Org Team
Create, update, and retrieve org teams and their members for white label programs
Overview
Org teams represent your company’s organizational hierarchy: for example departments, regions, or business units. Use org teams to group users, define managers, and scope spend or benefits. Create org teams before assigning users to teams or referencing them in budget mappings (teamId).
Typical flow:
- Create an org team:
POST /md/api/OrgTeams - Update an org team:
PATCH /md/api/OrgTeams/{orgTeamId} - Retrieve by ID:
GET /md/api/OrgTeams/{orgTeamId} - Assign a user to the team:
POST /md/api/TeamUserMappings - Update a mapping:
PATCH /md/api/TeamUserMappings/{teamUserMappingId} - Remove a user from the team:
DELETE /md/api/TeamUserMappings/{teamUserMappingId} - List members:
GET /md/api/OrgTeams/{orgTeamId}/allMembers
Authentication: All endpoints require Authorization: Bearer {access_token} and x-appid: {clientId}. The company is resolved from your access token scope: do not send companyId in request bodies. See Authentication.
name must be unique within your company (and subsidiary, when subsidiaryId is set). Duplicate names are rejected on create.
Create Org Team
Creates a new org team for the company associated with your access token. The platform sets companyId, id, active, and status automatically.
Request Body: mandatory fields
| Parameter | Type | Required | Description |
|---|---|---|---|
name |
string | Yes | Display name for the org team (max 100 characters). |
Optional fields
| Parameter | Type | Default | Description |
|---|---|---|---|
leaderId |
string | null |
User ID of the team owner or manager. |
subsidiaryId |
string | null |
Subsidiary the team belongs to, when your program uses subsidiaries. |
externalId |
string | null |
External system identifier (max 100 characters). |
active |
boolean | true |
Whether the org team is active. |
status |
string | "active" |
Lifecycle status. Values: active, archived, deleted. |
Example Request
Using cURL:
curl -X POST https://sandbox.custodia-tech.com/md/api/OrgTeams \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "x-appid: YOUR_CLIENT_ID" \
-H "Content-Type: application/json" \
-d '{
"name": "Regional Sales Team"
}'
Using JavaScript (fetch):
const response = await fetch('https://sandbox.custodia-tech.com/md/api/OrgTeams', {
method: 'POST',
headers: {
'Authorization': `Bearer ${accessToken}`,
'x-appid': clientId,
'Content-Type': 'application/json'
},
body: JSON.stringify({
name: 'Regional Sales Team'
})
});
const orgTeam = await response.json();
Response
Success Response (200 OK)
{
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"name": "Regional Sales Team",
"active": true,
"companyId": "your-company-id",
"status": "active"
}
Update Org Team
Partially updates an existing org team. Only include fields you want to change. Do not send companyId or id: they cannot be changed via this endpoint.
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
orgTeamId |
string | Yes | UUID of the org team to update |
Request Body
All fields are optional on update. Send only the properties you want to change:
| Parameter | Type | Description |
|---|---|---|
name |
string | Display name (max 100 characters). Must remain unique within your company and subsidiary. |
leaderId |
string | User ID of the team owner or manager. |
subsidiaryId |
string | Subsidiary the team belongs to. |
externalId |
string | External system identifier (max 100 characters). |
active |
boolean | Whether the org team is active. |
status |
string | Lifecycle status: active, archived, or deleted. |
Example Request
Rename the team and assign a leader:
Using cURL:
curl -X PATCH https://sandbox.custodia-tech.com/md/api/OrgTeams/a1b2c3d4-e5f6-7890-abcd-ef1234567890 \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "x-appid: YOUR_CLIENT_ID" \
-H "Content-Type: application/json" \
-d '{
"name": "North America Sales Team",
"leaderId": "your-user-id"
}'
Using JavaScript (fetch):
const orgTeamId = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';
const response = await fetch(`https://sandbox.custodia-tech.com/md/api/OrgTeams/${orgTeamId}`, {
method: 'PATCH',
headers: {
'Authorization': `Bearer ${accessToken}`,
'x-appid': clientId,
'Content-Type': 'application/json'
},
body: JSON.stringify({
name: 'North America Sales Team',
leaderId: 'your-user-id'
})
});
const orgTeam = await response.json();
Response
Success Response (200 OK)
{
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"name": "North America Sales Team",
"active": true,
"companyId": "your-company-id",
"leaderId": "your-user-id",
"status": "active"
}
Get Org Team by ID
Retrieves a single org team by its ID. Use the id returned from create org team.
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
orgTeamId |
string | Yes | Unique identifier of the org team |
Example Request
Using cURL:
curl -X GET https://sandbox.custodia-tech.com/md/api/OrgTeams/a1b2c3d4-e5f6-7890-abcd-ef1234567890 \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "x-appid: YOUR_CLIENT_ID"
Using JavaScript (fetch):
const orgTeamId = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';
const response = await fetch(`https://sandbox.custodia-tech.com/md/api/OrgTeams/${orgTeamId}`, {
method: 'GET',
headers: {
'Authorization': `Bearer ${accessToken}`,
'x-appid': clientId
}
});
const orgTeam = await response.json();
Response
Success Response (200 OK)
{
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"name": "Regional Sales Team",
"active": true,
"companyId": "your-company-id",
"leaderId": null,
"subsidiaryId": null,
"externalId": null,
"status": "active",
"deletedOn": null,
"deletedBy": null
}
Create Team User Mapping
Assigns a user to an org team by creating a team user mapping: the join record that links a user (memberId) to a team (teamId). Users are not added to teams by updating the org team or user record directly.
Prerequisites: the org team and user must already exist. Create users via Create User and org teams via create org team before calling this endpoint.
Request Body: mandatory fields
| Parameter | Type | Required | Description |
|---|---|---|---|
teamId |
string | Yes | Org team UUID to assign the user to. |
teamType |
string | Yes | Team type. Use OrgTeam for org team membership. |
memberId |
string | Yes | User UUID to add to the team. |
Optional fields
| Parameter | Type | Default | Description |
|---|---|---|---|
order |
number | 0 |
Sort order when a user belongs to multiple teams. |
teamType, teamId, and memberId can exist only once per company. Duplicate mappings are rejected. A user may belong to multiple org teams: create one mapping per team.
Example Request
Using cURL:
curl -X POST https://sandbox.custodia-tech.com/md/api/TeamUserMappings \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "x-appid: YOUR_CLIENT_ID" \
-H "Content-Type: application/json" \
-d '{
"teamId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"teamType": "OrgTeam",
"memberId": "b2c3d4e5-f6a7-8901-bcde-f12345678901"
}'
Using JavaScript (fetch):
const response = await fetch('https://sandbox.custodia-tech.com/md/api/TeamUserMappings', {
method: 'POST',
headers: {
'Authorization': `Bearer ${accessToken}`,
'x-appid': clientId,
'Content-Type': 'application/json'
},
body: JSON.stringify({
teamId: 'a1b2c3d4-e5f6-7890-abcd-ef1234567890',
teamType: 'OrgTeam',
memberId: 'b2c3d4e5-f6a7-8901-bcde-f12345678901'
})
});
const mapping = await response.json();
Response
Success Response (200 OK)
{
"id": "f6a7b8c9-d0e1-2345-fabc-678901234567",
"teamId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"teamType": "OrgTeam",
"memberId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
"order": 0,
"companyId": "your-company-id"
}
After creating the mapping, confirm membership with get org team members. Save the returned id to update or remove the mapping later.
Update Team User Mapping
Partially updates an existing team user mapping. Only include fields you want to change. Do not send companyId or id: they cannot be changed via this endpoint.
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
teamUserMappingId |
string | Yes | UUID of the team user mapping to update |
Request Body
All fields are optional on update. Send only the properties you want to change:
| Parameter | Type | Description |
|---|---|---|
order |
number | Sort order when a user belongs to multiple teams. |
teamId |
string | Org team UUID. Must remain unique with teamType and memberId. |
teamType |
string | Team type (for example OrgTeam). |
memberId |
string | User UUID. Must remain unique with teamType and teamId. |
To move a user to a different org team, you can update teamId or delete the existing mapping and create a new one.
Example Request
Change the sort order for a user with multiple team memberships:
Using cURL:
curl -X PATCH https://sandbox.custodia-tech.com/md/api/TeamUserMappings/f6a7b8c9-d0e1-2345-fabc-678901234567 \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "x-appid: YOUR_CLIENT_ID" \
-H "Content-Type: application/json" \
-d '{
"order": 1
}'
Using JavaScript (fetch):
const teamUserMappingId = 'f6a7b8c9-d0e1-2345-fabc-678901234567';
const response = await fetch(`https://sandbox.custodia-tech.com/md/api/TeamUserMappings/${teamUserMappingId}`, {
method: 'PATCH',
headers: {
'Authorization': `Bearer ${accessToken}`,
'x-appid': clientId,
'Content-Type': 'application/json'
},
body: JSON.stringify({
order: 1
})
});
const mapping = await response.json();
Response
Success Response (200 OK)
{
"id": "f6a7b8c9-d0e1-2345-fabc-678901234567",
"teamId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"teamType": "OrgTeam",
"memberId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
"order": 1,
"companyId": "your-company-id"
}
Delete Team User Mapping
Removes a user from an org team by deleting the team user mapping. Use the mapping id returned from create team user mapping. This soft-deletes the mapping record: the user and org team are not deleted.
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
teamUserMappingId |
string | Yes | UUID of the team user mapping to delete |
Example Request
Using cURL:
curl -X DELETE https://sandbox.custodia-tech.com/md/api/TeamUserMappings/f6a7b8c9-d0e1-2345-fabc-678901234567 \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "x-appid: YOUR_CLIENT_ID"
Using JavaScript (fetch):
const teamUserMappingId = 'f6a7b8c9-d0e1-2345-fabc-678901234567';
const response = await fetch(`https://sandbox.custodia-tech.com/md/api/TeamUserMappings/${teamUserMappingId}`, {
method: 'DELETE',
headers: {
'Authorization': `Bearer ${accessToken}`,
'x-appid': clientId
}
});
const result = await response.json();
Response
Success Response (200 OK)
{
"count": 1
}
A count of 1 confirms one mapping was removed. A count of 0 means no matching mapping was found (already deleted or invalid ID).
Get Org Team Members
Returns all users who are members of the org team, including members of child teams in the hierarchy. Use the org team id from create org team or get org team by ID.
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
orgTeamId |
string | Yes | Unique identifier of the org team |
Query Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
filter |
object (JSON) | No | Optional LoopBack filter to limit fields, sort, or paginate results (for example {"fields": ["id", "firstname", "lastname", "email"], "limit": 50}). Pass as a URL-encoded JSON string. |
Example Request
Using cURL:
curl -X GET https://sandbox.custodia-tech.com/md/api/OrgTeams/a1b2c3d4-e5f6-7890-abcd-ef1234567890/allMembers \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "x-appid: YOUR_CLIENT_ID"
Using JavaScript (fetch):
const orgTeamId = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';
const response = await fetch(`https://sandbox.custodia-tech.com/md/api/OrgTeams/${orgTeamId}/allMembers`, {
method: 'GET',
headers: {
'Authorization': `Bearer ${accessToken}`,
'x-appid': clientId
}
});
const { members } = await response.json();
Response
Success Response (200 OK)
{
"members": [
{
"id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
"firstname": "Alex",
"lastname": "Rivera",
"middlename": null,
"suffix": null,
"reason": "active",
"photoId": null,
"email": "alex.rivera@example.com",
"employeeId": "1042",
"subsidiaryId": null,
"name": "Alex Rivera"
},
{
"id": "c3d4e5f6-a7b8-9012-cdef-123456789012",
"firstname": "Jordan",
"lastname": "Lee",
"middlename": null,
"suffix": null,
"reason": "active",
"photoId": "profile-photo-abc123.png",
"email": "jordan.lee@example.com",
"employeeId": null,
"subsidiaryId": null,
"name": "Jordan Lee"
},
{
"id": "d4e5f6a7-b8c9-0123-def0-234567890123",
"firstname": "Sam",
"lastname": "Taylor",
"middlename": null,
"suffix": null,
"reason": "new",
"photoId": null,
"email": "sam.taylor@example.com",
"employeeId": "2201",
"subsidiaryId": null,
"name": "Sam Taylor"
}
]
}
Member fields
| Field | Type | Description |
|---|---|---|
id |
string | User UUID. |
firstname |
string | User’s first name. |
lastname |
string | User’s last name. |
middlename |
string | Middle name, if set. |
suffix |
string | Name suffix, if set. |
name |
string | Full display name. |
email |
string | User’s email address. |
employeeId |
string | Employee or external HR identifier, if set. |
reason |
string | User status reason (for example active or new). |
photoId |
string | Profile photo file reference, if set. |
subsidiaryId |
string | Subsidiary the user belongs to, if set. |
Org Team Fields
Summary of all fields returned by the API:
| Field | Type | On create | Description |
|---|---|---|---|
name |
string | Required | Display name (max 100 characters). |
leaderId |
string | Optional | Owner or manager user ID. |
subsidiaryId |
string | Optional | Subsidiary scope, when applicable. |
externalId |
string | Optional | Identifier in an external HR or directory system. |
active |
boolean | Optional (default true) |
Whether the org team is active. |
status |
string | Optional (default active) |
Lifecycle status: active, archived, or deleted. |
id |
string | Set by platform | UUID assigned on create. |
companyId |
string | Set by platform | Company resolved from your access token. |
deletedOn |
string (ISO date) | Read-only | Timestamp when the org team was deleted, if applicable. |
deletedBy |
string | Read-only | User ID that deleted the org team, if applicable. |
Error Responses
All endpoints may return the following error responses:
| Status Code | Description | Solution |
|---|---|---|
400 Bad Request |
Missing required fields, duplicate org team name, or duplicate team user mapping |
Include all mandatory fields; use unique team names and one mapping per user–team pair |
401 Unauthorized |
Invalid or missing access token | Verify your access token is valid and included in the Authorization header |
403 Forbidden |
Insufficient permissions | Verify your access token has the required scopes and permissions |
404 Not Found |
Org team or team user mapping not found | Verify the ID is correct and belongs to your company |
Related documentation
- Users: create and manage users in your company
- Cost center: accounting tags for spend routing
- Budget mapping: route spend by
teamId - Authentication: obtain access tokens