# Referencia de la API

Explora la API REST pública: endpoints, permisos, esquemas de peticiones y respuestas, y códigos de error.

Source: https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/api
Index: https://nextjs-saas-template.lubomirgeorgiev.com/llms.txt

Todos los endpoints de la API REST pública, generados a partir de los mismos esquemas que valida el servidor. Autentícate con una clave de API desde tus ajustes o con un token de acceso OAuth.

Agentes de IA: la versión Markdown de esta página, en la misma ruta con el sufijo .md, lista los endpoints para llamadas REST directas. Usa el documento OpenAPI para generar herramientas y clientes, y validar esquemas con exactitud. Usa MCP en /mcp cuando el cliente lo admita.

OAuth 2.1 usa el flujo de código de autorización con PKCE. Envía a los usuarios a /oauth/authorize. Intercambia el código en /oauth/token.

Envía una clave de API o un token de acceso OAuth como Authorization: Bearer TOKEN. Los cuerpos de petición usan application/json. Los errores usan application/problem+json. Decide según code y lee detail antes de la siguiente acción.

Las peticiones autenticadas a la API están limitadas a 300 peticiones por cada 60 segundos y credencial. Cada respuesta incluye RateLimit-Limit, RateLimit-Remaining y RateLimit-Reset (segundos hasta que se reinicia la ventana); una respuesta 429 incluye además retry-after.

URL base `https://nextjs-saas-template.lubomirgeorgiev.com`

v1.0.0

[Abrir la referencia Markdown de la API](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/api.md) [Abrir el documento OpenAPI](https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/openapi.json) [Cómo funciona la autenticación](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md) [Códigos de error](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/api/errors.md) [Conectar un agente de IA por MCP](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md)

Filtra endpoints, campos y permisos...

`/`

20 de 20 endpoints

## Account

GET `/api/v1/credential`

### Describe the calling credential

Returns what the credential making this request is: how it was issued, whether it acts for the whole account or for one team, the id of that team when it has one, and the scopes in force. Call this first when a request is refused, to see what this credential may actually do — the scopes listed are the ones enforced, which can be narrower than the set the credential was issued with. Requires no scope, so it answers whatever the caller holds; it reports only the caller's own grant and never the account behind it, so the team is an id and nothing more. Use getTeam for the team name and slug, and getMe for the account profile, which a team-scoped API key cannot reach.

[Permiso Cualquier credencial](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Este endpoint necesita una credencial, pero ningún permiso concreto.") [Herramienta MCP `getCredential`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `getCredential`

#### Petición

curl

```
curl "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/credential" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The calling credential. `application/json object`

`kind` `string` Obligatorio

enum: api-key oauth-grant

`audience` `string` Obligatorio

enum: personal team

`team` `object` Obligatorio acepta null

`team.id` `string` Obligatorio

`scopes` `string[]` Obligatorio

Ejemplo

```
{
  "kind" :  "api-key" ,
  "audience" :  "personal" ,
  "team" :  {
    "id" :  "string"
  } ,
  "scopes" :  [
    "string"
  ]
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

GET `/api/v1/me`

### Get the authenticated account

Returns the profile of the account the credential belongs to: id, email, name, role, avatar, preferred locale, and verification/creation timestamps. Account-level: a team-scoped API key is refused with 403.

[Permiso `profile:read`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Read your account profile, sessions, and preferences.") [Herramienta MCP `getMe`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `getMe`

#### Petición

curl

```
curl "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/me" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The authenticated account. `application/json object`

`id` `string` Obligatorio

`email` `string` Obligatorio acepta null

`firstName` `string` Obligatorio acepta null

`lastName` `string` Obligatorio acepta null

`role` `string` Obligatorio

`avatar` `string` Obligatorio acepta null

`preferredLocale` `string` Obligatorio acepta null

`emailVerified` `string` Obligatorio acepta null format: date-time

`createdAt` `string` Obligatorio format: date-time

`updatedAt` `string` Obligatorio format: date-time

Ejemplo

```
{
  "id" :  "string" ,
  "email" :  "string" ,
  "firstName" :  "string" ,
  "lastName" :  "string" ,
  "role" :  "string" ,
  "avatar" :  "string" ,
  "preferredLocale" :  "string" ,
  "emailVerified" :  "2026-01-01T00:00:00.000Z" ,
  "createdAt" :  "2026-01-01T00:00:00.000Z" ,
  "updatedAt" :  "2026-01-01T00:00:00.000Z"
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

PATCH `/api/v1/me`

### Update the authenticated account

Updates the first and last name of the authenticated account. Both fields are required; the response is the account as it stands after the update. Account-level: a team-scoped API key is refused with 403.

[Permiso `profile:write`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Update your account profile and revoke your sessions.") [Herramienta MCP `updateMe`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `updateMe`

#### Cuerpo de la petición

`application/json`

`firstName` `string` Obligatorio minLength 2 maxLength 255

`lastName` `string` Obligatorio minLength 2 maxLength 255

#### Petición

curl

```
curl -X PATCH "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/me" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "firstName": "string",
  "lastName": "string"
}'
```

#### Respuesta

200 The updated account. `application/json object`

`id` `string` Obligatorio

`email` `string` Obligatorio acepta null

`firstName` `string` Obligatorio acepta null

`lastName` `string` Obligatorio acepta null

`role` `string` Obligatorio

`avatar` `string` Obligatorio acepta null

`preferredLocale` `string` Obligatorio acepta null

`emailVerified` `string` Obligatorio acepta null format: date-time

`createdAt` `string` Obligatorio format: date-time

`updatedAt` `string` Obligatorio format: date-time

Ejemplo

```
{
  "id" :  "string" ,
  "email" :  "string" ,
  "firstName" :  "string" ,
  "lastName" :  "string" ,
  "role" :  "string" ,
  "avatar" :  "string" ,
  "preferredLocale" :  "string" ,
  "emailVerified" :  "2026-01-01T00:00:00.000Z" ,
  "createdAt" :  "2026-01-01T00:00:00.000Z" ,
  "updatedAt" :  "2026-01-01T00:00:00.000Z"
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

GET `/api/v1/me/sessions`

### List sign-in sessions

Lists the account's active browser/app sign-in sessions, newest first, with the device and location recorded at sign-in. \`isCurrentSession\` is false for every bearer credential. Account-level: a team-scoped API key is refused with 403.

[Permiso `profile:read`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Read your account profile, sessions, and preferences.") [Herramienta MCP `listMySessions`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `listMySessions`

#### Petición

curl

```
curl "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/me/sessions" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The account's sessions. `application/json object[]`

`id` `string` Obligatorio

`createdAt` `string` Obligatorio format: date-time

`expiresAt` `string` Obligatorio format: date-time

`isCurrentSession` `boolean` Obligatorio

`authenticationType` `string` Obligatorio acepta null

`country` `string` Obligatorio acepta null

`city` `string` Obligatorio acepta null

`browser` `string` Obligatorio acepta null

`os` `string` Obligatorio acepta null

`deviceType` `string` Obligatorio acepta null

Ejemplo

```
[
  {
    "id" :  "string" ,
    "createdAt" :  "2026-01-01T00:00:00.000Z" ,
    "expiresAt" :  "2026-01-01T00:00:00.000Z" ,
    "isCurrentSession" :  true ,
    "authenticationType" :  "string" ,
    "country" :  "string" ,
    "city" :  "string" ,
    "browser" :  "string" ,
    "os" :  "string" ,
    "deviceType" :  "string"
  }
]
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

DELETE `/api/v1/me/sessions/{sessionId}`

### Revoke a sign-in session

Signs the account out of one session. Revocation is scoped to the caller's own sessions, so an unknown session id is a no-op rather than an error. Account-level: a team-scoped API key is refused with 403.

[Permiso `profile:write`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Update your account profile and revoke your sessions.") [Herramienta MCP `revokeMySession`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `revokeMySession`

#### Parámetros

`sessionId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Petición

curl

```
curl -X DELETE "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/me/sessions/{sessionId}" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The session was revoked. `application/json object`

`success` `boolean` Obligatorio const: true

Ejemplo

```
{
  "success" :  true
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

## Teams

GET `/api/v1/teams`

### List the caller's teams

Lists every team the authenticated account is an active member of, with the account's role in each. Teams whose membership is inactive or expired are omitted. A team-scoped API key lists only the single team it is scoped to.

[Permiso `teams:read`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "List the teams you belong to and read their details.") [Herramienta MCP `listTeams`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `listTeams`

#### Petición

curl

```
curl "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The caller's teams. `application/json object[]`

`id` `string` Obligatorio

`name` `string` Obligatorio

`slug` `string` Obligatorio

`description` `string` Obligatorio acepta null

`avatarUrl` `string` Obligatorio acepta null

`role` `object` Obligatorio

`role.id` `string` Obligatorio

`role.name` `string` Obligatorio

Ejemplo

```
[
  {
    "id" :  "string" ,
    "name" :  "string" ,
    "slug" :  "string" ,
    "description" :  "string" ,
    "avatarUrl" :  "string" ,
    "role" :  {
      "id" :  "string" ,
      "name" :  "string"
    }
  }
]
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

POST `/api/v1/teams`

### Create a team

Creates a team owned by the authenticated account, which also becomes its first member. The slug is derived from the name. Fails with 403 when the account is at its team limit. Account-level: a team-scoped API key is refused with 403.

[Permiso `teams:write`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Create teams and change team details.") [Herramienta MCP `createTeam`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `createTeam`

#### Cuerpo de la petición

`application/json`

`name` `string` Obligatorio minLength 1 maxLength 100

`description` `string` Opcional maxLength 1000

#### Petición

curl

```
curl -X POST "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string",
  "description": "string"
}'
```

#### Respuesta

201 The created team. `application/json object`

`id` `string` Obligatorio

`name` `string` Obligatorio

`slug` `string` Obligatorio

`description` `string` Obligatorio acepta null

`avatarUrl` `string` Obligatorio acepta null

`role` `object` Obligatorio

`role.id` `string` Obligatorio

`role.name` `string` Obligatorio

Ejemplo

```
{
  "id" :  "string" ,
  "name" :  "string" ,
  "slug" :  "string" ,
  "description" :  "string" ,
  "avatarUrl" :  "string" ,
  "role" :  {
    "id" :  "string" ,
    "name" :  "string"
  }
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

GET `/api/v1/teams/{teamId}`

### Get a team

Returns one team the authenticated account belongs to. Teams the account is not an active member of answer 404, never 403, so team ids cannot be probed.

[Permiso `teams:read`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "List the teams you belong to and read their details.") [Herramienta MCP `getTeam`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `getTeam`

#### Parámetros

`teamId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Petición

curl

```
curl "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams/{teamId}" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The team. `application/json object`

`id` `string` Obligatorio

`name` `string` Obligatorio

`slug` `string` Obligatorio

`description` `string` Obligatorio acepta null

`avatarUrl` `string` Obligatorio acepta null

`role` `object` Obligatorio

`role.id` `string` Obligatorio

`role.name` `string` Obligatorio

Ejemplo

```
{
  "id" :  "string" ,
  "name" :  "string" ,
  "slug" :  "string" ,
  "description" :  "string" ,
  "avatarUrl" :  "string" ,
  "role" :  {
    "id" :  "string" ,
    "name" :  "string"
  }
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

PATCH `/api/v1/teams/{teamId}`

### Rename a team

Changes a team's display name. Requires the \`edit\_team\_settings\` permission on that team. The slug is deliberately left alone so existing links and invitations keep working.

[Permiso `teams:write`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Create teams and change team details.") [Herramienta MCP `updateTeam`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `updateTeam`

#### Parámetros

`teamId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Cuerpo de la petición

`application/json`

`name` `string` Obligatorio minLength 1 maxLength 100

#### Petición

curl

```
curl -X PATCH "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams/{teamId}" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string"
}'
```

#### Respuesta

200 The renamed team. `application/json object`

`id` `string` Obligatorio

`name` `string` Obligatorio

`slug` `string` Obligatorio

`description` `string` Obligatorio acepta null

`avatarUrl` `string` Obligatorio acepta null

`role` `object` Obligatorio

`role.id` `string` Obligatorio

`role.name` `string` Obligatorio

Ejemplo

```
{
  "id" :  "string" ,
  "name" :  "string" ,
  "slug" :  "string" ,
  "description" :  "string" ,
  "avatarUrl" :  "string" ,
  "role" :  {
    "id" :  "string" ,
    "name" :  "string"
  }
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

## Members

GET `/api/v1/teams/{teamId}/members`

### List team members

Lists every membership of a team with the member's identity, role, and join date. Requires the \`access\_dashboard\` permission on that team.

[Permiso `members:read`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "List the members of your teams.") [Herramienta MCP `listTeamMembers`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `listTeamMembers`

#### Parámetros

`teamId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Petición

curl

```
curl "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams/{teamId}/members" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The team's members. `application/json object[]`

`membershipId` `string` Obligatorio

`userId` `string` Obligatorio

`email` `string` Obligatorio acepta null

`firstName` `string` Obligatorio acepta null

`lastName` `string` Obligatorio acepta null

`avatar` `string` Obligatorio acepta null

`roleId` `string` Obligatorio

`roleName` `string` Obligatorio acepta null

`isSystemRole` `boolean` Obligatorio

`isActive` `boolean` Obligatorio

`joinedAt` `string` Obligatorio acepta null format: date-time

Ejemplo

```
[
  {
    "membershipId" :  "string" ,
    "userId" :  "string" ,
    "email" :  "string" ,
    "firstName" :  "string" ,
    "lastName" :  "string" ,
    "avatar" :  "string" ,
    "roleId" :  "string" ,
    "roleName" :  "string" ,
    "isSystemRole" :  true ,
    "isActive" :  true ,
    "joinedAt" :  "2026-01-01T00:00:00.000Z"
  }
]
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

DELETE `/api/v1/teams/{teamId}/members/{userId}`

### Remove a team member

Removes a member from a team. Requires the \`remove\_members\` permission on that team; the team owner can never be removed this way.

[Permiso `members:write`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Change and remove members of your teams.") [Herramienta MCP `removeTeamMember`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `removeTeamMember`

#### Parámetros

`teamId` `string` Obligatorio in: path minLength 1 maxLength 255

`userId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Petición

curl

```
curl -X DELETE "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams/{teamId}/members/{userId}" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The member was removed. `application/json object`

`success` `boolean` Obligatorio const: true

Ejemplo

```
{
  "success" :  true
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

## Invitations

GET `/api/v1/teams/{teamId}/roles`

### List the roles a team can assign

Lists every role id accepted by createTeamInvitation, with the permissions each one grants. System roles (\`owner\`, \`member\`, \`guest\`) exist on every team and are passed with \`isSystemRole: true\`; roles the team defined itself are passed with \`isSystemRole: false\`. \`isAssignable\` is false for roles an invitation cannot grant, such as \`owner\`. Requires the \`access\_dashboard\` permission.

[Permiso `members:read`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "List the members of your teams.") [Herramienta MCP `listTeamRoles`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `listTeamRoles`

#### Parámetros

`teamId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Petición

curl

```
curl "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams/{teamId}/roles" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The roles this team can assign. `application/json object[]`

`roleId` `string` Obligatorio

`name` `string` Obligatorio acepta null

`isSystemRole` `boolean` Obligatorio

`isAssignable` `boolean` Obligatorio

`permissions` `string[]` Obligatorio

Ejemplo

```
[
  {
    "roleId" :  "string" ,
    "name" :  "string" ,
    "isSystemRole" :  true ,
    "isAssignable" :  true ,
    "permissions" :  [
      "string"
    ]
  }
]
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

GET `/api/v1/teams/{teamId}/invitations`

### List pending team invitations

Lists invitations that have not been accepted and have not expired. Requires the \`invite\_members\` permission; callers without it receive an empty list, never invitee emails.

[Permiso `members:read`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "List the members of your teams.") [Herramienta MCP `listTeamInvitations`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `listTeamInvitations`

#### Parámetros

`teamId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Petición

curl

```
curl "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams/{teamId}/invitations" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The team's pending invitations. `application/json object[]`

`id` `string` Obligatorio

`email` `string` Obligatorio

`roleId` `string` Obligatorio

`roleName` `string` Obligatorio acepta null

`isSystemRole` `boolean` Obligatorio

`createdAt` `string` Obligatorio format: date-time

`expiresAt` `string` Obligatorio format: date-time

Ejemplo

```
[
  {
    "id" :  "string" ,
    "email" :  "string" ,
    "roleId" :  "string" ,
    "roleName" :  "string" ,
    "isSystemRole" :  true ,
    "createdAt" :  "2026-01-01T00:00:00.000Z" ,
    "expiresAt" :  "2026-01-01T00:00:00.000Z"
  }
]
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

POST `/api/v1/teams/{teamId}/invitations`

### Invite someone to a team

Sends an invitation email for a team seat. \`roleId\` is optional and defaults to \`member\`; call listTeamRoles for the other ids this team accepts, and pass \`isSystemRole: false\` alongside a role the team defined itself. Requires the \`invite\_members\` permission and a free seat on the team's plan — inviting past the seat limit answers 403, and the response detail names the limit. The response never reveals whether the address already has an account or is already a member.

[Permiso `invites:write`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Send and revoke invitations to your teams.") [Herramienta MCP `createTeamInvitation`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `createTeamInvitation`

#### Parámetros

`teamId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Cuerpo de la petición

`application/json`

`email` `string` Obligatorio format: email minLength 1 maxLength 255

`roleId` `string` Opcional minLength 1 maxLength 255 default: "member"

`isSystemRole` `boolean` Opcional default: true

#### Petición

curl

```
curl -X POST "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams/{teamId}/invitations" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "user@example.com",
  "roleId": "member",
  "isSystemRole": true
}'
```

#### Respuesta

201 The invitation was sent. `application/json object`

`success` `boolean` Obligatorio const: true

Ejemplo

```
{
  "success" :  true
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

DELETE `/api/v1/teams/{teamId}/invitations/{invitationId}`

### Revoke a pending invitation

Deletes a pending invitation so its link stops working. Requires the \`invite\_members\` permission. An already accepted or unknown invitation answers 404.

[Permiso `invites:write`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Send and revoke invitations to your teams.") [Herramienta MCP `revokeTeamInvitation`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `revokeTeamInvitation`

#### Parámetros

`teamId` `string` Obligatorio in: path minLength 1 maxLength 255

`invitationId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Petición

curl

```
curl -X DELETE "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams/{teamId}/invitations/{invitationId}" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The invitation was revoked. `application/json object`

`success` `boolean` Obligatorio const: true

Ejemplo

```
{
  "success" :  true
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

## Billing

GET `/api/v1/teams/{teamId}/billing`

### Get a team's subscription

Read-only summary of a team's plan, subscription status, billing interval, add-on units, and renewal date. Requires the \`access\_billing\` permission. Checkout and plan changes are not exposed over the API.

[Permiso `billing:read`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Read the subscription and billing status of your teams.") [Herramienta MCP `getTeamBilling`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `getTeamBilling`

#### Parámetros

`teamId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Petición

curl

```
curl "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/teams/{teamId}/billing" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The team's subscription. `application/json object`

`planId` `string` Obligatorio

`planName` `string` Obligatorio

`status` `string` Obligatorio acepta null

`interval` `string` Obligatorio acepta null

`addons` `object<string, number>` Obligatorio

`planExpiresAt` `string` Obligatorio acepta null format: date-time

`cancelAtPeriodEnd` `boolean` Obligatorio

`needsPaymentAction` `boolean` Obligatorio

Ejemplo

```
{
  "planId" :  "string" ,
  "planName" :  "string" ,
  "status" :  "string" ,
  "interval" :  "string" ,
  "addons" :  {
    "key" :  0
  } ,
  "planExpiresAt" :  "2026-01-01T00:00:00.000Z" ,
  "cancelAtPeriodEnd" :  true ,
  "needsPaymentAction" :  true
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

## API keys

GET `/api/v1/api-keys`

### List API keys

Lists the caller's personal API keys, or a team's keys when \`teamId\` is given (which requires the \`manage\_api\_keys\` permission on that team). Revoked keys are never listed, and no response can ever contain a key's secret. Account-level: a team-scoped API key is refused with 403.

[Permiso `api-keys:read`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "List the API keys on your account and when they were last used.") [Herramienta MCP `listApiKeys`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `listApiKeys`

#### Parámetros

`teamId` `string` Opcional in: query minLength 1 maxLength 255

#### Petición

curl

```
curl "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/api-keys" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The matching API keys. `application/json object[]`

`id` `string` Obligatorio

`name` `string` Obligatorio

`keyPrefix` `string` Obligatorio

`last4` `string` Obligatorio

`scopes` `string[]` Obligatorio

`teamId` `string` Obligatorio acepta null

`createdAt` `string` Obligatorio format: date-time

`lastUsedAt` `string` Obligatorio acepta null format: date-time

`expiresAt` `string` Obligatorio acepta null format: date-time

Ejemplo

```
[
  {
    "id" :  "string" ,
    "name" :  "string" ,
    "keyPrefix" :  "string" ,
    "last4" :  "string" ,
    "scopes" :  [
      "string"
    ] ,
    "teamId" :  "string" ,
    "createdAt" :  "2026-01-01T00:00:00.000Z" ,
    "lastUsedAt" :  "2026-01-01T00:00:00.000Z" ,
    "expiresAt" :  "2026-01-01T00:00:00.000Z"
  }
]
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

POST `/api/v1/api-keys`

### Create an API key

Creates an API key for the caller, or for a team when \`teamId\` is given. The scopes requested must be a subset of the calling credential's own scopes. A key created with a \`teamId\` cannot hold a scope this API marks account-only; the refusal names the rejected scopes, so ask for a personal key instead when you need those. The \`secret\` in the response is returned exactly once and is not recoverable afterwards. Account-level: a team-scoped API key is refused with 403.

[Permiso `api-keys:write`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Create and revoke API keys on your account.") [Herramienta MCP `createApiKey`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `createApiKey`

#### Cuerpo de la petición

`application/json`

`name` `string` Obligatorio minLength 1 maxLength 100

`scopes` `string[]` Obligatorio minItems 1 maxItems 10

enum: profile:read profile:write teams:read teams:write members:read members:write invites:write billing:read api-keys:read api-keys:write

`teamId` `string` Opcional minLength 1 maxLength 255

`expiresInDays` `integer` Opcional minimum 1 maximum 365

#### Petición

curl

```
curl -X POST "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/api-keys" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string",
  "scopes": [
    "profile:read"
  ],
  "teamId": "string",
  "expiresInDays": 1
}'
```

#### Respuesta

201 The created key and its one-time secret. `application/json object`

`key` `object` Obligatorio

`key.id` `string` Obligatorio

`key.name` `string` Obligatorio

`key.keyPrefix` `string` Obligatorio

`key.last4` `string` Obligatorio

`key.scopes` `string[]` Obligatorio

`key.teamId` `string` Obligatorio acepta null

`key.createdAt` `string` Obligatorio format: date-time

`key.lastUsedAt` `string` Obligatorio acepta null format: date-time

`key.expiresAt` `string` Obligatorio acepta null format: date-time

`secret` `string` Obligatorio

Ejemplo

```
{
  "key" :  {
    "id" :  "string" ,
    "name" :  "string" ,
    "keyPrefix" :  "string" ,
    "last4" :  "string" ,
    "scopes" :  [
      "string"
    ] ,
    "teamId" :  "string" ,
    "createdAt" :  "2026-01-01T00:00:00.000Z" ,
    "lastUsedAt" :  "2026-01-01T00:00:00.000Z" ,
    "expiresAt" :  "2026-01-01T00:00:00.000Z"
  } ,
  "secret" :  "string"
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

PATCH `/api/v1/api-keys/{keyId}`

### Update an API key's scopes

Replaces the scopes granted to an API key; the list is not merged with the key's current scopes, so send the full set you want it to end up with. The new scopes must be a subset of the calling credential's own scopes. The change takes effect immediately, including for the key making the call. Keys belonging to another account, and revoked keys, answer 404 so key ids cannot be probed. Account-level: a team-scoped API key is refused with 403.

[Permiso `api-keys:write`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Create and revoke API keys on your account.") [Herramienta MCP `updateApiKey`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `updateApiKey`

#### Parámetros

`keyId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Cuerpo de la petición

`application/json`

`scopes` `string[]` Obligatorio minItems 1 maxItems 10

enum: profile:read profile:write teams:read teams:write members:read members:write invites:write billing:read api-keys:read api-keys:write

#### Petición

curl

```
curl -X PATCH "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/api-keys/{keyId}" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "scopes": [
    "profile:read"
  ]
}'
```

#### Respuesta

200 The updated key. `application/json object`

`id` `string` Obligatorio

`name` `string` Obligatorio

`keyPrefix` `string` Obligatorio

`last4` `string` Obligatorio

`scopes` `string[]` Obligatorio

`teamId` `string` Obligatorio acepta null

`createdAt` `string` Obligatorio format: date-time

`lastUsedAt` `string` Obligatorio acepta null format: date-time

`expiresAt` `string` Obligatorio acepta null format: date-time

Ejemplo

```
{
  "id" :  "string" ,
  "name" :  "string" ,
  "keyPrefix" :  "string" ,
  "last4" :  "string" ,
  "scopes" :  [
    "string"
  ] ,
  "teamId" :  "string" ,
  "createdAt" :  "2026-01-01T00:00:00.000Z" ,
  "lastUsedAt" :  "2026-01-01T00:00:00.000Z" ,
  "expiresAt" :  "2026-01-01T00:00:00.000Z"
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

DELETE `/api/v1/api-keys/{keyId}`

### Revoke an API key

Revokes an API key immediately, including the key making the call. Keys belonging to another account answer 404 so key ids cannot be probed. Account-level: a team-scoped API key is refused with 403.

[Permiso `api-keys:write`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/authentication.md "Create and revoke API keys on your account.") [Herramienta MCP `revokeApiKey`](https://nextjs-saas-template.lubomirgeorgiev.com/es/docs/mcp.md) Operación `revokeApiKey`

#### Parámetros

`keyId` `string` Obligatorio in: path minLength 1 maxLength 255

#### Petición

curl

```
curl -X DELETE "https://nextjs-saas-template.lubomirgeorgiev.com/api/v1/api-keys/{keyId}" \
  -H "Authorization: Bearer $API_KEY"
```

#### Respuesta

200 The key was revoked. `application/json object`

`success` `boolean` Obligatorio const: true

Ejemplo

```
{
  "success" :  true
}
```

Respuestas de error

- 400

  The request body, query, or path failed validation.

- 401

  The credential is missing, malformed, expired, or revoked.

- 403

  The credential lacks the required scope or the caller lacks the team permission.

- 404

  The addressed resource does not exist or is not visible to this credential.

- 429

  Rate limit exceeded; retry after the number of seconds in \`retry-after\`. The \`RateLimit-\*\` headers describe the exhausted bucket.

Ningún endpoint coincide con ese filtro.