Synq Docs
Management APIChange requests

Ask for a change that the person approves in the dashboard

An app's redirect URIs, asked for from an MCP host (AERO-1034): nothing changes until the same person approves it in the dashboard within 15 minutes. People only, never an API key. Needs `org.apps.edit`. Recorded as `change_request.created`.

POST/v1/orgs/{org}/change-requests

An app's redirect URIs, asked for from an MCP host (AERO-1034): nothing changes until the same person approves it in the dashboard within 15 minutes. People only, never an API key. Needs org.apps.edit. Recorded as change_request.created.

Authorization

bearer
AuthorizationBearer <token>

An org API key (sk_live_…, sk_test_…), or an access token from the Synq issuer (the synq brand, on the accounts host) for this API.

In: header

Path Parameters

org*string

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/v1/orgs/string/change-requests" \  -H "Content-Type: application/json" \  -d '{    "kind": "app.redirect_uris",    "brand": "string",    "app": "string",    "redirect_uris": [      "string"    ]  }'
{  "id": "string",  "kind": "app.redirect_uris",  "target": {    "brand": "string",    "app": "string"  },  "change": {    "redirect_uris": [      "string"    ]  },  "status": "pending",  "asked_from": "string",  "approve_url": "string",  "expires_at": "2019-08-24T14:15:22Z",  "decided_at": "2019-08-24T14:15:22Z",  "created_at": "2019-08-24T14:15:22Z"}

Decline a change request POST

Changes nothing. From the dashboard, by the person who asked. Needs `org.apps.edit`. Recorded as `change_request.declined`.

Withdraw what a user allowed an app DELETE

The app's grants and tokens for them end, its refresh tokens included, and each session it was signed in to that registered a `backchannel_logout_uri` gets a logout token; their next sign-in to it asks them again. Needs `org.users.edit`. Recorded as `user.consent_revoked`.