Cowdidocs
API ReferenceMerchant members

Change direct merchant roles

PATCH
/v1/merchants/{id}/members/{userId}/roles

Add and remove the person's direct roles on this merchant. Group and inherited roles do not change. Requires org:merchants:write and org:access.roles:write. Each role applies on its own, so the request repeats safely. A request that fails part way keeps the roles it already applied. Read the access again to see the result. Removing every direct role preserves membership and inherited access.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

id*string

The merchant ID from the sales app.

Formatuuid
userId*string

The application user ID.

Formatuuid

Request Body

application/json

The direct roles to add and the direct roles to remove. Send either one on its own.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PATCH "https://example.com/v1/merchants/550e8400-e29b-41d4-a716-446655440001/members/660e8400-e29b-41d4-a716-446655440111/roles" \  -H "Content-Type: application/json" \  -d '{}'
Empty
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Delete a merchant member DELETE

Remove the user's membership and direct roles from the merchant. Core resolves the merchant's organization before authorization. Requires `merchant:members:write` on the merchant, from direct or inherited roles. Returns 204 when the user has no active membership.

List pending invitations through an organization GET

Deprecated. Use `GET /v1/merchants/{id}/invitations`. Requires `merchant:members:read` on the merchant. The organization must match the caller and the merchant.