Account & teams

Preview Account and team resources sit at the top of the object graph. Your account owns API keys; teams own members, projects, sites, invites, an audit trail, and a plan. These resources are product-agnostic — they look the same whether your sites run WordPress, static, or any future runtime.

Developer preview

The managed.dev public API is in active development. Endpoints, scopes, and payloads described here reflect the current design and may change before general availability.

Account

Your account is the principal behind a personal key. There is exactly one account per authenticated user; team membership is layered on top.

GET /v1/account

account:read Retrieve the authenticated account.

Retrieve the current account

curl https://api.managed.dev/v1/account \
  -H "Authorization: Bearer mfk_live_..."

Response

{
  "data": {
    "id": "acct_01J5...",
    "email": "dev@example.com",
    "name": "Avery Dev",
    "created_at": "2026-01-12T09:31:04Z",
    "default_team_id": "team_01J6..."
  },
  "request_id": "req_01J9..."
}

PATCH /v1/account

account:write Update mutable account fields such as name and notification preferences.

Parameter	Type	Required	Description
name	string	no	Display name for the account.
default_team_id	string	no	Team a key falls back to when no team is specified.

Teams

A team is the unit of collaboration and billing. Sites live in projects, projects live in teams, and roles are assigned per team.

GET /v1/teams

teams:read List the teams you belong to, cursor-paginated.

POST /v1/teams

teams:write Create a team. You become its owner.

Parameter	Type	Required	Description
name	string	yes	Human-readable team name.
slug	string	no	URL-safe identifier; generated from name if omitted.

cURL

Create a team

curl -X POST https://api.managed.dev/v1/teams \
  -H "Authorization: Bearer mfk_live_..." \
  -H "Idempotency-Key: 9c2f...a1" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Acme Web" }'

Go

Create a team

team, err := client.Teams.Create(ctx, &forge.TeamCreateParams{
    Name: forge.String("Acme Web"),
}, forge.WithIdempotencyKey("9c2f...a1"))

TypeScript

Create a team

const team = await client.teams.create(
  { name: "Acme Web" },
  { idempotencyKey: "9c2f...a1" },
);

Response

{
  "data": {
    "id": "team_01J6...",
    "name": "Acme Web",
    "slug": "acme-web",
    "role": "owner",
    "created_at": "2026-06-24T14:02:55Z"
  },
  "request_id": "req_01J9..."
}

GET · PATCH · DELETE /v1/teams/{id}

Retrieve (teams:read), update (teams:write), or delete (teams:admin) a team. Delete and transfer are non-instant and return a job.

Members & roles

Members are added to a team with one of five roles. The role caps everything a member — and any key they mint — can do.

Role	Can do
owner	Everything, including deleting the team and managing billing.
admin	Manage members, projects, and sites; cannot delete the team.
site_manager	Operate sites and environments; no member or billing management.
observer	Read-only access to sites, observability, and audit.
billing	Plan, usage, and billing only; no site access.

GET · POST · PATCH · DELETE /v1/teams/{id}/members[/{memberID}]

teams:read to list, teams:write to add, change a role, or remove a member.

Parameter	Type	Required	Description
email	string	yes	Email of the person to add.
role	string	yes	One of owner, admin, site_manager, observer, billing.

Add a member as site_manager

curl -X POST https://api.managed.dev/v1/teams/team_01J6.../members \
  -H "Authorization: Bearer mfk_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "email": "casey@example.com", "role": "site_manager" }'

Projects, invites & sites

• Projects group sites within a team. GET/POST/PATCH/DELETE /v1/teams/{id}/projects[/{projectID}], gated by teams:read/teams:write. See projects.
• Invites are pending memberships. GET/POST/DELETE /v1/teams/{id}/invites[/{inviteID}] (teams:write).
• Sites within a team are listed at GET /v1/teams/{id}/sites (sites:read), a convenience filter over the sites collection.

Audit log

GET /v1/teams/{id}/audit

audit:read Every meaningful action on the team — deploys, member changes, key mints, config edits — as a cursor-paginated feed.

Parameter	Type	Required	Description
actor	string	no	Filter to a single member or key.
action	string	no	Filter to one action type, e.g. site.deployed.
limit	integer	no	Page size; see pagination.
cursor	string	no	Opaque cursor from a previous page.

Read the audit log

curl "https://api.managed.dev/v1/teams/team_01J6.../audit?limit=50" \
  -H "Authorization: Bearer mfk_live_..."

Response

{
  "data": [
    {
      "id": "evt_01J9...",
      "action": "site.deployed",
      "actor": { "type": "api_key", "id": "key_01J7...", "label": "deploy-bot" },
      "resource": { "type": "environment", "id": "env_01J8..." },
      "created_at": "2026-06-24T13:58:10Z"
    }
  ],
  "pagination": { "next_cursor": "eyJ0...", "has_more": true },
  "request_id": "req_01J9..."
}

Plan, usage & quota

GET /v1/teams/{id}/plan · GET /v1/teams/{id}/usage

teams:read Read the team’s plan, its limits, and current usage against those limits — sites, environments, and storage. Use this before a create call to avoid a quota_exceeded error.

Usage response (figures are examples)

{
  "data": {
    "plan": "developer",
    "limits": { "sites": 5, "branch_environments": 10, "storage_gb": 25 },
    "usage":  { "sites": 3, "branch_environments": 6, "storage_gb": 11.4 }
  },
  "request_id": "req_01J9..."
}

Note

Plan limits are enforced server-side; the numbers above are illustrative. See plans & limits for the catalog and how quotas behave.

Next steps

Teams & rolesWhat each of the five roles can do, and how RBAC caps every key.

API keysMint scoped keys whose effective permission is bounded by a member's role.

Security modelThe triple-intersection rule: role ∩ scopes ∩ resource constraint.