> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/api/api-reference/account-and-admin/groups.md).

# Groups

Groups bundle roles and resource grants so end-user access can be managed collectively. End users receive a group's access through membership, added manually or synced from an identity provider (group claims at sign-in or a SCIM group push).

### Group schema

## The Group object

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"components":{"schemas":{"Group":{"type":"object","description":"A named bundle of roles and resource grants for end-user access\nmanagement. End users receive the group's access through membership,\nwhether added manually or synced from an identity provider.","required":["_id","name"],"properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Unique identifier for the group."},"_userId":{"type":"string","format":"objectId","readOnly":true,"description":"Account owner's user id."},"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted on write.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles pinned to this group. Members receive the roles' grants through the group.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants attached directly to the group, in addition to any role-derived grants.","items":{"$ref":"#/components/schemas/ResourceGrant"}},"hasIdpSyncedMembers":{"type":"boolean","readOnly":true,"description":"When true, at least one end user's membership in this group is synced\nfrom an identity provider — through group claims at sign-in or a SCIM\ngroup push. Maintained by the server — IdP-synced memberships cannot be\nremoved through the group members API. Groups a SCIM push names that do\nnot exist yet are created with this flag set and no grants."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was created."},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was last updated."}}},"ResourceGrant":{"type":"object","description":"Grants access to a resource (currently MCP servers only). A grant names\nthe resource, or applies as a wildcard across all resources of the type,\nand lists the capabilities granted on it.","required":["resourceType","capabilities"],"properties":{"resourceType":{"type":"string","enum":["mcpServer"],"description":"Resource type this grant applies to."},"_resourceId":{"type":["string","null"],"format":"objectId","description":"MCP server this grant applies to. Omit or set to null for a wildcard\ngrant across all MCP servers in the account."},"capabilities":{"type":"array","minItems":1,"description":"Capabilities granted on the target resource. Each `:all` capability\ncovers only its own kind — grant `tool:all`, `api:all`, `prompt:all`,\nand `resource:all` together to open every item on a server.","items":{"type":"string","pattern":"^(?:tool|api|prompt|resource):(?:[a-fA-F0-9]{24}|all)$|^pset:[a-fA-F0-9]{24}$","description":"Capability string for an `mcpServer` grant. `tool:`, `api:`,\n`prompt:`, and `resource:` take `all` or a 24-hex id on the target\nserver — a `tools[]._toolId` or upstream tool row `_id`, an\n`apis[]._apiId`, a `prompts[]._id`, or a `resources[]._id`; `pset:`\ntakes a `permissionSets[]._id`. Grant prompts with `prompt:<_id>`:\nolder grants written as `tool:<prompt _id>` still validate but are\nnot reported by effective access. Any other shape is rejected with\n400 `validation_failed` (\"Invalid capability\"), and an id that is\nnot attached to the target server with 400 `validation_failed`\nnaming the missing item."}}}}}}}
```

## List groups

> Returns all active groups in the account. Requires account owner or\
> administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider (group\nclaims at sign-in or a SCIM group push).\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"Group":{"type":"object","description":"A named bundle of roles and resource grants for end-user access\nmanagement. End users receive the group's access through membership,\nwhether added manually or synced from an identity provider.","required":["_id","name"],"properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Unique identifier for the group."},"_userId":{"type":"string","format":"objectId","readOnly":true,"description":"Account owner's user id."},"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted on write.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles pinned to this group. Members receive the roles' grants through the group.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants attached directly to the group, in addition to any role-derived grants.","items":{"$ref":"#/components/schemas/ResourceGrant"}},"hasIdpSyncedMembers":{"type":"boolean","readOnly":true,"description":"When true, at least one end user's membership in this group is synced\nfrom an identity provider — through group claims at sign-in or a SCIM\ngroup push. Maintained by the server — IdP-synced memberships cannot be\nremoved through the group members API. Groups a SCIM push names that do\nnot exist yet are created with this flag set and no grants."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was created."},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was last updated."}}},"ResourceGrant":{"type":"object","description":"Grants access to a resource (currently MCP servers only). A grant names\nthe resource, or applies as a wildcard across all resources of the type,\nand lists the capabilities granted on it.","required":["resourceType","capabilities"],"properties":{"resourceType":{"type":"string","enum":["mcpServer"],"description":"Resource type this grant applies to."},"_resourceId":{"type":["string","null"],"format":"objectId","description":"MCP server this grant applies to. Omit or set to null for a wildcard\ngrant across all MCP servers in the account."},"capabilities":{"type":"array","minItems":1,"description":"Capabilities granted on the target resource. Each `:all` capability\ncovers only its own kind — grant `tool:all`, `api:all`, `prompt:all`,\nand `resource:all` together to open every item on a server.","items":{"type":"string","pattern":"^(?:tool|api|prompt|resource):(?:[a-fA-F0-9]{24}|all)$|^pset:[a-fA-F0-9]{24}$","description":"Capability string for an `mcpServer` grant. `tool:`, `api:`,\n`prompt:`, and `resource:` take `all` or a 24-hex id on the target\nserver — a `tools[]._toolId` or upstream tool row `_id`, an\n`apis[]._apiId`, a `prompts[]._id`, or a `resources[]._id`; `pset:`\ntakes a `permissionSets[]._id`. Grant prompts with `prompt:<_id>`:\nolder grants written as `tool:<prompt _id>` still validate but are\nnot reported by effective access. Any other shape is rejected with\n400 `validation_failed` (\"Invalid capability\"), and an id that is\nnot attached to the target server with 400 `validation_failed`\nnaming the missing item."}}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups":{"get":{"summary":"List groups","operationId":"listGroups","tags":["Groups"],"description":"Returns all active groups in the account. Requires account owner or\nadministrator access.","responses":{"200":{"description":"List of groups.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Group"}}}}},"204":{"description":"No groups exist in the account."},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"}}}}}}
```

## Create a group

> Creates a group for end-user access management. Group names must be\
> unique within the account (case-insensitive), and any \`\_roleIds\` or\
> \`resourceGrants.\_resourceId\` values must reference resources owned by\
> the same account. Requires account owner or administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider (group\nclaims at sign-in or a SCIM group push).\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"GroupRequest":{"type":"object","description":"Writable fields for creating or replacing a group.","required":["name"],"properties":{"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles to pin to this group. Must reference roles owned by the same account.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants to attach directly to the group. `_resourceId` values must reference resources owned by the same account.","items":{"$ref":"#/components/schemas/ResourceGrant"}}}},"ResourceGrant":{"type":"object","description":"Grants access to a resource (currently MCP servers only). A grant names\nthe resource, or applies as a wildcard across all resources of the type,\nand lists the capabilities granted on it.","required":["resourceType","capabilities"],"properties":{"resourceType":{"type":"string","enum":["mcpServer"],"description":"Resource type this grant applies to."},"_resourceId":{"type":["string","null"],"format":"objectId","description":"MCP server this grant applies to. Omit or set to null for a wildcard\ngrant across all MCP servers in the account."},"capabilities":{"type":"array","minItems":1,"description":"Capabilities granted on the target resource. Each `:all` capability\ncovers only its own kind — grant `tool:all`, `api:all`, `prompt:all`,\nand `resource:all` together to open every item on a server.","items":{"type":"string","pattern":"^(?:tool|api|prompt|resource):(?:[a-fA-F0-9]{24}|all)$|^pset:[a-fA-F0-9]{24}$","description":"Capability string for an `mcpServer` grant. `tool:`, `api:`,\n`prompt:`, and `resource:` take `all` or a 24-hex id on the target\nserver — a `tools[]._toolId` or upstream tool row `_id`, an\n`apis[]._apiId`, a `prompts[]._id`, or a `resources[]._id`; `pset:`\ntakes a `permissionSets[]._id`. Grant prompts with `prompt:<_id>`:\nolder grants written as `tool:<prompt _id>` still validate but are\nnot reported by effective access. Any other shape is rejected with\n400 `validation_failed` (\"Invalid capability\"), and an id that is\nnot attached to the target server with 400 `validation_failed`\nnaming the missing item."}}}},"Group":{"type":"object","description":"A named bundle of roles and resource grants for end-user access\nmanagement. End users receive the group's access through membership,\nwhether added manually or synced from an identity provider.","required":["_id","name"],"properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Unique identifier for the group."},"_userId":{"type":"string","format":"objectId","readOnly":true,"description":"Account owner's user id."},"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted on write.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles pinned to this group. Members receive the roles' grants through the group.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants attached directly to the group, in addition to any role-derived grants.","items":{"$ref":"#/components/schemas/ResourceGrant"}},"hasIdpSyncedMembers":{"type":"boolean","readOnly":true,"description":"When true, at least one end user's membership in this group is synced\nfrom an identity provider — through group claims at sign-in or a SCIM\ngroup push. Maintained by the server — IdP-synced memberships cannot be\nremoved through the group members API. Groups a SCIM push names that do\nnot exist yet are created with this flag set and no grants."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was created."},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was last updated."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups":{"post":{"summary":"Create a group","operationId":"createGroup","tags":["Groups"],"description":"Creates a group for end-user access management. Group names must be\nunique within the account (case-insensitive), and any `_roleIds` or\n`resourceGrants._resourceId` values must reference resources owned by\nthe same account. Requires account owner or administrator access.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupRequest"}}}},"responses":{"201":{"description":"Group created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Group"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"409":{"description":"A group with this name already exists in the account.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Get a group

> Retrieves a single group by ID.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider (group\nclaims at sign-in or a SCIM group push).\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"Group":{"type":"object","description":"A named bundle of roles and resource grants for end-user access\nmanagement. End users receive the group's access through membership,\nwhether added manually or synced from an identity provider.","required":["_id","name"],"properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Unique identifier for the group."},"_userId":{"type":"string","format":"objectId","readOnly":true,"description":"Account owner's user id."},"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted on write.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles pinned to this group. Members receive the roles' grants through the group.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants attached directly to the group, in addition to any role-derived grants.","items":{"$ref":"#/components/schemas/ResourceGrant"}},"hasIdpSyncedMembers":{"type":"boolean","readOnly":true,"description":"When true, at least one end user's membership in this group is synced\nfrom an identity provider — through group claims at sign-in or a SCIM\ngroup push. Maintained by the server — IdP-synced memberships cannot be\nremoved through the group members API. Groups a SCIM push names that do\nnot exist yet are created with this flag set and no grants."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was created."},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was last updated."}}},"ResourceGrant":{"type":"object","description":"Grants access to a resource (currently MCP servers only). A grant names\nthe resource, or applies as a wildcard across all resources of the type,\nand lists the capabilities granted on it.","required":["resourceType","capabilities"],"properties":{"resourceType":{"type":"string","enum":["mcpServer"],"description":"Resource type this grant applies to."},"_resourceId":{"type":["string","null"],"format":"objectId","description":"MCP server this grant applies to. Omit or set to null for a wildcard\ngrant across all MCP servers in the account."},"capabilities":{"type":"array","minItems":1,"description":"Capabilities granted on the target resource. Each `:all` capability\ncovers only its own kind — grant `tool:all`, `api:all`, `prompt:all`,\nand `resource:all` together to open every item on a server.","items":{"type":"string","pattern":"^(?:tool|api|prompt|resource):(?:[a-fA-F0-9]{24}|all)$|^pset:[a-fA-F0-9]{24}$","description":"Capability string for an `mcpServer` grant. `tool:`, `api:`,\n`prompt:`, and `resource:` take `all` or a 24-hex id on the target\nserver — a `tools[]._toolId` or upstream tool row `_id`, an\n`apis[]._apiId`, a `prompts[]._id`, or a `resources[]._id`; `pset:`\ntakes a `permissionSets[]._id`. Grant prompts with `prompt:<_id>`:\nolder grants written as `tool:<prompt _id>` still validate but are\nnot reported by effective access. Any other shape is rejected with\n400 `validation_failed` (\"Invalid capability\"), and an id that is\nnot attached to the target server with 400 `validation_failed`\nnaming the missing item."}}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups/{_id}":{"get":{"summary":"Get a group","operationId":"getGroup","tags":["Groups"],"description":"Retrieves a single group by ID.","parameters":[{"name":"_id","in":"path","required":true,"description":"Group ID.","schema":{"type":"string","format":"objectId"}}],"responses":{"200":{"description":"Group details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Group"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"404":{"$ref":"#/components/responses/404-not-found"}}}}}}
```

## Update a group

> Replaces the group's writable fields; omitted fields are not preserved.\
> A body with only \`name\` comes back with no \`description\`,\
> \`resourceGrants: \[]\` and \`\_roleIds: \[]\`, so the group grants its\
> members nothing while their memberships stay. Read the group first and\
> send its \`description\`, \`\_roleIds\` and \`resourceGrants\` back with the\
> change. Requires account owner or administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider (group\nclaims at sign-in or a SCIM group push).\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"GroupRequest":{"type":"object","description":"Writable fields for creating or replacing a group.","required":["name"],"properties":{"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles to pin to this group. Must reference roles owned by the same account.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants to attach directly to the group. `_resourceId` values must reference resources owned by the same account.","items":{"$ref":"#/components/schemas/ResourceGrant"}}}},"ResourceGrant":{"type":"object","description":"Grants access to a resource (currently MCP servers only). A grant names\nthe resource, or applies as a wildcard across all resources of the type,\nand lists the capabilities granted on it.","required":["resourceType","capabilities"],"properties":{"resourceType":{"type":"string","enum":["mcpServer"],"description":"Resource type this grant applies to."},"_resourceId":{"type":["string","null"],"format":"objectId","description":"MCP server this grant applies to. Omit or set to null for a wildcard\ngrant across all MCP servers in the account."},"capabilities":{"type":"array","minItems":1,"description":"Capabilities granted on the target resource. Each `:all` capability\ncovers only its own kind — grant `tool:all`, `api:all`, `prompt:all`,\nand `resource:all` together to open every item on a server.","items":{"type":"string","pattern":"^(?:tool|api|prompt|resource):(?:[a-fA-F0-9]{24}|all)$|^pset:[a-fA-F0-9]{24}$","description":"Capability string for an `mcpServer` grant. `tool:`, `api:`,\n`prompt:`, and `resource:` take `all` or a 24-hex id on the target\nserver — a `tools[]._toolId` or upstream tool row `_id`, an\n`apis[]._apiId`, a `prompts[]._id`, or a `resources[]._id`; `pset:`\ntakes a `permissionSets[]._id`. Grant prompts with `prompt:<_id>`:\nolder grants written as `tool:<prompt _id>` still validate but are\nnot reported by effective access. Any other shape is rejected with\n400 `validation_failed` (\"Invalid capability\"), and an id that is\nnot attached to the target server with 400 `validation_failed`\nnaming the missing item."}}}},"Group":{"type":"object","description":"A named bundle of roles and resource grants for end-user access\nmanagement. End users receive the group's access through membership,\nwhether added manually or synced from an identity provider.","required":["_id","name"],"properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Unique identifier for the group."},"_userId":{"type":"string","format":"objectId","readOnly":true,"description":"Account owner's user id."},"name":{"type":"string","description":"Group name, unique within the account (case-insensitive)."},"description":{"type":"string","description":"Free-text description of the group's purpose."},"intendedFor":{"type":"array","default":["end-user"],"description":"Audience this group is intended for. Defaults to `[\"end-user\"]` when omitted on write.","items":{"type":"string","enum":["end-user"]}},"_roleIds":{"type":"array","description":"Roles pinned to this group. Members receive the roles' grants through the group.","items":{"type":"string","format":"objectId"}},"resourceGrants":{"type":"array","description":"Resource grants attached directly to the group, in addition to any role-derived grants.","items":{"$ref":"#/components/schemas/ResourceGrant"}},"hasIdpSyncedMembers":{"type":"boolean","readOnly":true,"description":"When true, at least one end user's membership in this group is synced\nfrom an identity provider — through group claims at sign-in or a SCIM\ngroup push. Maintained by the server — IdP-synced memberships cannot be\nremoved through the group members API. Groups a SCIM push names that do\nnot exist yet are created with this flag set and no grants."},"createdAt":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was created."},"lastModified":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the group was last updated."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups/{_id}":{"put":{"summary":"Update a group","operationId":"updateGroup","tags":["Groups"],"description":"Replaces the group's writable fields; omitted fields are not preserved.\nA body with only `name` comes back with no `description`,\n`resourceGrants: []` and `_roleIds: []`, so the group grants its\nmembers nothing while their memberships stay. Read the group first and\nsend its `description`, `_roleIds` and `resourceGrants` back with the\nchange. Requires account owner or administrator access.","parameters":[{"name":"_id","in":"path","required":true,"description":"Group ID.","schema":{"type":"string","format":"objectId"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupRequest"}}}},"responses":{"200":{"description":"Updated group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Group"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"404":{"$ref":"#/components/responses/404-not-found"},"409":{"description":"A group with this name already exists in the account.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Delete a group

> Soft-deletes the group and removes the corresponding membership entry\
> from every end user in the account. Requires account owner or\
> administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider (group\nclaims at sign-in or a SCIM group push).\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}}},"paths":{"/v1/groups/{_id}":{"delete":{"summary":"Delete a group","operationId":"deleteGroup","tags":["Groups"],"description":"Soft-deletes the group and removes the corresponding membership entry\nfrom every end user in the account. Requires account owner or\nadministrator access.","parameters":[{"name":"_id","in":"path","required":true,"description":"Group ID.","schema":{"type":"string","format":"objectId"}}],"responses":{"204":{"description":"Group deleted."},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"404":{"$ref":"#/components/responses/404-not-found"}}}}}}
```

## Add end users to a group

> Bulk-adds up to 100 end users to the group as manual memberships. The\
> operation is idempotent for end users already in the group. Requires\
> account owner or administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider (group\nclaims at sign-in or a SCIM group push).\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"GroupMembersRequest":{"type":"object","description":"End users to add to or remove from the group.","required":["_ashareIds"],"properties":{"_ashareIds":{"type":"array","minItems":1,"maxItems":100,"description":"End-user access-record ids to add or remove.","items":{"type":"string","format":"objectId"}}}},"GroupMembersResponse":{"type":"object","description":"Outcome of a bulk membership change.","properties":{"updated":{"type":"integer","description":"Number of listed end users processed, including any already in the\ngroup (on add) or already outside it (on remove), whose memberships\nare left as they were."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups/{_groupId}/members":{"post":{"summary":"Add end users to a group","operationId":"addGroupMembers","tags":["Groups"],"description":"Bulk-adds up to 100 end users to the group as manual memberships. The\noperation is idempotent for end users already in the group. Requires\naccount owner or administrator access.","parameters":[{"name":"_groupId","in":"path","required":true,"description":"Group ID.","schema":{"type":"string","format":"objectId"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupMembersRequest"}}}},"responses":{"200":{"description":"Members added.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupMembersResponse"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"404":{"$ref":"#/components/responses/404-not-found"}}}}}}
```

## Remove end users from a group

> Bulk-removes manual memberships from the group. Only manual memberships\
> can be removed this way — attempting to remove an IdP-synced membership\
> returns 409; change the person's group in the identity provider (its\
> group mapping or SCIM group assignment) instead. Uses POST rather than\
> DELETE so the request body survives proxies and CDNs. Requires account\
> owner or administrator access.

```json
{"openapi":"3.2.0","info":{"title":"End Users","version":"1.0.0"},"tags":[{"name":"Groups","description":"Groups bundle roles and resource grants so end-user access can be\nmanaged collectively. End users receive a group's access through\nmembership, added manually or synced from an identity provider (group\nclaims at sign-in or a SCIM group push).\n\n## Group schema\n\n{% openapi-schemas spec=\"enduser\" schemas=\"Group\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"GroupMembersRequest":{"type":"object","description":"End users to add to or remove from the group.","required":["_ashareIds"],"properties":{"_ashareIds":{"type":"array","minItems":1,"maxItems":100,"description":"End-user access-record ids to add or remove.","items":{"type":"string","format":"objectId"}}}},"GroupMembersResponse":{"type":"object","description":"Outcome of a bulk membership change.","properties":{"updated":{"type":"integer","description":"Number of listed end users processed, including any already in the\ngroup (on add) or already outside it (on remove), whose memberships\nare left as they were."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"403-forbidden":{"description":"Forbidden. The authenticated caller does not have permission to perform this operation.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/groups/{_groupId}/members/remove":{"post":{"summary":"Remove end users from a group","operationId":"removeGroupMembers","tags":["Groups"],"description":"Bulk-removes manual memberships from the group. Only manual memberships\ncan be removed this way — attempting to remove an IdP-synced membership\nreturns 409; change the person's group in the identity provider (its\ngroup mapping or SCIM group assignment) instead. Uses POST rather than\nDELETE so the request body survives proxies and CDNs. Requires account\nowner or administrator access.","parameters":[{"name":"_groupId","in":"path","required":true,"description":"Group ID.","schema":{"type":"string","format":"objectId"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupMembersRequest"}}}},"responses":{"200":{"description":"Members removed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GroupMembersResponse"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"403":{"$ref":"#/components/responses/403-forbidden"},"404":{"$ref":"#/components/responses/404-not-found"},"409":{"description":"One or more of the memberships is IdP-synced and cannot be removed\nmanually. Error code: `conflict`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```