Team access & resource scopes

Two surfaces — pick the one matching the token you have:

• Partner API (pk_) — new since 2026-05-28. Manage your own team (you are the channel owner). Members + tasks. See Partner API endpoints below.
• Session-auth — dashboard / OAuth user token. Full surface (invitations with email tokens, chat, delegated workspaces, granular scope rules). See /api/teams below.

Partner API (pk_-authenticated, your own team)

Owner-scoped to the API key holder — channel id is implicit (= the key owner). On first read the team row is auto-created.

# Read your team
curl -s -H "Authorization: Bearer pk_YOUR_KEY_HERE" https://api.dcast.pro/api/v1/team
# → 200 { data: { id, channelId, name, memberCount, ... } }

# Rename
curl -s -X PATCH -H "Authorization: Bearer pk_YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{"name":"My Production Crew"}' https://api.dcast.pro/api/v1/team

# Invite an existing DCAST user by email — invitee MUST exist on the platform
# (Partner API blocks cold-email invites; use session-auth /api/teams/:id/invite
# for token-based invites to non-users).
curl -s -X POST -H "Authorization: Bearer pk_YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "email":"[email protected]",
    "role":"CONTENT_MANAGER",
    "permissions":{
      "canManageContent":true,
      "canViewAnalytics":true
    }
  }' https://api.dcast.pro/api/v1/team/members
# → 201 | 404 INVITEE_NOT_FOUND | 409 ALREADY_MEMBER | 409 CANNOT_INVITE_SELF

Adding, changing and removing members needs an owner-class credential: a key with finance:write (a FULL_ACCESS key without a narrowing permission list has it) or the account owner's X-User-Token; otherwise 403 TEAM_OWNER_REQUIRED.

Allowed roles via Partner API: CONTENT_MANAGER, STREAM_TECHNICIAN, MODERATOR, VIEWER. OWNER is singleton (you) and ADMIN is intentionally not assignable via Partner API per our no-admin canon — use session-auth + the staff tool for those.

Session-auth (/api/teams — dashboard token)

The full surface below is exposed under /api/teams on the same API host as the Partner surface. Authentication is different from Partner API v1: use a user session access token (OAuth / dashboard sign-in), not the Partner API key used for https://api.dcast.pro/api/v1.

Base path

https://api.dcast.pro/api/teams/:channelId/...

channelId is the channel owner identifier (the same id used in dashboard URLs).

Auth headers

Authorization: Bearer {user_access_token}

For browser and server calls that act on behalf of another channel (delegated workspace — team member managing an owner's channel), send the owner's channel id:

X-Effective-Channel-Id: {channel_owner_id}

Same header is used across dashboard session APIs (streams, videos, creator stats where allowed, etc.). CORS on the API allows this header. When you call /api/teams/:channelId/..., the channelId in the path must match the channel you are accessing (usually the owner's id). The JWT is always the signed-in user; the header selects which channel context applies when the user is a team member.

Delegated workspace (memberships)

List channels where the current user is an ACTIVE team member (for workspace switcher and automation):

GET https://api.dcast.pro/api/teams/memberships/mine
Authorization: Bearer {user_access_token}

Pending invitations: GET /api/teams/invitations/mine, accept/decline via POST /api/teams/invitations/mine/:memberId/accept and .../decline.

Team chat (channel-scoped)

One message thread per channel team. Only ACTIVE team members (or the channel owner) can read and post. Messages are stored server-side; real-time updates are delivered to the dashboard via WebSocket on the channel-scoped room team:chat:{channelId}.

Dashboard UI: opening Team Chat as a delegated user uses the same channelId as the owner. Deep link /dashboard/team/chat?channel={ownerId} selects the workspace when the user has a membership for that channel. Acceptance notifications for invites point to this chat URL.

Team tasks

Kanban-style tasks for the channel team: GET/POST https://api.dcast.pro/api/teams/:channelId/tasks, PUT/DELETE .../tasks/:taskId, assign and status transitions under .../assign and .../status. Same auth and channelId rules as chat.

Resource scope model

Each member can have per-domain mode and optional allowlists. When mode is UNRESTRICTED, role permissions apply to all content of that type on the channel. When mode is ALLOWLIST, access is limited to listed resources.

Member object (response)

Members returned by the API include the fields above plus role, status, permission flags, and nested user.

Endpoints

Invite with scopes (example)

POST https://api.dcast.pro/api/teams/{channelId}/invite
Authorization: Bearer {user_access_token}
Content-Type: application/json

{
  "email": "[email protected]",
  "role": "STREAM_TECHNICIAN",
  "customMessage": "Optional",
  "videoScopeMode": "UNRESTRICTED",
  "streamScopeMode": "ALLOWLIST",
  "roomScopeMode": "UNRESTRICTED",
  "restreamScopeMode": "ALLOWLIST",
  "resourceGrants": [
    { "domain": "STREAM", "resourceId": "stream_cuid_1" },
    { "domain": "RESTREAM", "resourceId": "restream_cuid_2" }
  ]
}

Update member scopes (example)

PUT https://api.dcast.pro/api/teams/{channelId}/members/{memberId}
Authorization: Bearer {user_access_token}
Content-Type: application/json

{
  "streamScopeMode": "ALLOWLIST",
  "resourceGrants": [
    { "domain": "STREAM", "resourceId": "stream_cuid_1" }
  ]
}

Related

• Partner API v1 (API key): Quickstart, Streams, Restreams, Rooms.
• Authentication — obtain user tokens for dashboard-integrated tools.