Company

Manage the company the poweruser key belongs to: rename it or transfer ownership, list members and their permissions, invite and remove team members, and read a full snapshot of usage against every company limit.

All paths on this page are relative to https://api.autessa.com/autessa_poweruser/company. Every request is a POST with a JSON body, and every ID is an opaque string. See the Poweruser API overview for authentication and conventions.

The key acts as its linked user: team-changing endpoints (/update, /user/invite, /user/remove) require the linked user to hold the MANAGE_TEAM_MEMBERS permission; read endpoints work for any member.

Two things are deliberately not exposed on the poweruser surface:

Billing management — payment methods, invoices, and commitment changes are UI-only. The read-only /usage-status endpoint still reports billing state.
Invite acceptance — processing and accepting an invitation belongs to the invited user's own browser session, not to an API key acting for an existing member. /user/invite sends the invitation email; the invitee finishes in the UI.

Two safety guards apply only to poweruser keys (the in-app UI does not need them):

/user/remove refuses to remove the key's own linked user — a key cannot orphan itself from the company.
/user/invite refuses roles whose permissions are not a subset of the inviting user's own permissions — a key cannot escalate privileges by inviting someone more powerful than its linked user.

Permissions

Members' access is expressed as permissions, granted through roles. The permission values that appear in /members and /role/all responses:

Permission	Grants
`MANAGE_TEAM_MEMBERS`	Invite/remove members, update the company.
`AGENTIC_WORKFLOW`	Build and run agents, managers, and tools.
`BILLING`	Manage billing (UI-only surface).
`AUTESSADB`	Create and manage AutessaDB tables.
`API_KEY`	Create and manage API keys.
`SCHEDULED_EVENTS`	Create and manage scheduled events.
`APP_VIEWER`	View shared custom apps.
`APP_BUILDER`	Create custom apps (implies `APP_VIEWER`).
`E_SIGNATURE`	Upload, prepare, send, and manage PDF signing envelopes.
`MEETING_RECORDER`	Create and manage meeting-recorder bots.

Update the company

POST/company/update

Renames the company and/or transfers its ownership. Requires MANAGE_TEAM_MEMBERS.

Ownership transfer (newOwnerId) has extra rules: only the current owner may transfer, personal companies cannot be transferred, and the transfer is validated against the new owner's permissions and their owned-companies limit.

Request parameters

Name
newCompanyName
Type
string
Description
New display name for the company.
Name
newOwnerId
Type
string
Description
User to transfer ownership to. Must be a member of the company.

Response

Name
company
Type
Company
Description
The updated company: id (string), name, isPersonal, isOwner (whether the linked user owns it), and companyMetadata (tier limits and display settings, including companyLimit).
Name
errors
Type
array<string>
Description
Error messages, if any occurred.

cURL
JavaScript
Python

curl https://api.autessa.com/autessa_poweruser/company/update \
  -X POST \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "newCompanyName": "Acme Corp" }'

const response = await fetch(
  'https://api.autessa.com/autessa_poweruser/company/update',
  {
    method: 'POST',
    headers: {
      'Authorization': process.env.POWERUSER_KEY,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({ newCompanyName: 'Acme Corp' })
  }
);

const { company } = await response.json();

import os
import requests

response = requests.post(
    'https://api.autessa.com/autessa_poweruser/company/update',
    headers={'Authorization': os.environ['POWERUSER_KEY']},
    json={'newCompanyName': 'Acme Corp'}
)

company = response.json()['company']

Response (truncated)
{
  "company": {
    "id": "cP2mK7dX4v",
    "name": "Acme Corp",
    "isPersonal": false,
    "isOwner": true,
    "companyMetadata": {
      "companyLimit": { "sharedUserLimit": 25 }
    }
  },
  "errors": []
}

List members

POST/company/members

Lists every member of the company with their effective permissions.

Request parameters

None — send an empty object {}.

Response

Name
members
Type
array<Member>
Description
One entry per member.
Name
members[].user
Type
User
Description
The member: userId (string), email, name, isConfirmed (whether the account is confirmed), and userMetadata (per-user preference settings).
Name
members[].permissions
Type
array<Permission>
Description
The member's permissions in this company. Each entry has permission (a value from the permissions table) and id (string).
Name
errors
Type
array<string>
Description
Error messages, if any occurred.

cURL
curl https://api.autessa.com/autessa_poweruser/company/members \
  -X POST \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Response (truncated)
{
  "members": [
    {
      "user": {
        "userId": "uB7nT2wQ9k",
        "email": "sam@acme.com",
        "name": "Sam Rivera",
        "isConfirmed": true
      },
      "permissions": [
        { "permission": "MANAGE_TEAM_MEMBERS", "id": "pJ8rD3sF6m" },
        { "permission": "AGENTIC_WORKFLOW", "id": "pQ4tH9vB2n" }
      ]
    }
  ],
  "errors": []
}

List roles

POST/company/role/all

Lists the roles available in the company — built-in and custom — with the permissions each grants. Use the returned id values in /user/invite.

Request parameters

None — send an empty object {}.

Response

Name
roles
Type
array<Role>
Description
Available roles. Each has id (string), name, description, isBuiltIn (whether it is a platform-provided role), and associatedPermissions — an array of { permission, id } entries the role grants (see the permissions table).
Name
errors
Type
array<string>
Description
Error messages, if any occurred.

cURL
curl https://api.autessa.com/autessa_poweruser/company/role/all \
  -X POST \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Response (truncated)
{
  "roles": [
    {
      "id": "rK5pW8nQ2d",
      "name": "Builder",
      "description": "Builds agents and tables.",
      "isBuiltIn": true,
      "associatedPermissions": [
        { "permission": "AGENTIC_WORKFLOW", "id": "pQ4tH9vB2n" },
        { "permission": "AUTESSADB", "id": "pL7xC2kM5w" }
      ]
    }
  ],
  "errors": []
}

Invite a user

POST/company/user/invite

Sends an invitation email to join the company with the given roles. The invitee accepts in the Autessa UI — there is no poweruser endpoint for accepting invitations. Requires MANAGE_TEAM_MEMBERS.

Rules enforced:

Privilege-escalation guard (poweruser-only): every requested role's permissions must be a subset of the linked user's own permissions. A role that grants anything the inviter doesn't hold is rejected with a 422 and a message like "Cannot invite a user with role 'Builder': it grants permissions the inviting user does not have."
Unknown role IDs are ignored; at least one valid role must remain or the request fails with "No valid roles provided for user".
The company must be below its member limit (companyLimit.sharedUserLimit).

Request parameters

Name
email
Type
string
Description
Email address to invite.
Name
roleIds
Type
array<string>
Description
Roles the invitee receives on joining, from /role/all.

Response

Name
errors
Type
array<string>
Description
Error messages, if any occurred. Empty on success — the invitation email has been sent.

cURL
JavaScript
Python

curl https://api.autessa.com/autessa_poweruser/company/user/invite \
  -X POST \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "new.hire@acme.com",
    "roleIds": ["rK5pW8nQ2d"]
  }'

const response = await fetch(
  'https://api.autessa.com/autessa_poweruser/company/user/invite',
  {
    method: 'POST',
    headers: {
      'Authorization': process.env.POWERUSER_KEY,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      email: 'new.hire@acme.com',
      roleIds: ['rK5pW8nQ2d']
    })
  }
);

const { errors } = await response.json();

import os
import requests

response = requests.post(
    'https://api.autessa.com/autessa_poweruser/company/user/invite',
    headers={'Authorization': os.environ['POWERUSER_KEY']},
    json={
        'email': 'new.hire@acme.com',
        'roleIds': ['rK5pW8nQ2d']
    }
)

Response
{
  "errors": []
}

Remove a user

POST/company/user/remove

Removes a member from the company. Requires MANAGE_TEAM_MEMBERS.

Rules enforced:

Self-removal guard (poweruser-only): the key can never remove its own linked user — the request is rejected with a 422 and the message "A poweruser key cannot remove its own linked user."
The company owner cannot be removed; transfer ownership first with /update.

Request parameters

Name
userId
Type
string
Description
The member to remove.

Response

Name
errors
Type
array<string>
Description
Error messages, if any occurred.

cURL
curl https://api.autessa.com/autessa_poweruser/company/user/remove \
  -X POST \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "userId": "uB7nT2wQ9k" }'

Response
{
  "errors": []
}

Get usage status

POST/company/usage-status

Returns a read-only snapshot of the company's usage against every limit — the same data behind the Builder's usage dashboard. Each section pairs current usage with its limit and remaining headroom.

Request parameters

None — send an empty object {}.

Response

Name
entityUsage
Type
object
Description
Entity creation counts vs. limits. For each of tools, agents, managers, custom apps, and tables: used, limit, and remaining counters (for example agentsUsed, agentsLimit, agentsRemaining; likewise toolsUsed, managersUsed, customAppsUsed, tablesUsed, and so on).
Name
executionUsage
Type
object
Description
Execution rate limits for agents, tools, and managers. For each: executions this minute and this month with the matching limit and remaining counts (agentExecutionsThisMinute, agentLimitPerMinute, agentRemainingPerMinute, agentExecutionsThisMonth, agentLimitPerMonth, agentRemainingPerMonth, and the same six for tool and manager).
Name
llmCreditUsage
Type
object
Description
LLM credit consumption: dailyCreditsUsed/Remaining/dailyCreditLimit, the same trio for weekly and monthly windows, plus inputTokenWeight and outputTokenWeight (how tokens convert to credits) and enabled.
Name
phoneCallUsage
Type
object
Description
Phone usage: currentPhoneNumbers, maxPhoneNumbers, usedMinutesThisMonth, remainingMinutesThisMonth, maxMinutesPerMonth.
Name
storageUsage
Type
object
Description
AutessaDB storage: currentUnits, maxUnits, remainingUnits, usagePercentage, and the per-column-type unit costs (regularColumnCost, vectorizableColumnCost, fileColumnCost, autocomputedColumnCost).
Name
semanticSearchUsage
Type
object
Description
Semantic search requests: used/limit/remaining for the current minute (requestsThisMinute, limitPerMinute, remainingThisMinute), day, and month.
Name
browserUsage
Type
object
Description
Browser service usage on a rolling 30-day window: used/limit/remaining for search (searchUsedThisMonth, searchLimitPerMonth, searchRemaining), non-JS scrapes, and JS scrapes, plus the shared per-minute rate (requestsThisMinute, requestsLimitPerMinute, requestsRemainingPerMinute).
Name
vibecodeUsage
Type
object
Description
Vibecode credits: dailyCreditsUsed/Remaining/dailyCreditLimit, the same trio for the weekly window, inputTokenWeight, outputTokenWeight, and enabled.
Name
aiTaskUsage
Type
object
Description
AI-task metering and billing for the current period. All money fields are in cents. Task counts: currentMonthTasks, billableTasks, overageTasks, voiceTaskCount, evaledTaskCount, ragInvocationCount, voiceSeconds, freeSandboxRemaining. Rates and plan: currencyCode, perTaskBaseCents, monthlyCommitmentCents (null = pay-as-you-go), commitCreditCents, pendingCommitmentCents, voicePerMinuteCents, ragSurchargeCents, accruedCostCents, projectedMonthlyCostCents, prepaidBalanceCents, invoiceable. Budget controls: userHardBudgetCents, userHardTaskCap, userSoftWarnPercents, userSoftBudgetCents, budgetWarningLevel, hardLimitReached. Payment state: paymentState, hasCardOnFile, cardBrand, cardLast4, pastDueSinceIso.
Name
errors
Type
array<string>
Description
Error messages, if any occurred.

cURL
curl https://api.autessa.com/autessa_poweruser/company/usage-status \
  -X POST \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Response (truncated)
{
  "entityUsage": {
    "toolsUsed": 12,
    "toolsLimit": 50,
    "toolsRemaining": 38,
    "agentsUsed": 6,
    "agentsLimit": 25,
    "agentsRemaining": 19
  },
  "executionUsage": {
    "agentExecutionsThisMinute": 3,
    "agentLimitPerMinute": 60,
    "agentRemainingPerMinute": 57,
    "agentExecutionsThisMonth": 4210,
    "agentLimitPerMonth": 100000,
    "agentRemainingPerMonth": 95790
  },
  "llmCreditUsage": {
    "dailyCreditsUsed": 182000,
    "dailyCreditsRemaining": 818000,
    "dailyCreditLimit": 1000000,
    "inputTokenWeight": 1.0,
    "outputTokenWeight": 4.0,
    "enabled": true
  },
  "phoneCallUsage": {
    "currentPhoneNumbers": 2,
    "maxPhoneNumbers": 5,
    "usedMinutesThisMonth": 340.5,
    "remainingMinutesThisMonth": 659.5,
    "maxMinutesPerMonth": 1000
  },
  "storageUsage": {
    "currentUnits": 1840,
    "maxUnits": 10000,
    "remainingUnits": 8160,
    "usagePercentage": 18.4
  },
  "semanticSearchUsage": {
    "requestsThisMinute": 1,
    "limitPerMinute": 30,
    "remainingThisMinute": 29
  },
  "browserUsage": {
    "searchUsedThisMonth": 220,
    "searchLimitPerMonth": 2000,
    "searchRemaining": 1780
  },
  "vibecodeUsage": {
    "dailyCreditsUsed": 52000,
    "dailyCreditsRemaining": 448000,
    "dailyCreditLimit": 500000,
    "enabled": true
  },
  "aiTaskUsage": {
    "currentMonthTasks": 4180,
    "billableTasks": 4100,
    "accruedCostCents": 287000,
    "currencyCode": "usd",
    "perTaskBaseCents": 70,
    "monthlyCommitmentCents": 100000,
    "commitCreditCents": 41300,
    "projectedMonthlyCostCents": 430500,
    "paymentState": "OK",
    "hasCardOnFile": true,
    "cardBrand": "visa",
    "cardLast4": "4242",
    "hardLimitReached": false
  },
  "errors": []
}

Errors

Status	When
`200`	Success — check `errors` for any messages.
`401`	Invalid or missing poweruser key.
`403`	Scoped key without the endpoint in its allow-list.
`422`	A guard or validation rejected the request: linked user lacks `MANAGE_TEAM_MEMBERS`, removing the key's own linked user or the company owner, a role exceeding the inviter's permissions, no valid roles, member limit reached, or an invalid ownership transfer. `errors` explains which.
`408`	Server-side error; `errors` contains the message.

Permissions​

Update the company​

Request parameters​

Response​

List members​

Request parameters​

Response​

List roles​

Request parameters​

Response​

Invite a user​

Request parameters​

Response​

Remove a user​

Request parameters​

Response​

Get usage status​

Request parameters​

Response​

Errors​

Related​

Permissions

Update the company

Request parameters

Response

List members

Request parameters

Response

List roles

Request parameters

Response

Invite a user

Request parameters

Response

Remove a user

Request parameters

Response

Get usage status

Request parameters

Response

Errors

Related