xeonr.auth.api.v1.TeamsService

postAccept Team Invitation

Accepts a team invitation using the emailed token. The calling subject's verified email must match the invited address; membership materialises on acceptance. **Required scopes:** `auth:teams:manage`

postCreate Team

Creates a team; the calling subject becomes its owner. Slugs are immutable and unique within the organisation. **Required scopes:** `auth:teams:manage`

Invites an email address to a team with a team role and optional per-application roles granted on acceptance. Under `auth:teams:app-roles` invited roles are restricted to applications the calling client is bound to. The acting subject must be a team owner. **Required scopes:** `auth:teams:app-roles` or `auth:teams:manage`

postDelete Team

Deletes a team, its memberships, invitations, and entitlements. Requires team owner. **Required scopes:** `auth:teams:manage`

postDescribe Team Entitlement

Returns whether a team is entitled to the calling application, with the entitlement's per-product configuration. **Required scopes:** `auth:teams:read`

postDescribe Team Membership

Authoritatively answers whether a subject is a member of a team, with their team role and per-application role names for the calling application. This is the product-side authorisation check for destructive or sensitive operations where a cached token claim is not fresh enough. **Required scopes:** `auth:teams:read`

postDisable Team Application

Removes a team's entitlement to an application, revoking team-derived access for its members. Requires team owner. **Required scopes:** `auth:teams:manage`

postEnable Team Application

Entitles a team to an application. Only applications with automatic team binding enabled may be self-served; others require an organisation administrator. Requires team owner. **Required scopes:** `auth:teams:manage`

postGet Team

Fetches a team by URN or slug, with the calling subject's membership. The team must be entitled to the calling application. **Required scopes:** `auth:teams:read`

postLeave Team

Removes the calling subject from a team. The last owner must transfer ownership first. **Required scopes:** `auth:teams:manage`

postList My Teams

Lists the teams the calling subject belongs to, filtered to teams entitled to the calling application. Includes the subject's team role and their per-application role names for the calling application. **Required scopes:** `auth:teams:read`

postList Team Invitations

Lists a team's pending invitations. Requires team owner. **Required scopes:** `auth:teams:app-roles` or `auth:teams:manage`

postList Team Members

Lists a team's members with their team roles and per-application role names for the calling application. The calling subject must be a member (or the caller a service account of an entitled application). **Required scopes:** `auth:teams:read`

postRemove Team Member

Removes a member from a team. The last owner cannot be removed. Requires team owner. **Required scopes:** `auth:teams:manage`

postRevoke Team Invitation

Revokes a pending team invitation. Requires team owner. **Required scopes:** `auth:teams:app-roles` or `auth:teams:manage`

postSet Member Application Roles

Sets the full set of per-application role names a member holds within a team. Under `auth:teams:app-roles` the target application is restricted to applications the calling client is bound to, letting a product manage only its own permissions. The acting subject must be a team owner. **Required scopes:** `auth:teams:app-roles` or `auth:teams:manage`

postSet Team Member Role

Changes a member's team role. A team always keeps at least one owner. Requires team owner. **Required scopes:** `auth:teams:manage`

postUpdate Team

Updates a team's display fields. The slug is immutable. Requires team owner. **Required scopes:** `auth:teams:manage`