Managed clients API
Create, read, and detach a client the MSP manages.
POST creates a client and links it without a relationship handshake. DELETE detaches the link. It does not delete the organisation. The path is /api/msps/:mspId/clients and /api/msps/:mspId/clients/:clientId.
Use Relationships API instead when the organisation already exists and must approve the MSP link.
Endpoints
| Method | Path | What it does |
|---|---|---|
| GET | /api/msps/:mspId/clients | List managed clients |
| POST | /api/msps/:mspId/clients | Create a managed client |
| GET | /api/msps/:mspId/clients/:clientId | Read a managed client |
| PUT | /api/msps/:mspId/clients/:clientId | Rename a managed client |
| DELETE | /api/msps/:mspId/clients/:clientId | Detach a managed client |
| GET | /api/msps/:mspId/clients/:clientId/members | List managed-client members |
| PUT | /api/msps/:mspId/clients/:clientId/members/:memberId | Change member roles |
| DELETE | /api/msps/:mspId/clients/:clientId/members/:memberId | Remove a member |
| GET | /api/msps/:mspId/clients/:clientId/invites | List managed-client invites |
| POST | /api/msps/:mspId/clients/:clientId/invites | Create an invite |
| PUT | /api/msps/:mspId/clients/:clientId/invites/:inviteId | Respond to an invite |
| DELETE | /api/msps/:mspId/clients/:clientId/invites/:inviteId | Delete an invite |
| GET | /api/msps/:mspId/clients/:clientId/telemetry | Read managed-client telemetry |
Create a managed client
POST /api/msps/:mspId/clients creates the organisation and links it to the MSP. A Stripe customer and a default configuration with billing charged to the MSP are created with it.
Request
curl -X POST "https://api.requestrocket.com/api/msps/:mspId/clients" \
-H "Authorization: u-your-token" \
-H "Content-Type: application/json" \
-d '{
"clientName": "Managed example"
}'import axios from "axios";
const response = await axios.request({
method: "POST",
url: "https://api.requestrocket.com/api/msps/:mspId/clients",
headers: {
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data: {
"clientName": "Managed example"
}
});
console.log(response.status, response.data);import requests
response = requests.request(
"POST",
"https://api.requestrocket.com/api/msps/:mspId/clients",
headers={
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data="{\n \"clientName\": \"Managed example\"\n}"
)
print(response.status_code, response.json())package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
payload := strings.NewReader(`{
"clientName": "Managed example"
}`)
req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/msps/:mspId/clients", payload)
req.Header.Set("Authorization", "u-your-token")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(resp.StatusCode, string(body))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.requestrocket.com/api/msps/:mspId/clients"))
.method("POST", HttpRequest.BodyPublishers.ofString("{\n \"clientName\": \"Managed example\"\n}"))
.header("Authorization", "u-your-token")
.header("Content-Type", "application/json")
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode());
System.out.println(response.body());
}
}Responses
{
"clients": [
{
"clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
"clientName": "Managed example",
"clientMembers": [],
"clientMSPs": [
"msp-id"
],
"clientStripeId": "cus_Example",
"clientStripeSessionId": null,
"clientStripeSubscriptions": [],
"clientCreated": "2026-11-02T07:30:00.000Z",
"clientUpdated": "2026-11-02T07:30:00.000Z"
}
],
"message": "Client created and linked to MSP"
}{
"message": "Client with same name already exists"
}{
"Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}{
"message": "method / endpoint not supported"
}Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
clientName | string | ✓ | Organisation name, 3 to 256 characters. Letters, numbers, spaces, and hyphens. The name must be unique. |
Returns the new organisation, already linked to the MSP. A Stripe customer and a default configuration with billing charged to the MSP are created with it. clientMembers is empty.
Response
| Attribute | Type | Description |
|---|---|---|
clients | array | The created organisation. |
clients[].clientId | string | Organisation id. |
clients[].clientName | string | Name from the request. |
clients[].clientMembers | array | Empty on create. |
clients[].clientMSPs | string[] | MSP ids linked to this organisation. Contains this MSP. |
clients[].clientStripeId | string | Stripe customer id. |
clients[].clientStripeSessionId | string or null | Checkout session. Null until one is opened. |
clients[].clientStripeSubscriptions | array | Stripe subscriptions. |
clients[].clientCreated | string | ISO-8601 create time. |
clients[].clientUpdated | string | ISO-8601 update time. |
message | string | Client created and linked to MSP. |
List managed clients
GET /api/msps/:mspId/clients returns every organisation linked to the MSP.
Query parameters
None.
Response
| Attribute | Type | Description |
|---|---|---|
clients | array | Linked organisations. |
clients[].clientId | string | Organisation id. |
clients[].clientName | string | Organisation name. |
clients[].clientMembers | array | Members, each with userId and roles. |
clients[].clientMSPs | string[] | Linked MSP ids. |
message | string | Success. |
Rename a managed client
PUT /api/msps/:mspId/clients/:clientId updates the organisation name. All fields are optional. Omit a field to leave it unchanged.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
clientName | string | Replacement name. |
Returns the organisation after the update, including clientUpdated.
Response
| Attribute | Type | Description |
|---|---|---|
clients | array | The organisation. |
clients[].clientName | string | Name after the update. |
clients[].clientUpdated | string | ISO-8601 time of this call. |
message | string | Client updated. |
List managed-client members
GET /api/msps/:mspId/clients/:clientId/members returns the organisation team.
Query parameters
None.
Response
| Attribute | Type | Description |
|---|---|---|
members | array | Organisation members. |
members[].userId | string | User id. |
members[].userFirstName | string | Given name. |
members[].userLastName | string | Family name. |
members[].userEmail | string | Email address. |
members[].roles | string[] | One or more of owner, admin, devops, user, reader. |
message | string | Success. |
Change managed-client member roles
PUT /api/msps/:mspId/clients/:clientId/members/:memberId replaces one member's roles. There is no POST on this path; add someone with an invite.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
roles | string[] | ✓ | Replacement roles. At least one of owner, admin, devops, user, reader. Only an owner of the organisation can grant or remove owner. |
Returns the updated membership, with userId and roles.
Response
| Attribute | Type | Description |
|---|---|---|
members | array | The updated membership. |
members[].userId | string | Member id from the path. |
members[].roles | string[] | Roles after the owner guard. |
message | string | Member roles updated. |
List managed-client invites
GET /api/msps/:mspId/clients/:clientId/invites returns every invite stored for the organisation.
Query parameters
None.
Response
| Attribute | Type | Description |
|---|---|---|
invites | array | Invites whose parent is this organisation. |
invites[].inviteId | string | Invite id. |
invites[].parentId | string | Organisation id. |
invites[].clientName | string | Organisation name. |
invites[].userEmail | string | Invited email address. |
invites[].roles | string[] | Roles the invite will grant. |
invites[].inviteType | string | client when set. |
invites[].TTL | number | Expiry stored on the invite. |
message | string | Success. |
Create a managed-client invite
POST /api/msps/:mspId/clients/:clientId/invites invites an email address onto the organisation. A repeat invite for the same address updates the existing invite.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
userEmail | string | ✓ | Email address to invite. |
userName | string | Name used in the invitation email. | |
roles | string[] | ✓ | At least one of owner, admin, devops, user, reader. Only an owner of the organisation can grant owner. |
Returns the invite that was sent or refreshed.
Response
| Attribute | Type | Description |
|---|---|---|
invites | array | The invite. |
invites[].inviteId | string | Invite id. |
invites[].parentId | string | Organisation id. |
invites[].userEmail | string | Invited email address. |
invites[].roles | string[] | Roles on the invite. |
invites[].inviteType | string | client. |
message | string | Invite sent. |
Update a managed-client invite
PUT /api/msps/:mspId/clients/:clientId/invites/:inviteId replaces the roles on a pending invite and extends its expiry by 14 days.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
roles | string[] | ✓ | Replacement roles. At least one of owner, admin, devops, user, reader. Only an owner of the organisation can grant or remove owner. |
Returns the invite after the role replacement.
Response
| Attribute | Type | Description |
|---|---|---|
invites | array | The updated invite. |
invites[].roles | string[] | Roles from the request. |
invites[].TTL | number | Unix time, in seconds, 14 days from this call. |
message | string | Invite updated. |
Read managed-client telemetry
GET /api/msps/:mspId/clients/:clientId/telemetry returns call series for the managed organisation. The series is the organisation rollup, the same shape as the organisation telemetry route.
Query parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
interval | string | Bucket size: minute, hour, day, or month. Defaults to hour. | |
startDate | string | Start of the window. An ISO-8601 time or a Unix timestamp in seconds or milliseconds. | |
endDate | string | End of the window. Defaults to now when a start is set. Same formats as startDate. | |
limit | number | Maximum buckets returned, most recent first. Defaults to 60 for minute, 24 for hour, 30 for day, and 12 for month. |
There is no cursor or nextToken. limit caps how many buckets are returned.
Returns the interval you asked for and the buckets, newest first.
Response
| Attribute | Type | Description |
|---|---|---|
interval | string | Bucket size used for this response. |
telemetry | array | One object per bucket. |
telemetry[].sKey | string | Bucket timestamp. |
telemetry[].clientId | string | Organisation id. |
telemetry[].countMap | object | Request counts keyed by source, such as target. |
telemetry[].successCountMap | object | Successful request counts by source. |
telemetry[].errorCountMap | object | Failed request counts by source. |
telemetry[].averageResponseTimeMap | object | Average response time by source, computed on read. |
message | string | Success. |
Shared status codes, the 5.5 MB cap, and plan rate limits are on Platform limits.