificates live under /v1/security/. They are not this Bearer token. Authentication →
Walk a setting
Invite, hold, share policy, or a domain verify — we will do it once in the console and once on the API, and compare the audit line.