The team

curl --request GET \
  --url 'https://truestat.io/api/v1/team' \
  --header 'Authorization: Bearer <token>'

{
  "data": [
    {
      "role": "owner",
      "sites": null,
      "pending": false,
      "user_id": "734c7de3-58f1-46e6-83d1-2be85466ee70",
      "created_at": "2026-09-03T17:55:11Z",
      "accepted_at": "2026-09-03T17:55:11Z",
      "invited_email": null
    },
    {
      "role": "admin",
      "sites": [
        "6fed8980-a119-4a9c-a4d4-53e448ef9f9e"
      ],
      "pending": false,
      "user_id": "9c9df94f-59f2-4080-bc3c-21b80ebdfe9c",
      "created_at": "2026-09-14T08:12:40Z",
      "accepted_at": "2026-09-14T08:59:25Z",
      "invited_email": null
    }
  ],
  "meta": {}
}

Everyone who holds a seat, whether or not they have accepted yet.

A pending invitation is still a seat

The row exists from the moment the invitation is sent — before the person has an account, before they have clicked anything. That is deliberate, because the plan's seat limit counts rows: an invitation you have forgotten about is occupying a seat you are paying for.

pending separates them. A caller counting "people who can sign in" wants the accepted ones; a caller checking "how close am I to the limit" wants all of them.

sites: null means every site

This is the field most likely to be misread, and reading it wrong has real consequences on the site scope endpoint.

A member with no restriction reaches the whole organisation. That is the default, and it is what null reports. An array means they are confined to those sites and nothing else.

No email addresses for people who joined

invited_email disappears once somebody accepts. From then on they are a user_id.

An API key is not a person, and an endpoint that lists a company's staff addresses is a disclosure with no purpose here — every other endpoint identifies a member by their id, and the one place an address is genuinely needed is the invitation itself, where you supplied it.

Roles

Only admin and member can be invited or assigned. Ownership is transferred deliberately from the dashboard, and viewer is not offered while the permission rules do not actually enforce it.

Authorizations

Response