Team Members

A project is owned by one developer but can have many members. Invite teammates by email, grant each a role, and manage the roster over time. Invites are link-based: creating one returns a URL you send to your teammate, who accepts it while signed in to their own Amba account.

Membership routes mount under /v1/admin/projects/:projectId/* and require developer credentials (a PAT or console session) — these are person-identity actions, so server keys are rejected.

Roles

The owner is synthesized into member listings from the project record — you don't manage an explicit owner row.

Invite a teammate

POST .../invites mints an invite and returns the URL to forward. Owners and admins can invite; the default role is member, and invites expire after 7 days (max 30).

curl -X POST 'https://api.amba.dev/v1/admin/projects/$PROJECT_ID/invites' \
  -H 'Authorization: Bearer $AMBA_PAT' \
  -H 'Content-Type: application/json' \
  -d '{ "email": "teammate@example.com", "role": "member", "expires_in_days": 7 }'

{
  "data": {
    "id": "inv_…",
    "email": "teammate@example.com",
    "role": "member",
    "expires_at": "2026-06-03T10:00:00.000Z",
    "invite_url": "https://app.amba.dev/invites/accept?token=…"
  }
}

The invite_url is shown once — the raw token isn't stored. If it's lost, revoke the invite and send a new one. Re-inviting the same email while an open invite exists returns the existing invite with idempotent: true and a null invite_url.

Accept or decline

The recipient accepts (or declines) with the raw token from the invite URL, signed in as themselves. The email on the invite must match their account email.

curl -X POST 'https://api.amba.dev/v1/admin/invites/accept' \
  -H 'Authorization: Bearer $TEAMMATE_PAT' \
  -H 'Content-Type: application/json' \
  -d '{ "token": "…" }'

{ "data": { "project_id": "…", "role": "member", "joined_at": "2026-05-27T10:05:00.000Z" } }

Accept fails with 403 EMAIL_MISMATCH if the invite was sent to a different address, 410 INVITE_EXPIRED if it lapsed, or 409 ALREADY_ACCEPTED if it's already claimed. POST /v1/admin/invites/decline takes the same { token } body and quietly expires the invite.

List & remove members

# List members (owner + accepted invitees)
curl 'https://api.amba.dev/v1/admin/projects/$PROJECT_ID/members' \
  -H 'Authorization: Bearer $AMBA_PAT'

{
  "data": [
    { "developer_id": "dev_owner", "email": "you@example.com", "role": "owner", "joined_at": "…" },
    {
      "developer_id": "dev_mate",
      "email": "teammate@example.com",
      "role": "member",
      "joined_at": "…"
    }
  ]
}

PATCH .../members/:developerId with { role } changes a member's role (owner only). DELETE .../members/:developerId removes a member — the owner can remove anyone (except themselves), admins can remove members/viewers, and any member can remove themselves (leave the project).

Endpoints

MCP tools

Free-tier note: accepting an invite to a free-tier project counts toward the accepting developer's free-project limit.