Org Team

Create, update, and retrieve org teams and their members for white label programs

Overview

Org teams represent your company’s organizational hierarchy: for example departments, regions, or business units. Use org teams to group users, define managers, and scope spend or benefits. Create org teams before assigning users to teams or referencing them in budget mappings (teamId).

Typical flow:

  1. Create an org team: POST /md/api/OrgTeams
  2. Update an org team: PATCH /md/api/OrgTeams/{orgTeamId}
  3. Retrieve by ID: GET /md/api/OrgTeams/{orgTeamId}
  4. Assign a user to the team: POST /md/api/TeamUserMappings
  5. Update a mapping: PATCH /md/api/TeamUserMappings/{teamUserMappingId}
  6. Remove a user from the team: DELETE /md/api/TeamUserMappings/{teamUserMappingId}
  7. List members: GET /md/api/OrgTeams/{orgTeamId}/allMembers

Authentication: All endpoints require Authorization: Bearer {access_token} and x-appid: {clientId}. The company is resolved from your access token scope: do not send companyId in request bodies. See Authentication.

Name uniqueness: name must be unique within your company (and subsidiary, when subsidiaryId is set). Duplicate names are rejected on create.

Create Org Team

POST /md/api/OrgTeams

Creates a new org team for the company associated with your access token. The platform sets companyId, id, active, and status automatically.

Request Body: mandatory fields

Parameter Type Required Description
name string Yes Display name for the org team (max 100 characters).

Optional fields

Parameter Type Default Description
leaderId string null User ID of the team owner or manager.
subsidiaryId string null Subsidiary the team belongs to, when your program uses subsidiaries.
externalId string null External system identifier (max 100 characters).
active boolean true Whether the org team is active.
status string "active" Lifecycle status. Values: active, archived, deleted.

Example Request

Using cURL:

curl -X POST https://sandbox.custodia-tech.com/md/api/OrgTeams \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "x-appid: YOUR_CLIENT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Regional Sales Team"
  }'

Using JavaScript (fetch):

const response = await fetch('https://sandbox.custodia-tech.com/md/api/OrgTeams', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'x-appid': clientId,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'Regional Sales Team'
  })
});

const orgTeam = await response.json();

Response

Success Response (200 OK)

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "name": "Regional Sales Team",
  "active": true,
  "companyId": "your-company-id",
  "status": "active"
}

Update Org Team

PATCH /md/api/OrgTeams/{orgTeamId}

Partially updates an existing org team. Only include fields you want to change. Do not send companyId or id: they cannot be changed via this endpoint.

Path Parameters

Parameter Type Required Description
orgTeamId string Yes UUID of the org team to update

Request Body

All fields are optional on update. Send only the properties you want to change:

Parameter Type Description
name string Display name (max 100 characters). Must remain unique within your company and subsidiary.
leaderId string User ID of the team owner or manager.
subsidiaryId string Subsidiary the team belongs to.
externalId string External system identifier (max 100 characters).
active boolean Whether the org team is active.
status string Lifecycle status: active, archived, or deleted.

Example Request

Rename the team and assign a leader:

Using cURL:

curl -X PATCH https://sandbox.custodia-tech.com/md/api/OrgTeams/a1b2c3d4-e5f6-7890-abcd-ef1234567890 \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "x-appid: YOUR_CLIENT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "North America Sales Team",
    "leaderId": "your-user-id"
  }'

Using JavaScript (fetch):

const orgTeamId = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';

const response = await fetch(`https://sandbox.custodia-tech.com/md/api/OrgTeams/${orgTeamId}`, {
  method: 'PATCH',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'x-appid': clientId,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'North America Sales Team',
    leaderId: 'your-user-id'
  })
});

const orgTeam = await response.json();

Response

Success Response (200 OK)

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "name": "North America Sales Team",
  "active": true,
  "companyId": "your-company-id",
  "leaderId": "your-user-id",
  "status": "active"
}

Get Org Team by ID

GET /md/api/OrgTeams/{orgTeamId}

Retrieves a single org team by its ID. Use the id returned from create org team.

Path Parameters

Parameter Type Required Description
orgTeamId string Yes Unique identifier of the org team

Example Request

Using cURL:

curl -X GET https://sandbox.custodia-tech.com/md/api/OrgTeams/a1b2c3d4-e5f6-7890-abcd-ef1234567890 \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "x-appid: YOUR_CLIENT_ID"

Using JavaScript (fetch):

const orgTeamId = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';

const response = await fetch(`https://sandbox.custodia-tech.com/md/api/OrgTeams/${orgTeamId}`, {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'x-appid': clientId
  }
});

const orgTeam = await response.json();

Response

Success Response (200 OK)

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "name": "Regional Sales Team",
  "active": true,
  "companyId": "your-company-id",
  "leaderId": null,
  "subsidiaryId": null,
  "externalId": null,
  "status": "active",
  "deletedOn": null,
  "deletedBy": null
}

Create Team User Mapping

POST /md/api/TeamUserMappings

Assigns a user to an org team by creating a team user mapping: the join record that links a user (memberId) to a team (teamId). Users are not added to teams by updating the org team or user record directly.

Prerequisites: the org team and user must already exist. Create users via Create User and org teams via create org team before calling this endpoint.

Request Body: mandatory fields

Parameter Type Required Description
teamId string Yes Org team UUID to assign the user to.
teamType string Yes Team type. Use OrgTeam for org team membership.
memberId string Yes User UUID to add to the team.

Optional fields

Parameter Type Default Description
order number 0 Sort order when a user belongs to multiple teams.
Unique mapping: Each combination of teamType, teamId, and memberId can exist only once per company. Duplicate mappings are rejected. A user may belong to multiple org teams: create one mapping per team.

Example Request

Using cURL:

curl -X POST https://sandbox.custodia-tech.com/md/api/TeamUserMappings \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "x-appid: YOUR_CLIENT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "teamId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "teamType": "OrgTeam",
    "memberId": "b2c3d4e5-f6a7-8901-bcde-f12345678901"
  }'

Using JavaScript (fetch):

const response = await fetch('https://sandbox.custodia-tech.com/md/api/TeamUserMappings', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'x-appid': clientId,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    teamId: 'a1b2c3d4-e5f6-7890-abcd-ef1234567890',
    teamType: 'OrgTeam',
    memberId: 'b2c3d4e5-f6a7-8901-bcde-f12345678901'
  })
});

const mapping = await response.json();

Response

Success Response (200 OK)

{
  "id": "f6a7b8c9-d0e1-2345-fabc-678901234567",
  "teamId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "teamType": "OrgTeam",
  "memberId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "order": 0,
  "companyId": "your-company-id"
}

After creating the mapping, confirm membership with get org team members. Save the returned id to update or remove the mapping later.

Update Team User Mapping

PATCH /md/api/TeamUserMappings/{teamUserMappingId}

Partially updates an existing team user mapping. Only include fields you want to change. Do not send companyId or id: they cannot be changed via this endpoint.

Path Parameters

Parameter Type Required Description
teamUserMappingId string Yes UUID of the team user mapping to update

Request Body

All fields are optional on update. Send only the properties you want to change:

Parameter Type Description
order number Sort order when a user belongs to multiple teams.
teamId string Org team UUID. Must remain unique with teamType and memberId.
teamType string Team type (for example OrgTeam).
memberId string User UUID. Must remain unique with teamType and teamId.

To move a user to a different org team, you can update teamId or delete the existing mapping and create a new one.

Example Request

Change the sort order for a user with multiple team memberships:

Using cURL:

curl -X PATCH https://sandbox.custodia-tech.com/md/api/TeamUserMappings/f6a7b8c9-d0e1-2345-fabc-678901234567 \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "x-appid: YOUR_CLIENT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "order": 1
  }'

Using JavaScript (fetch):

const teamUserMappingId = 'f6a7b8c9-d0e1-2345-fabc-678901234567';

const response = await fetch(`https://sandbox.custodia-tech.com/md/api/TeamUserMappings/${teamUserMappingId}`, {
  method: 'PATCH',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'x-appid': clientId,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    order: 1
  })
});

const mapping = await response.json();

Response

Success Response (200 OK)

{
  "id": "f6a7b8c9-d0e1-2345-fabc-678901234567",
  "teamId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "teamType": "OrgTeam",
  "memberId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "order": 1,
  "companyId": "your-company-id"
}

Delete Team User Mapping

DELETE /md/api/TeamUserMappings/{teamUserMappingId}

Removes a user from an org team by deleting the team user mapping. Use the mapping id returned from create team user mapping. This soft-deletes the mapping record: the user and org team are not deleted.

Path Parameters

Parameter Type Required Description
teamUserMappingId string Yes UUID of the team user mapping to delete

Example Request

Using cURL:

curl -X DELETE https://sandbox.custodia-tech.com/md/api/TeamUserMappings/f6a7b8c9-d0e1-2345-fabc-678901234567 \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "x-appid: YOUR_CLIENT_ID"

Using JavaScript (fetch):

const teamUserMappingId = 'f6a7b8c9-d0e1-2345-fabc-678901234567';

const response = await fetch(`https://sandbox.custodia-tech.com/md/api/TeamUserMappings/${teamUserMappingId}`, {
  method: 'DELETE',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'x-appid': clientId
  }
});

const result = await response.json();

Response

Success Response (200 OK)

{
  "count": 1
}

A count of 1 confirms one mapping was removed. A count of 0 means no matching mapping was found (already deleted or invalid ID).

Get Org Team Members

GET /md/api/OrgTeams/{orgTeamId}/allMembers

Returns all users who are members of the org team, including members of child teams in the hierarchy. Use the org team id from create org team or get org team by ID.

Path Parameters

Parameter Type Required Description
orgTeamId string Yes Unique identifier of the org team

Query Parameters

Parameter Type Required Description
filter object (JSON) No Optional LoopBack filter to limit fields, sort, or paginate results (for example {"fields": ["id", "firstname", "lastname", "email"], "limit": 50}). Pass as a URL-encoded JSON string.

Example Request

Using cURL:

curl -X GET https://sandbox.custodia-tech.com/md/api/OrgTeams/a1b2c3d4-e5f6-7890-abcd-ef1234567890/allMembers \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "x-appid: YOUR_CLIENT_ID"

Using JavaScript (fetch):

const orgTeamId = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';

const response = await fetch(`https://sandbox.custodia-tech.com/md/api/OrgTeams/${orgTeamId}/allMembers`, {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'x-appid': clientId
  }
});

const { members } = await response.json();

Response

Success Response (200 OK)

{
  "members": [
    {
      "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
      "firstname": "Alex",
      "lastname": "Rivera",
      "middlename": null,
      "suffix": null,
      "reason": "active",
      "photoId": null,
      "email": "alex.rivera@example.com",
      "employeeId": "1042",
      "subsidiaryId": null,
      "name": "Alex Rivera"
    },
    {
      "id": "c3d4e5f6-a7b8-9012-cdef-123456789012",
      "firstname": "Jordan",
      "lastname": "Lee",
      "middlename": null,
      "suffix": null,
      "reason": "active",
      "photoId": "profile-photo-abc123.png",
      "email": "jordan.lee@example.com",
      "employeeId": null,
      "subsidiaryId": null,
      "name": "Jordan Lee"
    },
    {
      "id": "d4e5f6a7-b8c9-0123-def0-234567890123",
      "firstname": "Sam",
      "lastname": "Taylor",
      "middlename": null,
      "suffix": null,
      "reason": "new",
      "photoId": null,
      "email": "sam.taylor@example.com",
      "employeeId": "2201",
      "subsidiaryId": null,
      "name": "Sam Taylor"
    }
  ]
}

Member fields

Field Type Description
id string User UUID.
firstname string User’s first name.
lastname string User’s last name.
middlename string Middle name, if set.
suffix string Name suffix, if set.
name string Full display name.
email string User’s email address.
employeeId string Employee or external HR identifier, if set.
reason string User status reason (for example active or new).
photoId string Profile photo file reference, if set.
subsidiaryId string Subsidiary the user belongs to, if set.

Org Team Fields

Summary of all fields returned by the API:

Field Type On create Description
name string Required Display name (max 100 characters).
leaderId string Optional Owner or manager user ID.
subsidiaryId string Optional Subsidiary scope, when applicable.
externalId string Optional Identifier in an external HR or directory system.
active boolean Optional (default true) Whether the org team is active.
status string Optional (default active) Lifecycle status: active, archived, or deleted.
id string Set by platform UUID assigned on create.
companyId string Set by platform Company resolved from your access token.
deletedOn string (ISO date) Read-only Timestamp when the org team was deleted, if applicable.
deletedBy string Read-only User ID that deleted the org team, if applicable.

Error Responses

All endpoints may return the following error responses:

Status Code Description Solution
400 Bad Request Missing required fields, duplicate org team name, or duplicate team user mapping Include all mandatory fields; use unique team names and one mapping per user–team pair
401 Unauthorized Invalid or missing access token Verify your access token is valid and included in the Authorization header
403 Forbidden Insufficient permissions Verify your access token has the required scopes and permissions
404 Not Found Org team or team user mapping not found Verify the ID is correct and belongs to your company