# Members

Who runs the account: its members, their roles and the invitations waiting to be accepted. Members are the same in live and test mode, and both permissions are sensitive, so a key has them only when they are ticked on it.

## The member object

| Field | Type | Description |
| --- | --- | --- |
| `id` | string | The member's id, used in the paths below. |
| `object` | "member" | The kind of object. |
| `name` | string | Their name. |
| `email` | string | The address they sign in with. |
| `role` | string | owner, admin or member. |
| `joined_at` | string | When they joined, as an ISO 8601 timestamp in UTC. |

## The invitation object

| Field | Type | Description |
| --- | --- | --- |
| `id` | string | The invitation's id, used in the paths below. It is not the code in the email's link, which is never returned. |
| `object` | "invitation" | The kind of object. |
| `email` | string | Where it was sent. |
| `role` | string | admin or member: the role it gives once accepted. |
| `invited_by` | string | The name of the member who sent it. |
| `expired` | boolean | Whether it can no longer be accepted. |
| `expires_at` | string\|null | When it stops working, three days after it was sent. |
| `created_at` | string | When it was sent. |

## Endpoints

- GET `/v1/members` List the members, oldest first. Needs members:read.
- PATCH `/v1/members/{id}` Make a member an admin or a member, from {"role": "admin"}. Needs members:write on a key an owner made.
- DELETE `/v1/members/{id}` Remove a member. Answers 204. Needs members:write on a key an owner made.
- GET `/v1/invitations` List the invitations nobody has accepted yet, newest first, expired ones included. Needs members:read.
- POST `/v1/invitations` Invite someone from email and role, admin or member. Answers 201. Needs members:write.
- DELETE `/v1/invitations/{id}` Withdraw an invitation, so its link stops working. Answers 204. Needs members:write.

```bash
curl -X POST 'https://api.velirapay.com/v1/invitations' \
  --fail-with-body --silent --show-error --max-time 30 \
  -H "Authorization: Bearer ${VELIRAPAY_API_KEY:?Set VELIRAPAY_API_KEY}" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "grace@example.com",
    "role": "admin"
  }'
```

## Who may do what

The roles are the dashboard's, taken from the member who made the key. A key an owner or admin made can invite people and cancel invitations, which go out in that member's name and count towards their invitations an hour. Only a key an owner made can change a role or remove a member. Owners are never changed or removed through the API, and nobody is invited or promoted to owner: handing over an organization stays in the dashboard. A personal account takes no members, and inviting into one answers 409.

Removing a member also revokes every API key they made and switches off the webhook endpoints they added, as in the dashboard, so an integration running on one of their keys stops at once. Making an admin a member withdraws the invitations they sent. Every change is in the activity log, naming the key.

Signed in to the MCP server with your account, an AI app has the reach of your own role, and can also create a new organization, which it may then work in.