Members API

REST endpoints for members in ServFlo: 4 operations with parameters, request and response fields, permissions and curl examples.

Base URL: https://app.servflo.ai/api. Every call needs Authorization: Bearer sfk_… (Authentication); {organizationId} ($ORGANIZATION_ID in the examples) is your business's id.

Operation	Endpoint	Risk
List the team (members and roles)	`GET /organizations/{organizationId}/team`	`read`
Invite someone to the team with a role	`POST /organizations/{organizationId}/team/invitations`	`sensitive`
Change a team member's role	`PATCH /organizations/{organizationId}/team/{userId}`	`sensitive`
Remove a team member	`DELETE /organizations/{organizationId}/team/{userId}`	`sensitive`

List the team (members and roles)

GET /organizations/{organizationId}/team

Everyone in the organization with their role (owner, admin, dispatcher, technician, member), for any caller including API keys and AI apps. Emails only for callers with members.manage (else null, except your own). Each person's role is Base316's live one; someone removed elsewhere drops off. Use the user ids with team.remove and technicians.link (team.changeRole is for signed-in people). Read-only.


Permission	`members.read` (Owner, Admin, Dispatcher, Member)
Risk	`read`, OAuth scope `servflo.read`. Read: reads only.
MCP tool	`team_members` (toolset `team`)

Example

curl "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/team" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

Field	Type	Description
`members`	array of object
`members[].userId`	string
`members[].name`	string or null
`members[].email`	string or null
`members[].image`	string or null
`members[].role`	object
`members[].role.key`	string	Base316 role key: owner, admin, dispatcher, technician or member.
`members[].role.name`	string
`members[].joinedAt`	string
`members[].isYou`	boolean	Whether this member is the caller.

Invite someone to the team with a role

POST /organizations/{organizationId}/team/invitations

Grants access: brings email into the organization with role: makes a Base316 invitation, emails its acceptance link to the person from ServFlo and returns the link once (emailed, else emailReason). An API key or AI app's call waits for the person's approval in ServFlo first (428 APPROVAL_REQUIRED); once approved it makes the new person's account at once with the role (status ADDED, no email: send them url), and an email that already has an account is refused (409: a person invites existing accounts from Settings → Members). Only an owner can bring in an owner. Any role except technician takes one of the plan's office users (402 PLAN_LIMIT_REACHED when none is left); technicians are unlimited. To make the new person a technician's login, call technicians.link once they have joined.


Permission	`members.manage` (Owner, Admin)
Risk	`sensitive`, OAuth scope `servflo.sensitive`. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access.
MCP tool	`team_invite` (toolset `team`)
Approval	Waits for your approval in ServFlo when called with an API key or a connected app: the first call answers `428 APPROVAL_REQUIRED`; once you approve it, repeat the call with the `X-ServFlo-Approval` header. See Approvals.

Request body

Field	Type	Required	Description
`email`	string (email)	Yes	Who to invite. Up to 254 characters.
`role`	enum	No	owner: Everything, including billing ownership and deleting the organization. admin: Everything except billing ownership and deleting the organization. dispatcher: Runs the day: customers, requests, quotes, jobs, the schedule, invoices and recording payments. No refunds, settings or team changes. technician: In the field: their jobs and My day, notes, checklists, materials, photos, forms, service reports (filled in, not published) and status; quotes from the pricebook and payment on their own jobs (when the business allows it); their own time, truck stock and commissions; reads the customers and properties they visit. member: Read-only: sees the work, but not payments, settings or the activity log. One of `owner`, `admin`, `dispatcher`, `technician`, `member`. Default `member`.
`name`	string	No	Their name, for a new account (API keys and AI apps). Up to 200 characters.

Example

curl -X POST "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/team/invitations" \
  -H "Authorization: Bearer $SERVFLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"dana@example.com"}'

Response

201: the answer's fields

Field	Type	Description
`status`	enum	Invited: a Base316 invitation was made (signed-in person); `url` is its acceptance link, returned once. ADDED: an API key or AI app made a new account for the email and added it with the role; `url` is where they sign in (with a sign-in link or Forgot password). One of `INVITED`, `ADDED`.
`email`	string
`role`	string	The role they join with.
`userId`	string or null	The new member's user id (ADDED), else null until they accept.
`invitationId`	string or null
`url`	string	Invited: the acceptance link, also emailed to the person. ADDED: where they sign in; nothing is emailed, so send it yourself.
`expiresAt`	string or null	When the invitation link expires (INVITED).
`emailed`	boolean	Whether ServFlo emailed the acceptance link to the invited address (from ServFlo, with the business's name and the role).
`emailReason`	string or null	Why it was not emailed (then send `url` yourself); null when it was.

Change a team member's role

PATCH /organizations/{organizationId}/team/{userId}

Grants or revokes access: gives the member another role, which changes what they may do at once (their sessions, API keys and AI apps follow within seconds). Only an owner can grant or take away owner; nobody changes their own role. An API key or AI app's call waits for the person's approval in ServFlo first (428 APPROVAL_REQUIRED). Moving a technician to any other role takes an office user from the plan (402 PLAN_LIMIT_REACHED when none is left). Get user ids from team.members. Returns the member.


Permission	`members.manage` (Owner, Admin)
Risk	`sensitive`, OAuth scope `servflo.sensitive`. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access.
MCP tool	`team_changeRole` (toolset `team`)
Approval	Waits for your approval in ServFlo when called with an API key or a connected app: the first call answers `428 APPROVAL_REQUIRED`; once you approve it, repeat the call with the `X-ServFlo-Approval` header. See Approvals.

Parameters

Name	In	Type	Required	Description
`userId`	path	string	Yes	The member's user id (from GET …/members). Up to 200 characters.

Request body

Field	Type	Required	Description
`role`	enum	Yes	owner: Everything, including billing ownership and deleting the organization. admin: Everything except billing ownership and deleting the organization. dispatcher: Runs the day: customers, requests, quotes, jobs, the schedule, invoices and recording payments. No refunds, settings or team changes. technician: In the field: their jobs and My day, notes, checklists, materials, photos, forms, service reports (filled in, not published) and status; quotes from the pricebook and payment on their own jobs (when the business allows it); their own time, truck stock and commissions; reads the customers and properties they visit. member: Read-only: sees the work, but not payments, settings or the activity log. One of `owner`, `admin`, `dispatcher`, `technician`, `member`.

Example

curl -X PATCH "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/team/{userId}" \
  -H "Authorization: Bearer $SERVFLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"role":"owner"}'

Response

200: the answer's fields

Field	Type	Description
`userId`	string
`name`	string or null
`email`	string or null
`image`	string or null
`role`	object
`role.key`	string	Base316 role key: owner, admin, dispatcher, technician or member.
`role.name`	string
`joinedAt`	string
`isYou`	boolean	Whether this member is the caller.

Remove a team member

DELETE /organizations/{organizationId}/team/{userId}

Revokes access: removes the person from the organization (their account and other organizations stay; their API keys and AI apps here stop working). Only an owner can remove an owner; nobody removes themselves this way. Their records (notes, jobs, time) stay. Get user ids from team.members.


Permission	`members.manage` (Owner, Admin)
Risk	`sensitive`, OAuth scope `servflo.sensitive`. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access.
MCP tool	`team_remove` (toolset `team`)
Approval	Over MCP, this tool always waits for your approval in ServFlo. See Approvals.

Parameters

Name	In	Type	Required	Description
`userId`	path	string	Yes	The member's user id (from GET …/members). Up to 200 characters.

Example

curl -X DELETE "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/team/{userId}" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

Field	Type	Description
`ok`	true
`userId`	string

On this page