> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qodo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up the User management API

> Enable the User management API, create an API key, and send your first authenticated request.

<Badge color="deployment" size="sm" shape="pill">Single-tenant</Badge>
<Badge color="outline-purple" size="sm" shape="pill">Research Preview</Badge>

The User management API lets organization owners list, invite, update, and remove organization members programmatically. Requests are scoped to the organization and workspace associated with the API key owner.

## Prerequisites

Before you begin, make sure you have:

* An eligible Qodo single-tenant organization.
* User management API access enabled for your organization. Contact [Qodo Support](/qodo-support) to confirm access.
* The organization owner role. For more information, see [Roles and permissions](/account-management/roles-and-permissions).
* Your Qodo tenant subdomain. Qodo provides this value when API access is enabled.

<Note>
  The `v1` segment in `/platform/v1` identifies the API contract version. It is independent of the Qodo product documentation version.
</Note>

## Quickstart

### Create an API key

The API uses a personal `sk-` API key that belongs to an organization owner.

<Steps>
  <Step>
    Log in to the Qodo portal as an organization owner.
  </Step>

  <Step>
    Navigate to your Account settings in the bottom-left corner.
  </Step>

  <Step>
    Click **Create API Key**.
  </Step>

  <Step>
    Enter a descriptive name and select an expiration period. Use an expiring key when your integration supports rotation.
  </Step>

  <Step>
    Click **Create**, copy the key, and store it in your organization's secret manager. Qodo does not display the complete key again.
  </Step>
</Steps>

For more information, see [API key management](/account-management/manage-api-keys).

### Configure your API client

Use your single-tenant Platform host as the API base URL:

```text theme={null}
https://qodo-platform.<tenant>.st.qodo.ai
```

All API requests use this base URL.

Authenticate requests by sending your API key in the `Authorization` header:

```http theme={null}
Authorization: Bearer <sk-api-key>
```

<Note>Do not commit the key to source control or include it in logs. Load it from a secret manager or another protected runtime configuration.</Note>

### Send your first request

List the members in your organization:

```bash theme={null}
curl --request GET \
  --url "https://qodo-platform.<tenant>.st.qodo.ai/platform/v1/admin/users?page=1&page_size=50" \
  --header "Authorization: Bearer <sk-api-key>"
```

A successful request returns a paginated response:

```json theme={null}
{
  "items": [],
  "total": 0,
  "page": 1,
  "size": 50,
  "pages": 0
}
```

Replace the placeholders before sending the request. Never paste a real API key into a shared script, ticket, or documentation page.

## Use the API playground

1. In the documentation navigation, open Account management > API.
2. Select an endpoint and click **Try it**.
3. Replace `your-tenant` with your tenant subdomain.
4. Enter your API key in the **Bearer** field.
5. Review the target host, then click **Send**.

<Warning>
  Treat values entered in the playground as secrets. Verify the tenant host before sending a request, and do not forward a key automatically to a host returned in an error response.
</Warning>

## Troubleshoot authentication and access

| Status | Cause                                                                     | Resolution                                                                                                                 |
| ------ | ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `401`  | The credential or authenticated identity is invalid.                      | Create a new key and verify that the complete value was copied.                                                            |
| `403`  | The key owner is not an organization owner, or API access is not enabled. | Use an organization owner's key and confirm API access with Qodo Support.                                                  |
| `409`  | The single-tenant identity flow returned another Qodo host.               | Verify `detail.redirectTo` and confirm the expected tenant host before retrying. Do not forward credentials automatically. |
| `501`  | The deployment does not support the User management API.                  | Use an eligible single-tenant deployment.                                                                                  |
| `503`  | API access or authorization could not be verified.                        | Retry later. Contact Qodo Support if the error continues.                                                                  |

## Removal and offboarding limitations

Removing a member does not currently revoke that member's personal API keys. Do not use the remove-member endpoint as the only step in an automated offboarding workflow until Qodo confirms that API-key revocation is enabled for your deployment.

In an organization that allows domain-based sign-up, a removed user can join again at the next sign-in. Configure [invite-only access](/account-management/invite-only-access) when membership must require an invitation.

## Next steps

* [List organization members](/api-reference/user-management/list-organization-members): Send your first authenticated User management API request.
* [API key management](/account-management/manage-api-keys): Rotate or revoke personal API keys.
* [Roles and permissions](/account-management/roles-and-permissions): Review organization and team roles.