RequestRocketRequestRocketDocs
PartnersOrganisation and team

MSP organisation and team API

Read an MSP team and its configuration.

The handler for members lists the team and, for a system admin, can add an existing user. Invites are the normal way to add someone. Configuration holds billing type and the rates floor.

MSP roles

RoleProven access
msp_ownerManage clients, own-team members and invites, managed-client teams, configuration, plans, relationships, and billing.
msp_adminManage the same subresources, except only an owner can grant or remove msp_owner.
msp_userRead clients, configuration, plans, and telemetry; manage managed-client members and invites; cannot manage the MSP's own team.
msp_readerRead clients, members, invites, configuration, plans, and telemetry.

Endpoints

MethodPathWhat it does
GET/api/msps/:mspId/membersList MSP team members
POST/api/msps/:mspId/membersAdd an existing user (system admin)
PUT/api/msps/:mspId/members/:memberIdChange member roles
DELETE/api/msps/:mspId/members/:memberIdRemove a member
GET/api/msps/:mspId/invitesList MSP invites
POST/api/msps/:mspId/invitesCreate an MSP invite
PUT/api/msps/:mspId/invites/:inviteIdRespond to an invite
DELETE/api/msps/:mspId/invites/:inviteIdDelete an invite
GET/api/msps/:mspId/configurationsRead MSP configuration
PUT/api/msps/:mspId/configurationsUpdate MSP configuration
GET/api/msps/:mspId/promocodesList MSP grants
POST/api/msps/:mspId/promocodesRedeem an MSP code

List MSP members

GET /api/msps/:mspId/members returns the MSP's own team and their roles.

Request

curl -X GET "https://api.requestrocket.com/api/msps/:mspId/members" \
  -H "Authorization: u-your-token"
import axios from "axios";

const response = await axios.request({
  method: "GET",
  url: "https://api.requestrocket.com/api/msps/:mspId/members",
  headers: {
    "Authorization": "u-your-token",
  }
});

console.log(response.status, response.data);
import requests

response = requests.request(
    "GET",
    "https://api.requestrocket.com/api/msps/:mspId/members",
    headers={
        "Authorization": "u-your-token",
    }
)
print(response.status_code, response.json())
package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    var payload io.Reader
    req, _ := http.NewRequest("GET", "https://api.requestrocket.com/api/msps/:mspId/members", payload)
    req.Header.Set("Authorization", "u-your-token")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/msps/:mspId/members"))
            .method("GET", HttpRequest.BodyPublishers.noBody())
            .header("Authorization", "u-your-token")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "members": [
    {
      "userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
      "userFirstName": "Alex",
      "userLastName": "Example",
      "userEmail": "alex@example.com",
      "roles": [
        "msp_owner"
      ]
    }
  ],
  "message": "Success"
}
{
  "message": "Member not found in MSP"
}
{
  "message": "Unauthorized"
}
{
  "Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}
{
  "message": "method / endpoint not supported"
}

Query parameters

None.

Response

AttributeTypeDescription
membersarrayTeam members.
members[].userIdstringUser id.
members[].userFirstNamestringGiven name.
members[].userLastNamestringFamily name.
members[].userEmailstringEmail address.
members[].rolesstring[]One or more of msp_owner, msp_admin, msp_user, msp_reader.
messagestringSuccess.

Add an existing user

POST /api/msps/:mspId/members adds a user who already has a RequestRocket account. Only a system admin can call it. Invites are the normal way to add someone.

Request body

ParameterTypeRequiredDescription
userIdstring✓Id of the user to add.
rolesstring[]✓At least one of msp_owner, msp_admin, msp_user, msp_reader.

Returns the membership that was stored. The array contains userId and roles for that user.

Response

AttributeTypeDescription
membersarrayThe new membership.
members[].userIdstringUser id from the request.
members[].rolesstring[]Roles from the request.
messagestringMember added to MSP.

A user who is already on the team returns 409.

Change member roles

PUT /api/msps/:mspId/members/:memberId replaces the roles on one team member.

Request body

ParameterTypeRequiredDescription
rolesstring[]✓Replacement roles. At least one of msp_owner, msp_admin, msp_user, msp_reader. Only an MSP owner can grant or remove msp_owner.

Returns the updated membership, with userId and roles.

Response

AttributeTypeDescription
membersarrayThe updated membership.
members[].userIdstringMember id from the path.
members[].rolesstring[]Roles after the owner guard.
messagestringMember roles updated.

List MSP invites

GET /api/msps/:mspId/invites returns every invite stored for the MSP.

Query parameters

None.

Response

AttributeTypeDescription
invitesarrayInvites whose parent is this MSP.
invites[].inviteIdstringInvite id.
invites[].parentIdstringMSP id.
invites[].clientNamestringMSP name shown on the invite.
invites[].userEmailstringInvited email address.
invites[].rolesstring[]Roles the invite will grant.
invites[].inviteTypestringmsp when set.
invites[].TTLnumberExpiry stored on the invite.
messagestringSuccess.

Create an MSP invite

POST /api/msps/:mspId/invites invites an email address onto the MSP team. A repeat invite for the same address updates the existing invite.

Request body

ParameterTypeRequiredDescription
userEmailstring✓Email address to invite.
userNamestringName used in the invitation email.
rolesstring[]✓At least one of msp_owner, msp_admin, msp_user, msp_reader. Only an MSP owner can grant msp_owner.

Returns the invite that was sent or refreshed.

Response

AttributeTypeDescription
invitesarrayThe invite.
invites[].inviteIdstringInvite id.
invites[].parentIdstringMSP id.
invites[].clientNamestringMSP name.
invites[].userEmailstringInvited email address.
invites[].rolesstring[]Roles on the invite.
invites[].inviteTypestringmsp.
invites[].TTLnumberExpiry stored on the invite.
messagestringInvite sent.

Update an invite

PUT /api/msps/:mspId/invites/:inviteId replaces the roles on a pending invite and extends its expiry by 14 days.

Request body

ParameterTypeRequiredDescription
rolesstring[]✓Replacement roles. At least one of msp_owner, msp_admin, msp_user, msp_reader. Only an MSP owner can grant or remove msp_owner.

Returns the invite after the role replacement.

Response

AttributeTypeDescription
invitesarrayThe updated invite.
invites[].inviteIdstringInvite id from the path.
invites[].rolesstring[]Roles from the request.
invites[].TTLnumberUnix time, in seconds, 14 days from this call.
messagestringInvite updated.

Read MSP configuration

GET /api/msps/:mspId/configurations returns the MSP billing type and the rates floor.

Query parameters

None.

Response

AttributeTypeDescription
configuration.billingTypestringstripe, marketplace, or invoice.
configuration.billingStatusstringactive or suspended, when set.
configuration.promotionalCodesarray or nullApplied grants. Each item has name, createdAt, and expiresAt. The redemption secret is not included.
configuration.rates.apiSecondsnumberFloor multiplier for API seconds.
configuration.rates.storageGBnumberFloor multiplier for storage.
configuration.rates.aiTokensnumberFloor multiplier for AI tokens.
configuration.rates.plannumberFloor multiplier for the plan fee.
messagestringSuccess.

Update MSP configuration

PUT /api/msps/:mspId/configurations updates the MSP's own configuration. All fields are optional. Omit a field to leave it unchanged. Rates and billing type are applied for a system admin. Raising the rates floor re-clamps managed organisations whose stored rates sit below the new floor.

Request body

ParameterTypeRequiredDescription
billingTypestringstripe, marketplace, or invoice. Applied for a system admin.
billingStatusstringactive or suspended. Accepted by validation and left unchanged.
ratesobjectFloor multipliers. Applied for a system admin. Sending rates requires apiSeconds, storageGB, aiTokens, and plan. Each value is clamped to the range 0.7 to 1.
rates.apiSecondsnumberAPI-seconds floor. Required when rates is sent.
rates.storageGBnumberStorage floor. Required when rates is sent.
rates.aiTokensnumberAI-token floor. Required when rates is sent.
rates.plannumberPlan-fee floor. Required when rates is sent.

promotionalCodes is not writable here. Redeem a code on POST /api/msps/:mspId/promocodes.

Returns the saved configuration. When the new floor raises one or more managed organisations, the response also includes clientsReclamped. Balances are not overwritten.

Response

AttributeTypeDescription
configurationobjectSaved MSP configuration. Same shape as the GET response.
clientsReclampednumberHow many managed organisations were raised to the new floor. Present only when that count is greater than zero.
messagestringConfiguration updated successfully.

List MSP grants

GET /api/msps/:mspId/promocodes returns grants applied to the MSP. The redemption secret is not included.

Query parameters

None.

Response

AttributeTypeDescription
promotionalCodesarray or nullApplied grants.
promotionalCodes[].namestringPublic grant name.
promotionalCodes[].createdAtstringISO-8601 time the grant was applied.
promotionalCodes[].expiresAtstringISO-8601 expiry.
messagestringSuccess.

Redeem an MSP code

POST /api/msps/:mspId/promocodes redeems a promotional code for the MSP.

Request body

ParameterTypeRequiredDescription
codestring✓Redemption secret. It is not returned.

Returns the grant name that matched, whether it was already on the MSP, and the full grant list.

Response

AttributeTypeDescription
applied.namestringPublic name of the grant.
applied.createdAtstringISO-8601 time the grant was applied.
applied.expiresAtstringISO-8601 expiry.
alreadyAppliedbooleantrue when this grant name was already stored.
promotionalCodesarrayGrants after this call. The secret is omitted.
messagestringPromotional code applied, or Promotional code already applied.

Shared status codes, the 5.5 MB cap, and plan rate limits are on Platform limits.

Next

On this page