Which sites they see

curl --request PATCH \
  --url 'https://truestat.io/api/v1/team/members/{userId}/sites' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "site_ids": [
    "00000000-0000-0000-0000-000000000000"
  ]
}'

{
  "data": {
    "sites": [
      "6fed8980-a119-4a9c-a4d4-53e448ef9f9e"
    ],
    "user_id": "9c9df94f-59f2-4080-bc3c-21b80ebdfe9c"
  },
  "meta": {}
}

Confines somebody to a subset of the account's sites.

Sending [] grants every site

A member with no restriction reaches the whole organisation — that is the default, and it is what an account looks like before anybody scopes anything. So the way to remove a restriction is to send an empty list:

{ "site_ids": [] }

There is no separate "unscope" endpoint, because there is no separate state. A caller who reads [] as lock them out of everything and sends it has done the exact opposite of what they meant, and nothing in the response will look wrong: it answers 200 with sites: null, which is the truthful report of what they just did.

If the intent is to stop somebody seeing anything, remove them from the team.

Reading it back

GET /team reports the same state the same way — null for every site, an array for a restriction. This endpoint's response matches it deliberately, so a caller can compare before and after without translating between two shapes.

Every id must be yours

A site id belonging to another account is refused with 400.

It would not have granted anything — access is resolved through the organisation regardless of what this table says — but it would leave a row claiming somebody can see a site they cannot, and the team screen would be showing something untrue.

Duplicates in the list are collapsed rather than refused.

The owner is never scoped

409 last_owner. An owner confined to a subset could not assign a site they cannot see, and could not see it to notice — the account becomes unmanageable from inside.

Authorizations

Path parameters

Request bodyapplication/json

Response