Skip to main content
PATCH
cURL

Authorizations

Authorization
string
header
required

Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace.

assess creates and reads assessments, records outcomes and reports key usage. investigate reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy history scope also permits account exports, submitted identifiers and enforcement reports. delete permits account and assessment deletion.

evidence or detailed adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. exports permits exports with the underlying account or audit scope. audit reads audit events and usage reads usage. audit_manage manages audit streams and retention, and includes audit-read and export authority.

webhooks manages webhook endpoints. integrations manages hosted auth-provider integrations. management manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions.

settings reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires settings and policy_publish together, or the legacy management scope.

groups creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment.

members reads the workspace directory. members_manage also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. management does not grant team access. API keys cannot change owners or accept invitations.

A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403.

Path Parameters

workspace_id
string
required

The workspace id. A workspace the acting user is not an active member of answers 404, as do another workspace than an API key's own, a malformed id and a test environment's id. The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID.

Pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$
member_id
string
required

The member's mem_ id. A member of another workspace, or a removed one, answers 404. Opaque, server-assigned member id: mem_ and a 26-character ULID. It stays the same when a removed member is invited back.

Pattern: ^mem_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Body

application/json

PATCH /v1/workspaces/{workspace_id}/members/{member_id} body: the member's new role. The workspace's last owner cannot be demoted.

role
enum<string>
required

A built-in capability set. Specialist roles are independent; effective access is returned by GET /v1/workspaces/{workspace_id}/capabilities.

Available options:
owner,
admin,
developer,
viewer,
investigator,
auditor,
billing
environments
enum<string>[]

Allowed data environments. Invites default to both. Omitted on member PATCH preserves the current grants; owners retain both.

Required array length: 1 - 2 elements
Available options:
live,
test
denied_actions
enum<string>[]

Independent removals from a built-in preset: sensitive evidence, exports, or active policy publication. Owners retain full authority. Omitted member updates preserve exclusions.

Maximum array length: 3
Available options:
evidence.read,
exports.read,
policy.publish

Response

The member with the new role.

One member of a workspace: an external user id holding one role. A removed member loses every permission at once.

id
string
required

Opaque, server-assigned member id: mem_ and a 26-character ULID. It stays the same when a removed member is invited back.

Pattern: ^mem_[0-7][0-9A-HJKMNP-TV-Z]{25}$
workspace_id
string
required

The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID.

Pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$
external_user_id
string
required

The user's id at the identity provider the console signs people in with: 1 to 256 printable ASCII characters with no space, compared exactly.

Required string length: 1 - 256
Pattern: ^[!-~]{1,256}$
role
enum<string>
required

A built-in capability set. Specialist roles are independent; effective access is returned by GET /v1/workspaces/{workspace_id}/capabilities.

Available options:
owner,
admin,
developer,
viewer,
investigator,
auditor,
billing
status
enum<string>
required

Listed and returned members are active.

Available options:
active
created_at
string<date-time>
required
updated_at
string<date-time>
required
environments
enum<string>[]

Allowed data environments. Invites default to both. Omitted on member PATCH preserves the current grants; owners retain both.

Required array length: 1 - 2 elements
Available options:
live,
test
denied_actions
enum<string>[]

Independent removals from a built-in preset: sensitive evidence, exports, or active policy publication. Owners retain full authority. Omitted member updates preserve exclusions.

Maximum array length: 3
Available options:
evidence.read,
exports.read,
policy.publish
principal_id
string

Immutable internal workspace principal, equal to member id, preserved across explicit provider-identity migrations.

Pattern: ^mem_[0-7][0-9A-HJKMNP-TV-Z]{25}$
display_name
string

Informational display name, never an authentication or provider identity assertion.

Maximum string length: 100
Pattern: ^[^\x00-\x1f\x7f-\x9f]*$
unverified_email
string

Unverified display/contact address. Empty clears it; a supplied value must be an address. Never used to link identities.

Maximum string length: 254
Pattern: ^[\x21-\x7e]*$