Cowdidocs
API ReferenceMerchant members

Delete a merchant member

DELETE
/v1/merchants/{id}/members/{userId}

Remove the user's membership and direct roles from the merchant. Core resolves the merchant's organization before authorization. Requires merchant:members:write on the merchant, from direct or inherited roles. Returns 204 when the user has no active membership.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

id*string

The merchant ID from the sales app.

Formatuuid
userId*string

The application user ID.

Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/v1/merchants/550e8400-e29b-41d4-a716-446655440001/members/660e8400-e29b-41d4-a716-446655440111"
Empty
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
Empty
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Revoke an invitation DELETE

Cancel the merchant's pending member invitation. Core resolves the merchant's organization before authorization. Requires `merchant:members:write` on the merchant, from direct or inherited roles. Returns 204 when the invitation does not exist or is no longer pending.

Change direct merchant roles PATCH

Add and remove the person's direct roles on this merchant. Group and inherited roles do not change. Requires `org:merchants:write` and `org:access.roles:write`. Each role applies on its own, so the request repeats safely. A request that fails part way keeps the roles it already applied. Read the access again to see the result. Removing every direct role preserves membership and inherited access.