Enter at least two characters to search. Searching documentation… No matching sections. Try an endpoint, field or event name.
Members
View as MarkdownWho runs the account: its members, their roles and the invitations waiting to be accepted. Members are the same in live and test mode, and both permissions are sensitive, so a key has them only when they are ticked on it.
On this page
The member object
| Field | Type | Description |
|---|---|---|
id
string
|
string | The member's id, used in the paths below. |
object
"member"
|
"member" | The kind of object. |
name
string
|
string | Their name. |
email
string
|
string | The address they sign in with. |
role
string
|
string | owner, admin or member. |
joined_at
string
|
string | When they joined, as an ISO 8601 timestamp in UTC. |
The invitation object
| Field | Type | Description |
|---|---|---|
id
string
|
string | The invitation's id, used in the paths below. It is not the code in the email's link, which is never returned. |
object
"invitation"
|
"invitation" | The kind of object. |
email
string
|
string | Where it was sent. |
role
string
|
string | admin or member: the role it gives once accepted. |
invited_by
string
|
string | The name of the member who sent it. |
expired
boolean
|
boolean | Whether it can no longer be accepted. |
expires_at
string|null
|
string|null | When it stops working, three days after it was sent. |
created_at
string
|
string | When it was sent. |
Endpoints
-
GET
/v1/membersList the members, oldest first. Needs members:read. -
PATCH
/v1/members/{id}Make a member an admin or a member, from {"role": "admin"}. Needs members:write on a key an owner made. -
DELETE
/v1/members/{id}Remove a member. Answers 204. Needs members:write on a key an owner made. -
GET
/v1/invitationsList the invitations nobody has accepted yet, newest first, expired ones included. Needs members:read. -
POST
/v1/invitationsInvite someone from email and role, admin or member. Answers 201. Needs members:write. -
DELETE
/v1/invitations/{id}Withdraw an invitation, so its link stops working. Answers 204. Needs members:write.
Copy failed. Select the code and copy it manually.
curl -X POST 'https://api.velirapay.com/v1/invitations' \
--fail-with-body --silent --show-error --max-time 30 \
-H "Authorization: Bearer ${VELIRAPAY_API_KEY:?Set VELIRAPAY_API_KEY}" \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-d '{
"email": "grace@example.com",
"role": "admin"
}'
<?php
use VeliraPay\VeliraPayClient;
require __DIR__.'/vendor/autoload.php';
$apiKey = getenv('VELIRAPAY_API_KEY') ?: throw new RuntimeException('Set VELIRAPAY_API_KEY.');
$velirapay = new VeliraPayClient($apiKey, baseUrl: 'https://api.velirapay.com');
$invitation = $velirapay->invitations->create([
'email' => 'grace@example.com',
'role' => 'admin',
]);
echo json_encode($invitation, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR), PHP_EOL;
use VeliraPay\Laravel\Facades\VeliraPay;
$invitation = VeliraPay::invitations()->create([
'email' => 'grace@example.com',
'role' => 'admin',
]);
const secretKey = process.env.VELIRAPAY_API_KEY;
if (!secretKey) throw new Error('Set VELIRAPAY_API_KEY.');
const response = await fetch('https://api.velirapay.com/v1/invitations', {
method: 'POST',
headers: {
Authorization: `Bearer ${secretKey}`,
Accept: 'application/json',
'Content-Type': 'application/json',
},
body: JSON.stringify({
email: 'grace@example.com',
role: 'admin',
}),
redirect: 'error',
signal: AbortSignal.timeout(30_000),
});
if (!response.ok) {
throw new Error(`VeliraPay ${response.status}: ${await response.text()}`);
}
const invitation = response.status === 204 ? null : (await response.json()).data;
console.log(JSON.stringify(invitation, null, 2));
import json
import os
import requests
api_key = os.environ["VELIRAPAY_API_KEY"]
response = requests.post(
"https://api.velirapay.com/v1/invitations",
headers={
"Authorization": f"Bearer {api_key}",
"Accept": "application/json",
},
json={
"email": "grace@example.com",
"role": "admin",
},
timeout=(5, 30),
allow_redirects=False,
)
if not 200 <= response.status_code < 300:
raise RuntimeError(f"VeliraPay {response.status_code}: {response.text}")
invitation = None if response.status_code == 204 else response.json()["data"]
print(json.dumps(invitation, indent=2))
using System;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;
var secretKey = Environment.GetEnvironmentVariable("VELIRAPAY_API_KEY")
?? throw new InvalidOperationException("Set VELIRAPAY_API_KEY.");
using var client = new HttpClient(new HttpClientHandler { AllowAutoRedirect = false })
{
Timeout = TimeSpan.FromSeconds(30),
};
using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.velirapay.com/v1/invitations");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", secretKey);
request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
request.Content = new StringContent("""
{
"email": "grace@example.com",
"role": "admin"
}
""", Encoding.UTF8, "application/json");
using var response = await client.SendAsync(request);
var responseBody = await response.Content.ReadAsStringAsync();
if (!response.IsSuccessStatusCode)
{
throw new HttpRequestException($"VeliraPay {(int)response.StatusCode}: {responseBody}");
}
JsonElement? invitation = null;
if (response.StatusCode != HttpStatusCode.NoContent)
{
using var document = JsonDocument.Parse(responseBody);
invitation = document.RootElement.GetProperty("data").Clone();
}
Console.WriteLine(invitation?.GetRawText() ?? "null");
Who may do what
The roles are the dashboard's, taken from the member who made the key. A key an owner or admin made can invite people and cancel invitations, which go out in that member's name and count towards their invitations an hour. Only a key an owner made can change a role or remove a member. Owners are never changed or removed through the API, and nobody is invited or promoted to owner: handing over an organization stays in the dashboard. A personal account takes no members, and inviting into one answers 409.
Removing a member also revokes every API key they made and switches off the webhook endpoints they added, as in the dashboard, so an integration running on one of their keys stops at once. Making an admin a member withdraws the invitations they sent. Every change is in the activity log, naming the key.
Signed in to the MCP server with your account, an AI app has the reach of your own role, and can also create a new organization, which it may then work in.