admin, member, and viewer. An admin can perform all write operations and manage the team. A member can create and edit tests, runs, and graders. A viewer can read everything but cannot write.
List members
Returns everyone currently in your organization. Available to all roles.GET /api/members
array
Array of member objects.
boolean
Whether the authenticated user has permission to invite, re-role, remove, or deactivate members. Use this to conditionally render admin controls in your own tooling.
List members
Member object
string
The user’s unique identifier. Use this in role, remove, and deactivate operations.
string
The user’s email address.
string
The user’s display name.
string
Current role:
"admin", "member", or "viewer".string
ISO 8601 timestamp of when they joined the organization.
string | null
ISO 8601 timestamp of when the account was deactivated.
null for active members.List pending invitations
Returns invitations that have been sent but not yet accepted. Admin only.GET /api/invitations
array
Array of pending invitation objects.
List pending invitations
Invitation object
string
The invitation’s identifier.
string
The email address the invitation was sent to.
string
The role the invited person will receive when they accept.
string
ISO 8601 timestamp of when the invitation expires.
string
The user ID of the admin who sent the invitation.
string
ISO 8601 timestamp of when the invitation was created.
Invite a member
Sends an invitation to join your organization. Admin only.POST /api/invitations
string
required
The email address to invite.
string
The role to assign when the invitation is accepted. One of
"admin", "member", or "viewer". Defaults to "admin" when omitted.201 Created with the invitation object and delivery status.
boolean
true if Egma sent the invitation email. false if your deployment has no SMTP configured.string
The acceptance link, included only when
delivered is false. Pass this link to the invitee through your own channel. The link is single-use and expires.Invite a member
If your Egma instance has no SMTP configured,
delivered is false and the response includes accept_url. Copy that URL and send it to the invitee yourself — through Slack, email, or any other channel. The invitation still works exactly the same way; Egma just could not post the message for you.An invitation token is 256 bits of randomness and is hashed on write. Egma stores only the hash, never the plaintext. The
accept_url is present in this response only, and is not retrievable from the invitations list.Change a member’s role
Updates a member’s role. Takes effect immediately — any API key that member holds re-reads their role on the next request, so no key rotation is needed. Admin only.POST /api/members/:userId/role
string
required
The
user_id of the member whose role you want to change.string
required
The new role. One of
"admin", "member", or "viewer".Change a member's role
You cannot demote the last admin in an organization. Egma returns
409 Conflict with error: "last_admin". Promote another member to admin first, then change the original admin’s role.Remove a member
Removes a person from the organization and revokes all API keys they created. Their name remains on everything they authored. Admin only.POST /api/members/:userId/remove
string
required
The
user_id of the member to remove.string
The ID of the removed member.
number
The number of API keys revoked as part of this operation.
Remove a member
Removing a member revokes all API keys they created, effective immediately. Any service using one of those keys stops authenticating on its next request. Rotate affected keys before removing the member if you need uninterrupted service.
Deactivate an account
Deactivates a user account without removing the person from the organization. All API keys they created stop working immediately. Their membership record and everything they authored remain intact. Admin only.POST /api/members/:userId/deactivate
string
required
The
user_id of the member to deactivate.deactivated_at set.
Deactivate an account
Deactivation is the deprovisioning path — it shuts off access without erasing history. Use this when an employee leaves but you want to keep their contribution record intact. Use remove when you want to clear the membership entirely.