xeonr.auth.api.v1.TeamsService

postAccept Team Invitation

Accepts a team invitation by emailed token or by invitation id. The calling subject's verified email must match the invited address; membership materialises on acceptance. **Required scopes:** `auth:teams:manage` or `auth:teams:manage:app`

postCreate Team

Creates a team; the calling subject becomes its owner. Slugs are immutable and unique within the organisation. **Required scopes:** `auth:teams:manage` or `auth:teams:manage:app` (the latter additionally requires the team to be entitled to the calling application)

postCreate Team Invitation

Invites an email address to a team with a team role and optional per-application roles granted on acceptance. Under `auth:teams:app-roles` invited roles are restricted to applications the calling client is bound to. The acting subject must be a team owner. **Required scopes:** `auth:teams:app-roles` or `auth:teams:manage`

postDecline Team Invitation

Declines an invitation addressed to the calling subject, by token or by invitation id. Same identity proof as accepting. **Required scopes:** `auth:teams:manage` or `auth:teams:manage:app`

postDelete Team

Deletes a team, its memberships, invitations, and entitlements. Requires team owner. **Required scopes:** `auth:teams:manage` or `auth:teams:manage:app` (the latter additionally requires the team to be entitled to the calling application)

postDescribe Team Entitlement

Returns whether a team is entitled to the calling application, with the entitlement's per-product configuration. **Required scopes:** `auth:teams:read`

postDescribe Team Membership

Authoritatively answers whether a subject is a member of a team, with their team role and per-application role names for the calling application. This is the product-side authorisation check for destructive or sensitive operations where a cached token claim is not fresh enough. **Required scopes:** `auth:teams:read`

postDisable Team Application

Removes a team's entitlement to an application, revoking team-derived access for its members. Requires team owner. **Required scopes:** `auth:teams:manage` or `auth:teams:manage:app` (the latter additionally requires the team to be entitled to the calling application)

postEnable Team Application

Entitles a team to an application. Only applications with automatic team binding enabled may be self-served; others require an organisation administrator. Requires team owner. Under `auth:teams:manage:app` a product may entitle ONLY itself, and only to a team the calling user owns and names explicitly; a team the caller does not own is indistinguishable from one that does not exist. Naming another application under that scope is refused. **Required scopes:** `auth:teams:manage` or `auth:teams:manage:app`

postGet Team

Fetches a team by URN or slug, with the calling subject's membership. The team must be entitled to the calling application. **Required scopes:** `auth:teams:read`

postLeave Team

Removes the calling subject from a team. The last owner must transfer ownership first. **Required scopes:** `auth:teams:manage` or `auth:teams:manage:app` (the latter additionally requires the team to be entitled to the calling application)

postList My Invitations

Lists pending, unexpired invitations addressed to the calling subject's VERIFIED email, restricted to teams entitled to the calling application. Never returns invitation tokens. Lets a product show an invitation inbox in-app instead of relying on the emailed link. **Required scopes:** `auth:teams:read`

postList My Teams

Lists the teams the calling subject belongs to, filtered to teams entitled to the calling application. Includes the subject's team role and their per-application role names for the calling application. Set `include_unentitled` to additionally return teams the calling user OWNS that are not yet entitled to this application (`entitled=false`, no application roles) — the picker for entitling an existing team via EnableTeamApplication. That form additionally requires `auth:teams:manage` or `auth:teams:manage:app`, and a user subject. **Required scopes:** `auth:teams:read`

postList Team Events

Ordered feed of successful state-changing events for teams entitled to the calling application, for cache invalidation. At-least-once by construction: poll with the previous next_cursor. Membership additions are visible here immediately, whereas token claims only reflect them after a refresh. **Required scopes:** `auth:teams:read`

postList Team Invitations

Lists a team's pending invitations. Requires team owner. **Required scopes:** `auth:teams:app-roles` or `auth:teams:manage`

postList Team Members

Lists a team's members with their team roles and per-application role names for the calling application. The calling subject must be a member (or the caller a service account of an entitled application). **Required scopes:** `auth:teams:read`

postRemove Team Member

Removes a member from a team. The last owner cannot be removed. Requires team owner. **Required scopes:** `auth:teams:manage` or `auth:teams:manage:app` (the latter additionally requires the team to be entitled to the calling application)

postRevoke Team Invitation

Revokes a pending team invitation. Requires team owner. **Required scopes:** `auth:teams:app-roles` or `auth:teams:manage`

postSet Member Application Roles

Sets the full set of per-application role names a member holds within a team. Under `auth:teams:app-roles` the target application is restricted to applications the calling client is bound to, letting a product manage only its own permissions. The acting subject must be a team owner. **Required scopes:** `auth:teams:app-roles` or `auth:teams:manage`

postSet Team Member Role

Changes a member's team role. A team always keeps at least one owner. Requires team owner. **Required scopes:** `auth:teams:manage` or `auth:teams:manage:app` (the latter additionally requires the team to be entitled to the calling application)

postUpdate Team

Updates a team's display fields. The slug is immutable. Requires team owner. **Required scopes:** `auth:teams:manage` or `auth:teams:manage:app` (the latter additionally requires the team to be entitled to the calling application)