Directories & members
A directory is a Sally company account. These endpoints return company accounts, their memberships and users, and let admins invite and remove members.
Every endpoint below shows its parameters and response fields in the middle and a request sample with an example response on the right.
Lists the directories the authenticated user is a member of
/v1.0/directoriesDiscovery endpoint: returns all directories of the token user (active, non-blocked memberships). The directoryId is used in the subsequent paths. Each entry carries the same fields as the single-directory endpoint.
Field overview from the specification
Response fields (per directory):
directoryId(string): id of the directory; use it in all/v1.0/directories/{directoryId}/...paths.name(string): display name of the directory.pictureFileUrl(string | null): absolute URL of the directory logo (requires the same Bearer token as the API); null if unset.languageCode(string | null): default language of the directory (IETF language tag, e.g.de-DE,en); null if unset.maxApiRequestsPerMinute(number): maximum number of API requests per minute allowed for this directory.maxApiRequestsPerDay(number): maximum number of API requests per day allowed for this directory.
Query parameters
fieldsstringoptionalComma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.
Only first-level fields can be named. A nested list such as
attendees,tagsorsectionItemsis returned whole or not at all;attendees.nameis not supported.On a paged response the selection applies to the entries in
items;page,pageSize,totalandhasMoreare always returned. An unknown name is rejected with 400 rather than ignored.Selectable here:
directoryId,languageCode,maxApiRequestsPerDay,maxApiRequestsPerMinute,name,pictureFileUrl.Example:directoryId,languageCode
Response
directoryIdstringrequiredUnique id of the directory.
namestringrequiredDisplay name of the directory.
pictureFileUrlstringrequirednullableAbsolute URL of the directory logo, or null. Requires the same Bearer token as the API.
languageCodestringrequirednullableDefault language of the directory (IETF language tag, e.g.
de-DE,en-US).maxApiRequestsPerMinutenumberrequiredMaximum number of API requests per minute allowed for this directory.
maxApiRequestsPerDaynumberrequiredMaximum number of API requests per day allowed for this directory.
Status codes
- 200Success
- 401
Missing or invalid bearer token.
- 429
Rate limit exceeded (per token/IP). Transcription uploads may also return
codeFUP_LIMIT_EXCEEDEDorTOO_MANY_CONCURRENT_TRANSCRIPTIONS. - 500
Internal server error.
Returns a single directory (if the user is a member)
/v1.0/directories/{directoryId}Returns one directory by id (the caller must be a member, otherwise 404). Same shape as the discovery list.
Field overview from the specification
Response fields:
directoryId(string): id of the directory; use it in all/v1.0/directories/{directoryId}/...paths.name(string): display name of the directory.pictureFileUrl(string | null): absolute URL of the directory logo (requires the same Bearer token as the API); null if unset.languageCode(string | null): default language of the directory (IETF language tag, e.g.de-DE,en); null if unset.maxApiRequestsPerMinute(number): maximum number of API requests per minute allowed for this directory.maxApiRequestsPerDay(number): maximum number of API requests per day allowed for this directory.
Path parameters
directoryIdstringrequiredId of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by
GET /v1.0/me/directories/memberships.
Query parameters
fieldsstringoptionalComma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.
Only first-level fields can be named. A nested list such as
attendees,tagsorsectionItemsis returned whole or not at all;attendees.nameis not supported.On a paged response the selection applies to the entries in
items;page,pageSize,totalandhasMoreare always returned. An unknown name is rejected with 400 rather than ignored.Selectable here:
directoryId,languageCode,maxApiRequestsPerDay,maxApiRequestsPerMinute,name,pictureFileUrl.Example:directoryId,languageCode
Response
directoryIdstringrequiredUnique id of the directory.
namestringrequiredDisplay name of the directory.
pictureFileUrlstringrequirednullableAbsolute URL of the directory logo, or null. Requires the same Bearer token as the API.
languageCodestringrequirednullableDefault language of the directory (IETF language tag, e.g.
de-DE,en-US).maxApiRequestsPerMinutenumberrequiredMaximum number of API requests per minute allowed for this directory.
maxApiRequestsPerDaynumberrequiredMaximum number of API requests per day allowed for this directory.
Status codes
- 200Success
- 400
Invalid request (validation error).
- 401
Missing or invalid bearer token.
- 404
Resource not found or not accessible.
- 429
Rate limit exceeded (per token/IP). Transcription uploads may also return
codeFUP_LIMIT_EXCEEDEDorTOO_MANY_CONCURRENT_TRANSCRIPTIONS. - 500
Internal server error.
Lists the memberships of a directory (paginated, optionally filtered)
/v1.0/directories/{directoryId}/membershipsPagination via ?page + ?pageSize (max. 100). An optional ?search substring matches first/last name and email of the member (case-insensitive). Returns membership scalars only (userId, roleId, licenseId, isBlocked); fetch user details via GET .../memberships/users/{userId}. Resolve roleId/licenseId via GET /v1.0/roles / GET /v1.0/licenses.
Field overview from the specification
Response fields:
page/pageSize/total/hasMore: pagination envelope (current page, page size, total count, whether more pages follow).items(array): the memberships on this page. Each item has:directoryId(string): id of the directory this membership belongs to.userId(string): id of the user this membership belongs to.roleId(string): role id of the user in this directory; resolve viaGET /v1.0/roles.licenseId(string): license id of the user in this directory; resolve viaGET /v1.0/licenses.isBlocked(boolean): whether the user is blocked in this directory.
Path parameters
directoryIdstringrequiredId of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by
GET /v1.0/me/directories/memberships.
Query parameters
pagenumberoptionalPage number, 1-based. Defaults to 1.
pageSizenumberoptionalItems per page. Defaults to 25, capped at 100.
searchstringoptionalCase-insensitive substring match on first/last name and email. The term may appear at the start, middle, or end.
fieldsstringoptionalComma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.
Only first-level fields can be named. A nested list such as
attendees,tagsorsectionItemsis returned whole or not at all;attendees.nameis not supported.On a paged response the selection applies to the entries in
items;page,pageSize,totalandhasMoreare always returned. An unknown name is rejected with 400 rather than ignored.Selectable here:
directoryId,isBlocked,licenseId,roleId,userId.Example:directoryId,isBlocked
Response: each entry in items
directoryIdstringrequiredId of the directory this membership belongs to.
userIdstringrequiredId of the user this membership belongs to.
roleIdstringrequiredRole id of the user in this directory. Resolve via
GET /v1.0/roles.licenseIdstringrequiredLicense id of the user in this directory. Resolve via
GET /v1.0/licenses.isBlockedbooleanrequiredWhether the user is blocked in this directory.
Every page also carries page, pageSize, total, hasMore.
Status codes
- 200Success
- 400
Invalid request (validation error).
- 401
Missing or invalid bearer token.
- 404
Resource not found or not accessible.
- 429
Rate limit exceeded (per token/IP). Transcription uploads may also return
codeFUP_LIMIT_EXCEEDEDorTOO_MANY_CONCURRENT_TRANSCRIPTIONS. - 500
Internal server error.
Invites/creates a user in the directory
/v1.0/directories/{directoryId}/membershipsCreates a membership by inviting a user (by email) with a role + license. Only admins/owners may invite; only an owner may invite another owner. Fails with 400 if no free license seat is available.
Field overview from the specification
Body fields:
email(string, required): email address to invite.roleId(string, required): role id to assign; resolve valid ids viaGET /v1.0/roles.licenseId(string, required): license id to assign; resolve valid ids viaGET /v1.0/licenses.description(string, optional): free-text note.languageCode(string, optional): invitation language (IETF language tag, e.g.de-DE).
Path parameters
directoryIdstringrequiredId of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by
GET /v1.0/me/directories/memberships.
Query parameters
fieldsstringoptionalComma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.
Only first-level fields can be named. A nested list such as
attendees,tagsorsectionItemsis returned whole or not at all;attendees.nameis not supported.On a paged response the selection applies to the entries in
items;page,pageSize,totalandhasMoreare always returned. An unknown name is rejected with 400 rather than ignored.Selectable here:
createdOn,inviteeEmail,licenseId,roleId,userId.Example:createdOn,inviteeEmail
Request body application/json
emailstringrequiredEmail address to invite.
roleIdstringrequiredRole id to assign. Resolve valid ids via
GET /v1.0/roles.licenseIdstringrequiredLicense id to assign. Resolve valid ids via
GET /v1.0/licenses.descriptionstringoptionalnullableOptional note.
languageCodestringoptionalnullableOptional invitation language as an IETF language tag (e.g.
de-DE).
Response
userIdstringrequiredId of the invited user.
inviteeEmailstringrequirednullableInvited email address.
roleIdstringrequiredAssigned role id.
licenseIdstringrequiredAssigned license id.
createdOnstringrequiredCreation timestamp (ISO-8601).
Status codes
- 200Success
- 400
Invalid request (validation error).
- 401
Missing or invalid bearer token.
- 403
Forbidden (insufficient permissions).
- 404
Resource not found or not accessible.
- 429
Rate limit exceeded (per token/IP). Transcription uploads may also return
codeFUP_LIMIT_EXCEEDEDorTOO_MANY_CONCURRENT_TRANSCRIPTIONS. - 500
Internal server error.
Lists the users of a directory (paginated, optionally filtered)
/v1.0/directories/{directoryId}/memberships/usersBasic user info of all members of the directory. Pagination via ?page + ?pageSize (max. 100). An optional ?search substring matches first/last name and email (case-insensitive). The caller must be a member of the directory.
Field overview from the specification
Response fields:
page/pageSize/total/hasMore: pagination envelope (current page, page size, total count, whether more pages follow).items(array): the users on this page. Each item has:userId(string): id of the user.email(string): email address of the user.firstName(string): first name.lastName(string): last name.pictureFileUrl(string | null): absolute URL of the profile picture, or null. Requires the same Bearer token as the API.
Path parameters
directoryIdstringrequiredId of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by
GET /v1.0/me/directories/memberships.
Query parameters
pagenumberoptionalPage number, 1-based. Defaults to 1.
pageSizenumberoptionalItems per page. Defaults to 25, capped at 100.
searchstringoptionalCase-insensitive substring match on first/last name and email. The term may appear at the start, middle, or end.
fieldsstringoptionalComma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.
Only first-level fields can be named. A nested list such as
attendees,tagsorsectionItemsis returned whole or not at all;attendees.nameis not supported.On a paged response the selection applies to the entries in
items;page,pageSize,totalandhasMoreare always returned. An unknown name is rejected with 400 rather than ignored.Selectable here:
email,firstName,lastName,pictureFileUrl,userId.Example:email,firstName
Response: each entry in items
userIdstringrequiredId of the user.
emailstringrequiredEmail address of the user.
firstNamestringrequiredFirst name.
lastNamestringrequiredLast name.
pictureFileUrlstringrequirednullableAbsolute URL of the profile picture, or null. Requires the same Bearer token as the API.
Every page also carries page, pageSize, total, hasMore.
Status codes
- 200Success
- 400
Invalid request (validation error).
- 401
Missing or invalid bearer token.
- 404
Resource not found or not accessible.
- 429
Rate limit exceeded (per token/IP). Transcription uploads may also return
codeFUP_LIMIT_EXCEEDEDorTOO_MANY_CONCURRENT_TRANSCRIPTIONS. - 500
Internal server error.
Searches the users of a directory (parameters in the body)
/v1.0/directories/{directoryId}/memberships/users/searchThe caller must be a member of the directory.
Field overview from the specification
Body fields:
search(string, optional): case-insensitive substring on first/last name and email; the term may appear at the start, middle, or end.page(number, optional, default1): 1-based page number.pageSize(number, optional, default25): page size (max. 100).
Path parameters
directoryIdstringrequiredId of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by
GET /v1.0/me/directories/memberships.
Query parameters
fieldsstringoptionalComma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.
Only first-level fields can be named. A nested list such as
attendees,tagsorsectionItemsis returned whole or not at all;attendees.nameis not supported.On a paged response the selection applies to the entries in
items;page,pageSize,totalandhasMoreare always returned. An unknown name is rejected with 400 rather than ignored.Selectable here:
email,firstName,lastName,pictureFileUrl,userId.Example:email,firstName
Request body application/json
searchstringoptionalnullableCase-insensitive substring match on first/last name and email. The term may appear at the start, middle, or end.
pagenumberoptionalPage (1-based, default 1).
pageSizenumberoptionalPage size (default 25, max 100).
Response: each entry in items
userIdstringrequiredId of the user.
emailstringrequiredEmail address of the user.
firstNamestringrequiredFirst name.
lastNamestringrequiredLast name.
pictureFileUrlstringrequirednullableAbsolute URL of the profile picture, or null. Requires the same Bearer token as the API.
Every page also carries page, pageSize, total, hasMore.
Status codes
- 200Success
- 400
Invalid request (validation error).
- 401
Missing or invalid bearer token.
- 403
Forbidden (insufficient permissions).
- 404
Resource not found or not accessible.
- 429
Rate limit exceeded (per token/IP). Transcription uploads may also return
codeFUP_LIMIT_EXCEEDEDorTOO_MANY_CONCURRENT_TRANSCRIPTIONS. - 500
Internal server error.
Returns a single user of a directory
/v1.0/directories/{directoryId}/memberships/users/{userId}Basic user info by id. The caller must be a member of the directory, and the requested user must be a member of the same directory — otherwise 404 (no existence leak).
Field overview from the specification
Response fields:
userId(string): id of the user.email(string): email address of the user.firstName(string): first name.lastName(string): last name.pictureFileUrl(string | null): absolute URL of the profile picture, or null. Requires the same Bearer token as the API.
Path parameters
directoryIdstringrequiredId of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by
GET /v1.0/me/directories/memberships.userIdstringrequiredId of the user.
Query parameters
fieldsstringoptionalComma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.
Only first-level fields can be named. A nested list such as
attendees,tagsorsectionItemsis returned whole or not at all;attendees.nameis not supported.On a paged response the selection applies to the entries in
items;page,pageSize,totalandhasMoreare always returned. An unknown name is rejected with 400 rather than ignored.Selectable here:
email,firstName,lastName,pictureFileUrl,userId.Example:email,firstName
Response
userIdstringrequiredId of the user.
emailstringrequiredEmail address of the user.
firstNamestringrequiredFirst name.
lastNamestringrequiredLast name.
pictureFileUrlstringrequirednullableAbsolute URL of the profile picture, or null. Requires the same Bearer token as the API.
Status codes
- 200Success
- 400
Invalid request (validation error).
- 401
Missing or invalid bearer token.
- 404
Resource not found or not accessible.
- 429
Rate limit exceeded (per token/IP). Transcription uploads may also return
codeFUP_LIMIT_EXCEEDEDorTOO_MANY_CONCURRENT_TRANSCRIPTIONS. - 500
Internal server error.
Removes a user from the directory
/v1.0/directories/{directoryId}/memberships/{userId}Revokes the membership of the user. Only admins/owners may remove members; the last owner cannot be removed. If it was the user’s last directory, the user is deleted entirely (GDPR).
Path parameters
directoryIdstringrequiredId of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by
GET /v1.0/me/directories/memberships.userIdstringrequiredId of the user.
Query parameters
fieldsstringoptionalComma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.
Only first-level fields can be named. A nested list such as
attendees,tagsorsectionItemsis returned whole or not at all;attendees.nameis not supported.On a paged response the selection applies to the entries in
items;page,pageSize,totalandhasMoreare always returned. An unknown name is rejected with 400 rather than ignored.Selectable here:
userHardDeleted.Example:userHardDeleted
Response
userHardDeletedbooleanrequiredTrue if the user had no other directories and was therefore deleted entirely (GDPR).
Status codes
- 200Success
- 400
Invalid request (validation error).
- 401
Missing or invalid bearer token.
- 403
Forbidden (insufficient permissions).
- 404
Resource not found or not accessible.
- 429
Rate limit exceeded (per token/IP). Transcription uploads may also return
codeFUP_LIMIT_EXCEEDEDorTOO_MANY_CONCURRENT_TRANSCRIPTIONS. - 500
Internal server error.