Organization, members & keys

These optional endpoints manage your integration. Your review key does not need administrative permissions. Expand an endpoint for its scope, parameters and examples.

Administrative scopes are members:read, members:write, keys:read and keys:write. Grant only those your integration needs.

GET/organization · Get organization

GET/organization

Key permission: members:read

Read your organization's identity, status and retention settings.

What to send

No request body. Replace any example ID in the URL with your own.

What you get back

Organization object with id, name, slug, status, sourceRetentionHours and resultRetentionDays.

Get organization

curl --fail-with-body -X GET 'https://www.steletta.com/api/v1/organization' \
  -H "Authorization: Bearer $STELETTA_API_KEY"

GET/members · List members

GET/members

Key permission: members:read

List people with access to your organization.

What to send

No request body. Replace any example ID in the URL with your own.

What you get back

An object containing a data array of members.

List members

curl --fail-with-body -X GET 'https://www.steletta.com/api/v1/members' \
  -H "Authorization: Bearer $STELETTA_API_KEY"

POST/members · Invite a member

POST/members

Key permission: members:write

Create an organization invitation. Owner and role protections still apply.

What to send

emailstringRequired: The person's email address.
rolestringRequired: One of admin, developer, reviewer or viewer.

What you get back

The invited member record.

Invite a member

curl --fail-with-body -X POST 'https://www.steletta.com/api/v1/members' \
  -H "Authorization: Bearer $STELETTA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "developer@example.com",
  "role": "developer"
}'

DELETE/members/{memberId} · Revoke a member

DELETE/members/{memberId}

Key permission: members:write

Remove a member's organization access. Replace member_example with the member's ID. The last active owner cannot be removed.

What to send

No request body. Replace any example ID in the URL with your own.

What you get back

The revoked member record. 409 if an owner protection prevents the change.

Revoke a member

curl --fail-with-body -X DELETE 'https://www.steletta.com/api/v1/members/member_example' \
  -H "Authorization: Bearer $STELETTA_API_KEY"

GET/api-keys · List API keys

GET/api-keys

Key permission: keys:read

List key metadata, environments and scopes. Secret tokens are not returned.

What to send

No request body. Replace any example ID in the URL with your own.

What you get back

An object containing a data array of API keys.

List API keys

curl --fail-with-body -X GET 'https://www.steletta.com/api/v1/api-keys' \
  -H "Authorization: Bearer $STELETTA_API_KEY"

POST/api-keys · Create an API key

POST/api-keys

Key permission: keys:write

Create a separate credential for an integration. Store the returned token securely; it is shown only at creation.

What to send

labelstringRequired: A descriptive name, 1–100 characters.
environmentstringRequired: test or live; must match the calling key. Both use your organization's review allowance.
scopesstring[]Optional: Defaults to reviews:read, reviews:write and usage:read. Must be a subset of the calling key's scopes. Add administrative scopes only if needed.

What you get back

API key metadata and a token field containing the secret.

Create an API key

curl --fail-with-body -X POST 'https://www.steletta.com/api/v1/api-keys' \
  -H "Authorization: Bearer $STELETTA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "label": "Catalog integration",
  "environment": "live",
  "scopes": [
    "reviews:read",
    "reviews:write",
    "usage:read"
  ]
}'

POST/api-keys/{apiKeyId}/rotate · Rotate an API key

POST/api-keys/{apiKeyId}/rotate

Key permission: keys:write

Replace key_example with the key's ID. Returns a new secret and immediately revokes the old key. Update your integration before making another request with it.

What to send

No request body. Replace any example ID in the URL with your own.

What you get back

Replacement key metadata and a token field containing the new secret.

Rotate an API key

curl --fail-with-body -X POST 'https://www.steletta.com/api/v1/api-keys/key_example/rotate' \
  -H "Authorization: Bearer $STELETTA_API_KEY"

DELETE/api-keys/{apiKeyId} · Revoke an API key

DELETE/api-keys/{apiKeyId}

Key permission: keys:write

Permanently revoke the key identified by key_example. Requests using that credential will no longer be authorized.

What to send

No request body. Replace any example ID in the URL with your own.

What you get back

Confirmation that the key was revoked. No response body.

Revoke an API key

curl --fail-with-body -X DELETE 'https://www.steletta.com/api/v1/api-keys/key_example' \
  -H "Authorization: Bearer $STELETTA_API_KEY"

GET/health · Check API health

GET/health

No authentication required

Check that the API responds. This request does not create a review or consume review units.

What to send

No request body. Replace any example ID in the URL with your own.

What you get back

A health object. Check productionReady as well as the HTTP status; this endpoint does not test a full review.

Check API health

curl --fail-with-body -X GET 'https://www.steletta.com/api/v1/health'