Fac-360
Organizations

Remove a member

DELETE
/console/v1/organizations/{organizationId}/members/{userId}

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

organizationId*string
Formatuuid
userId*string
Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/console/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/members/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Authorization: Bearer apf_v2_tu_credencial"
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9",  "userId": "2c4a230c-5085-4924-a3e1-25fb4fc5965b",  "memberRole": "OWNER",  "revokedSessions": 0}

Change a member's role PATCH PATCH

OWNER only, and the last OWNER can be neither demoted nor removed. The affected member's sessions are revoked -- theirs alone, since a role change concerns one person and logging the whole team out would turn administration into an outage.

Register a company under this organization POST POST

ADMIN and above, which is ADR 0016 point 7's assignment of companies rather than this route's opinion. Nothing here proves the caller controls the RUC and nothing needs to: the claim confers nothing until a certificate this platform signed with has been accepted by SUNAT, which is proof of control checked by the party that can perform it. What the alta does guarantee is attribution -- it writes an ops.audit_events row naming the person, in the same transaction as the company -- so a squatted RUC is an operator action with evidence rather than an argument between two customers. Every refusal about WHO the caller is answers 409 MEMBERSHIP_CHANGE_REFUSED indistinguishably; only a RUC already registered answers something specific, and it says nothing about whose it is.