Teams & Roles

Invite teammates, assign scoped roles, and require multiple approvals on sensitive actions — all backed by a real maker-checker workflow, not just a permissions label.

Roles & scopes

GET /team/roles/scopes lists every permission scope available to attach to a custom role — payments, payouts, refunds, cards, and settings each have their own read/write scopes.

Invitations

curl-X POST https://api.binkpay.net/team/invitations \
 -H "Authorization: Bearer sk_test_..." \
 -d '{ "email": "finance@yourcompany.com", "roleId": "role_finance_ops" }'

The invitee receives a token-based link (GET /team/invitations/token/:token) to accept or reject — no password is exchanged over the API.

Approvals (maker-checker)

Sensitive actions — like issuing a card above a threshold — can be routed through an approval policy requiring one or more teammates to vote before the action executes. See the Approvals admin guide for the full workflow.

Audit trail

Every role change, invitation, and approval decision is logged here. GET /team/audit/export produces a downloadable export for compliance review.