Skip to main content

Account & tokens

📄️The signed-in person

The signed-in person (roles, is_admin, namespace, `email_verified`: false until the emailed link is opened — runs wait for it; resend with POST /csl/auth/v1/email/verification-notification), `terms_accepted` (false when the person never accepted the terms in force: no version, or older than `terms_version`; accept with POST /api/v3/me/terms) and `terms_version`, the account the request acts for (`account`, with the member's `permissions`, `custom_role` and agency `branding`), every account they can switch to (`accounts`: own, organizations, and client workspaces of agencies they run; each with is_agency, status, parent) `pending_invitations`, `locale` (en|vi|null) and `theme` (light|dark|system|null, see /api/v3/me/preferences), `username` and `avatar_url` (see /api/v3/me/profile). One query for the agencies of the listed client workspaces, none per client

📄️Get security (me)

Dashboard session only. Settings → Login & Privacy: recent_until (sensitive changes open until; null = confirm the password at POST /csl/auth/v1/reauth {password, code}), reauth_minutes, session_lifetime_days (the person's, null = default_session_days), the person's dashboard sessions (id, ip_address, user_agent, created_at, last_used_at, expires_at, is_current), trusted_devices (browsers where sign-in skips the 2FA code: id, device, ip_address, created_at, last_used_at, expires_at, is_current) with trusted_device_days (0 = off), and general_access of the acting account (RESTRICTED | ANYONE_WITH_ID_CAN_READ) with can_manage_general_access

📄️The Getting started checklist of the acting account

The Getting started checklist of the acting account: {hidden, done, total, complete, tracks: [{key: listening|actors, steps: [{key, done, detail?}]}]}. Steps come from each module (OnboardingSteps): project_created (detail.project_id), source_added, collected, channel_set; run_started, run_succeeded (detail.run: the latest run, id, status, actor, default_dataset_id), schedule_created, token_created. The listening track shows only to who may see listening and while the account has 2 projects or fewer

📄️Create a token for the acting account

Dashboard session only. Create a token for the acting account (the plain token is in the answer, once). In an organization it acts for the organization and stops working when its creator leaves. `permissions` (keys from /api/v3/me/token-permissions) limits the token to those (`perm:⟨key⟩` abilities): anything they do not cover (billing, team, token management, …; listening needs `listening.read` / `listening.write`) answers 403 `insufficient_permissions`; `GET /api/v3/me` stays open. `scope: read_only` tokens may only GET/HEAD. `actor_ids` (ids or `user~name`) limits the token to those actors (read, builds, start runs), their runs (read, log, abort) and reading the default storages of those runs (by id; writes are the run's own token's); on /api/v3/mcp and /api/v3/standby the same scope applies. Stored as Sanctum abilities `*` or `read`, `actor:⟨id⟩`, plus `member:⟨id⟩` for organization tokens. The list answers `scope` and `actor_ids` per token.

📄️Create convert to organization (me)

Settings → Organizations: turns the person's own account into an organization. Dashboard session of the person's own account only. The account keeps its id and everything keyed by it (actors and `u{id}` namespace, runs, storages, plan, credit, Paddle customer, earnings, username and profile); a new personal account with the same email, password and 2FA becomes its owner. Dashboard sessions end (sign in again); API tokens keep working as organization tokens of the owner; AI apps connected through OAuth are disconnected (connect them again for the organization). Refused for Lantfly staff and for members of any organization