Reconcile the organization read model | API reference

Description

Returns the organization read model: display and navigation data for the directory, groups, group memberships, grants, and organization policy. Without a cursor it returns an atomic snapshot; with one, only lanes changed since. Any organization member may call it; the read model is not authority, so clients still verify signed policies and manifests.

Authentication

Requires a signed-in session: the client sends its session token as a bearer token in the Authorization header.

Parameters

Name	In	Type	Details
`organizationId`	path	string	required lowercase UUID v4
`cursor`	query	string	optional

Responses

200 OK

application/jsonOrganizationReadModelResponse

A page of the organization read model: an atomic snapshot when the request had no cursor, otherwise only the lanes changed since it. Display data only, never authority.

object
7 fields
- currentUserobjectrequired
  1 field
  - isOrgAdminbooleanrequired
- hasMorebooleanrequired
- nextCursorstringrequired
  - not empty
- organizationIdstringrequired
- versionnumberrequired
  - always 6
- lanesobjectrequired
  5 fields
  - directoryobjectoptional
    3 fields
    organizationIdstringrequired
    profileDocumentIdstringrequirednullable
    userslist of objectrequired
    15 fields
    createdAtstringrequired
    disabledAtstringrequirednullable
    disabledByUserIdstringrequirednullable
    encapsulationKeyFingerprintstringrequired
    encapsulationPublicKeystringrequired
    isPersonalOrganizationOwnerbooleanrequired
    isSelfbooleanrequired
    joinedAtstringrequired
    leaveRequestOrganizationLeaveRequestrequirednullable
    profileDocumentIdstringrequirednullable
    signingKeyFingerprintstringrequired
    signingPublicKeystringrequired
    statusstringrequired
    one of active, disabled
    updatedAtstringrequired
    userIdstringrequired
  - grantsobjectoptional
    2 fields
    grantslist of objectrequired
    15 fields
    accessLevelstringrequired
    one of admin, read, write
    containerIdstringrequired
    createdAtstringrequired
    depthintegerrequired
    at least 0
    isBuiltinbooleanrequired
    metadataAccessEpochintegerrequired
    greater than 0
    metadataAccessStateHashstringrequired
    not empty
    metadataDocumentIdstringrequirednullable
    parentIdstringrequirednullable
    updatedAtstringrequired
    groupIdstringrequirednullable
    signingKeyFingerprintstringrequirednullable
    subjectIdstringrequired
    subjectTypestringrequired
    one of group, user
    userIdstringrequirednullable
    organizationIdstringrequired
  - groupMembershipsobjectoptional
    3 fields
    deletedGroupIdslist of stringrequired
    each item: not empty
    groupslist of objectrequired
    3 fields
    groupIdstringrequired
    memberslist of objectrequired
    2 fields
    rolestringrequired
    one of member, admin
    userIdstringrequired
    stateHashstringrequired
    not empty
    organizationIdstringrequired
  - groupsobjectoptional
    3 fields
    groupslist of objectrequired
    5 fields
    createdAtstringrequired
    currentStateobjectrequirednullable
    5 fields
    keyEpochintegerrequired
    at least 1
    keyFingerprintstringrequired
    not empty
    memberCountintegerrequired
    at least 0
    stateHashstringrequired
    versionintegerrequired
    at least 1
    groupIdstringrequired
    isBuiltinbooleanrequired
    organizationIdstringrequired
    memberGroupIdstringrequired
    organizationIdstringrequired
  - organizationPolicyobjectoptional
    2 fields
    currentStateobjectrequired
    5 fields
    keyEpochintegerrequired
    at least 1
    keyFingerprintstringrequired
    not empty
    memberCountintegerrequired
    at least 0
    stateHashstringrequired
    not empty
    versionintegerrequired
    at least 1
    organizationIdstringrequired
- modestringrequired
  - always delta
object
7 fields
- currentUserobjectrequired
  1 field
  - isOrgAdminbooleanrequired
- hasMorebooleanrequired
  - always false
- nextCursorstringrequired
  - not empty
- organizationIdstringrequired
- versionnumberrequired
  - always 6
- lanesobjectrequired
  5 fields
  - directoryobjectrequired
    3 fields
    organizationIdstringrequired
    profileDocumentIdstringrequirednullable
    userslist of objectrequired
    15 fields
    createdAtstringrequired
    disabledAtstringrequirednullable
    disabledByUserIdstringrequirednullable
    encapsulationKeyFingerprintstringrequired
    encapsulationPublicKeystringrequired
    isPersonalOrganizationOwnerbooleanrequired
    isSelfbooleanrequired
    joinedAtstringrequired
    leaveRequestOrganizationLeaveRequestrequirednullable
    profileDocumentIdstringrequirednullable
    signingKeyFingerprintstringrequired
    signingPublicKeystringrequired
    statusstringrequired
    one of active, disabled
    updatedAtstringrequired
    userIdstringrequired
  - grantsobjectrequired
    2 fields
    grantslist of objectrequired
    15 fields
    accessLevelstringrequired
    one of admin, read, write
    containerIdstringrequired
    createdAtstringrequired
    depthintegerrequired
    at least 0
    isBuiltinbooleanrequired
    metadataAccessEpochintegerrequired
    greater than 0
    metadataAccessStateHashstringrequired
    not empty
    metadataDocumentIdstringrequirednullable
    parentIdstringrequirednullable
    updatedAtstringrequired
    groupIdstringrequirednullable
    signingKeyFingerprintstringrequirednullable
    subjectIdstringrequired
    subjectTypestringrequired
    one of group, user
    userIdstringrequirednullable
    organizationIdstringrequired
  - groupMembershipsobjectrequired
    3 fields
    deletedGroupIdslist of stringrequired
    each item: not empty
    groupslist of objectrequired
    3 fields
    groupIdstringrequired
    memberslist of objectrequired
    2 fields
    rolestringrequired
    one of member, admin
    userIdstringrequired
    stateHashstringrequired
    not empty
    organizationIdstringrequired
  - groupsobjectrequired
    3 fields
    groupslist of objectrequired
    5 fields
    createdAtstringrequired
    currentStateobjectrequirednullable
    5 fields
    keyEpochintegerrequired
    at least 1
    keyFingerprintstringrequired
    not empty
    memberCountintegerrequired
    at least 0
    stateHashstringrequired
    versionintegerrequired
    at least 1
    groupIdstringrequired
    isBuiltinbooleanrequired
    organizationIdstringrequired
    memberGroupIdstringrequired
    organizationIdstringrequired
  - organizationPolicyobjectrequired
    2 fields
    currentStateobjectrequired
    5 fields
    keyEpochintegerrequired
    at least 1
    keyFingerprintstringrequired
    not empty
    memberCountintegerrequired
    at least 0
    stateHashstringrequired
    not empty
    versionintegerrequired
    at least 1
    organizationIdstringrequired
- modestringrequired
  - always snapshot

Other responses

Status	Meaning	Body
400	Bad Request	`application/json`OrganizationReadModelFailureResponse
401	Unauthorized	`application/json`SessionFailureResponse
403	Forbidden	`application/json`OrganizationPresentationFailureResponse
404	Not Found	`application/json`OrganizationPresentationFailureResponse
500	Internal Server Error	`application/json`ErrorResponse
503	Service Unavailable	`application/json`ErrorResponse

Additional rules

The server also enforces these rules, which the schema above cannot express.

Read-model lanes match the response organization; grants and memberships are unambiguous; snapshot lanes are complete and contain no deletions.