Member accounts through the API

These routes act on a member’s Moon AI account, beyond their membership. The strongest ones (email address, two-factor authentication, password, disabling) only apply to a managed account: an account whose email address belongs to a domain verified by the organization, or that was created through its single sign-on or its directory. On an account that belongs to the person, they return 409 not_managed_account.

All routes live under https://chat.realmoon.ai/api/v1/orgs/{org_id}. Actions on an account follow the same rules as for members: never the key’s creator, the owner, an admin, or a member with more rights than the key (403 forbidden). The person concerned receives an email for each action, when email sending is set up.

Read a member’s account#Link to the Read a member’s account section

GET /members/{user_id}/account · members:read

{
  "managed": true,
  "managed_reason": "domain",
  "member_status": "active",
  "account": {
    "name": "Camille Martin",
    "email": "camille.martin@ecole.fr",
    "status": "active",
    "disabled_by_org": false,
    "sign_in": ["password", "google"],
    "two_factor": { "enabled": true, "method": "totp", "backup_codes_remaining": 8 },
    "last_active_at": 1762332000,
    "created_at": 1756684800,
    "sessions_revoked_at": null,
    "two_factor_required": true
  },
  "devices": [
    { "kind": "cli", "label": "Moon CLI", "created_at": 1762300000, "last_active_at": 1762330000, "expires_at": 1764892000, "ip": "203.0.113.x" },
    { "kind": "web", "label": "Chrome · Windows", "created_at": 1762331000, "last_active_at": 1762331000, "expires_at": null, "ip": "2001:0db8:0001::" }
  ],
  "verified_domains": ["ecole.fr"],
  "blocked": null,
  "can": { "sign_out_org": true, "sign_out_account": true, "edit": true, "reset_2fa": true, "password_reset": true, "disable": true, "enable": false, "offboard": true, "transfer_private": true }
}

Sign a member out#Link to the Sign a member out section

POST /members/{user_id}/account/sign-out · members:write

Response: {"scope": "organization", "signed_out": true, "cli_revoked": 2} (Moon CLI sessions closed), or {"scope": "account", "signed_out": true}.

Reset two-factor authentication#Link to the Reset two-factor authentication section

POST /members/{user_id}/account/reset-2fa · security:write · managed account

Removes the authenticator app, the email code and the backup codes; the person sets it up again the next time they sign in. All their sessions are closed. Response: {"reset": true, "had_two_factor": true}.

Send a password reset code#Link to the Send a password reset code section

POST /members/{user_id}/account/password-reset · security:write · managed account

Sends the person a 6-digit code valid for 15 minutes; it is never shown to the organization. Response: {"sent": true, "email_hint": "c***@ecole.fr"}.

Change the name or email address#Link to the Change the name or email address section

PATCH /members/{user_id}/account · security:write · managed account

Response: {"changed": ["email", "name"], "name": "…", "email": "…"}. A new email address closes every session and must be confirmed at the next sign-in; both the old and the new address are notified.

Disable and reactivate an account#Link to the Disable and reactivate an account section

POST /members/{user_id}/account/disable · security:write · managed account

The person can no longer sign in anywhere; they remain a member. All their sessions are closed. Response: {"disabled": true, "disabled_at": 1762339200}.

POST /members/{user_id}/account/enable · security:write · managed account

Reverses a disabling done by this organization, and only by this one. Response: {"disabled": false}.

Offboarding a member#Link to the Offboarding a member section

List what they own#Link to the List what they own section

GET /members/{user_id}/resources · members:read

{
  "resources": {
    "agents": { "total": 2, "shared": 2 },
    "knowledge": { "total": 5, "shared": 3 },
    "notes": { "total": 12, "shared": 1 },
    "prompts": { "total": 4, "shared": 4 },
    "tools": { "total": 0, "shared": 0 }
  },
  "managed": true,
  "kinds": ["agents", "knowledge", "notes", "prompts", "tools"]
}

Transfer, remove, disable#Link to the Transfer, remove, disable section

POST /members/{user_id}/offboard · members:write

Runs these steps in order: transfer of resources, removal from the organization, disabling of the account. Everything is checked before the first change.

curl https://chat.realmoon.ai/api/v1/orgs/$ORG_ID/members/$USER_ID/offboard \
  -H "Authorization: Bearer $MOONAI_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"transfer_to": "<successor id>", "kinds": ["knowledge", "prompts"], "remove": true}'

import os
import requests

BASE = f"https://chat.realmoon.ai/api/v1/orgs/{os.environ['ORG_ID']}"
HEADERS = {"Authorization": f"Bearer {os.environ['MOONAI_ADMIN_KEY']}"}

r = requests.post(
    f"{BASE}/members/{os.environ['USER_ID']}/offboard",
    headers=HEADERS,
    json={"transfer_to": os.environ["SUCCESSOR_ID"], "kinds": ["knowledge", "prompts"], "remove": True},
    timeout=60,
)
r.raise_for_status()
print(r.json())

const BASE = `https://chat.realmoon.ai/api/v1/orgs/${process.env.ORG_ID}`;
const r = await fetch(`${BASE}/members/${process.env.USER_ID}/offboard`, {
  method: 'POST',
  headers: { Authorization: `Bearer ${process.env.MOONAI_ADMIN_KEY}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({ transfer_to: process.env.SUCCESSOR_ID, kinds: ['knowledge', 'prompts'], remove: true }),
});
if (!r.ok) throw new Error(await r.text());
console.log(await r.json());

Response: {"transferred": {"knowledge": 3, "prompts": 4}, "removed": true, "account_disabled": false} (with disabled_at when the account was disabled). Transferred resources keep their shares. The removal sends the member.removed event.

Account requirements#Link to the Account requirements section

Read the requirements#Link to the Read the requirements section

GET /security/requirements · security:read

{
  "settings": { "require_2fa": true, "grace_until": 1763000000, "max_session_hours": 168, "sessions_valid_after": null, "updated_at": 1762339200, "updated_by": "3f2b9c1d-7e4a-4b8c-9d0e-1f2a3b4c5d6e" },
  "limits": { "grace_days_max": 90, "session_hours_min": 1, "session_hours_max": 2160 },
  "sso": { "configured": true, "active": true, "enforced": false },
  "verified_domains": ["ecole.fr"],
  "members": { "active": 120, "compliant": 97, "missing": 23 }
}

A member meets the requirements when they have turned on two-factor authentication, or when they sign in through the organization’s required single sign-on.

Change the requirements#Link to the Change the requirements section

PUT /security/requirements · security:write

Send at least one field; a missing field does not change. The response has the same shape as the read, without members. Requiring two-factor authentication right away returns 409 actor_without_2fa when the key’s creator has not turned it on themselves. A member without two-factor authentication once the grace period is over can no longer work in the organization (403 org_2fa_required).

List members who do not meet the requirements#Link to the List members who do not meet the requirements section

GET /security/requirements/members · security:read

Parameters: filter (missing, the default, or all), page, limit. Each item: user_id, name, email, last_active_at, two_factor. The response also includes settings, active_members, compliant and missing.

Sign everyone out#Link to the Sign everyone out section

POST /security/sign-out-all · security:write

No session opened before now can act in the organization any longer: everyone signs in again, including the key’s creator. The key itself keeps working. Response: {"signed_out": true, "valid_after": 1762339200}.

What the organization requires of the key’s creator#Link to the What the organization requires of the key’s creator section

GET /me/requirements · no scope

Returns require_2fa, two_factor_enabled, two_factor_missing, grace_until, blocked, can_switch_out and max_session_hours for the person who created the key.

See also#Link to the See also section

• Domains, which make an account managed
• Members