api.user.m7.org API Reference

api.user.m7.org is the management API for M7 accounts, organizations, organization members, OAuth applications, and offline-access records. Use it after a person or application has obtained an access token from M7 SSO.

Manage accounts, organizations, applications, and offline access in the M7 user application.

Base URL

https://api.user.m7.org/api/v2

Authorization

This service uses a project-specific authorization profile. Every documented endpoint except /oauth/clients/connections/verify expects an access token in the Authorization header:

Authorization: Bearer <ACCESS_TOKEN>

Some human sessions are additionally bound to a DPoP key, a fingerprint, or both. Requests made with a bound session must include the companion headers described in the authorization guide.

Use the M7 SSO API documentation for the standards-facing OAuth and OpenID Connect endpoints, including:

  • https://sso.user.m7.org/authorize
  • https://sso.user.m7.org/token
  • https://sso.user.m7.org/device_authorization
  • https://sso.user.m7.org/register

Access tokens are scoped to a principal. Use the token that matches the work you need to perform:

Token principal Supported use
Consumer user The user's account and personal applications, plus organizations where the user has active Management-group access.
Organization member /session/me and any other endpoint that explicitly documents organization-member support.
Organization machine application Organization routes for the application's assigned organization. Machine applications cannot create organizations.

/session/me rejects application tokens. Organization operations require access to the selected organization; personal application operations require the signed-in user's ownership of that application. An organization-member token alone does not authorize organization-management routes. The connection verification endpoint is a token-check helper: it accepts a token request field instead of a bearer token.

Request and response format

Send JSON request bodies with Content-Type: application/json. The current handlers accept several methods for compatibility, but POST is the supported integration contract used throughout this reference. Every relative route in the guide tables is therefore a POST route under the base URL.

Successful calls use this envelope:

{
  "status": 1,
  "comment": "ACTION",
  "data": {}
}

Failures use this envelope:

{
  "status": 0,
  "code": 400,
  "comment": "Invalid token"
}

status is an application result (1 or 0), not the HTTP status. Handle the HTTP status independently. Common examples are 400 for an invalid token, 404 for an unknown path, and 501 for an unimplemented route.

The comment is a stable action result such as OK, INSERT, SET_KNOBS, or ISSUE_WEB. Use the documented data fields for program flow rather than matching a human-readable error message.

Pagination

List and search endpoints accept the pagination fields below. Send at least one of them to receive a pageable object in data; otherwise, most endpoints return a raw array in data.

Field Required Notes
limit No Default is usually 20. Values below 1 fall back to the default; valid values are capped at the endpoint maximum, usually 100.
page_number No One-based page number. Invalid values fail the request.
offset No Offset-based alternative to page_number.
cursor No Opaque continuation value. Send the previous response's next_cursor.

A pageable response has these data keys:

{
  "items": [],
  "limit": 20,
  "total_count": 0,
  "next_offset": 20,
  "page_number": 1,
  "page_total": 0,
  "next_cursor": null
}

Object map

The API uses a few similarly named objects. These terms distinguish them.

Name Path or payload key Meaning
User /account/me/* A consumer account.
Organization /org/* An organization and its member pool.
Org member /org/client/* An organization-scoped member record. The route path uses client; product language uses member. /session/me returns this as data.client.
OAuth app /oauth/clients/* An OAuth application registration. Its public identifier is client_id; its API record identifier is id.
Management group /org/manage/* The built-in organization administration group. It is distinct from /org/group/*.

Guides