# Administration

> Company settings, people, API keys, email, runs and suggestions.

MCP toolset: `admin` (https://app.getoatmilk.com/api/mcp?toolset=admin)

## accountant.access

- [`accountant.access.get`](https://app.getoatmilk.com/docs/api/accountant.access.get.md) — Accountants only: read your access to this organization, its end date and days left, your permissions and your requests.

## accountant.changes

- [`accountant.changes.list`](https://app.getoatmilk.com/docs/api/accountant.changes.list.md) — Accountants only: read the changes you asked the company to make and what was decided, newest first. Who decided is not shown.

- [`accountant.changes.request`](https://app.getoatmilk.com/docs/api/accountant.changes.request.md) — Accountants with corrections access only: ask the company to attach an existing receipt to a bank record (attach_receipt with entryId and receiptEntryId), match a receipt to a same-currency bank payment (settle_match with entryId and transactionId), or check which contractor a payment belongs to (contractor_attribution with contractorId and transactionId), with a reason and idempotency key. Nothing changes until a company administrator approves it; payouts, agreements and settings are never offered.

## accountant.comments

- [`accountant.comments.create`](https://app.getoatmilk.com/docs/api/accountant.comments.create.md) — Accountants with comment access only: ask a question on one transaction (entry) or receipt with targetType, targetId, body and an idempotency key. The company is emailed a short grouped summary.

- [`accountant.comments.list`](https://app.getoatmilk.com/docs/api/accountant.comments.list.md) — Accountants with comment access only: read the questions and replies on one record (targetType and targetId), or the most recent ones on any record.

## accountant.requests

- [`accountant.requests.create`](https://app.getoatmilk.com/docs/api/accountant.requests.create.md) — Accountants only: ask for an extra permission with scope and reason, or for more time with kind more_time, an optional proposedUntil date and reason. Requires an idempotency key.

## accountant.slips

- [`accountant.slips.readiness`](https://app.getoatmilk.com/docs/api/accountant.slips.readiness.md) — Accountants only: contractor reporting readiness for one calendarYear, selected by the company's formation country. Canadian organizations show the indicated T4A/T4A-NR checklist; U.S. organizations show a review checklist and do not infer 1099 applicability from payment totals. The response includes fees, masked Canadian and U.S. taxpayer numbers, self-reported W-9/W-8 selection and missing company follow-up. Mailing addresses and full numbers are never included.

## accountant.tax

- [`accountant.tax.request`](https://app.getoatmilk.com/docs/api/accountant.tax.request.md) — Accountants only: ask the company to collect or confirm missing tax details for one contractor and calendar year. The request contains missing field names only, never tax number values, and goes to the company question queue.

## accountant.welcome

- [`accountant.welcome.update`](https://app.getoatmilk.com/docs/api/accountant.welcome.update.md) — Accountants only: save where you stopped in the welcome steps (see, first, ask, done), and whether you skipped or finished it.

## accountants.access

- [`accountants.access.update`](https://app.getoatmilk.com/docs/api/accountants.access.update.md) — Extend, shorten or clear an accountant's access end date and, optionally, change their access level to read, comment or prepare (exactly that preset, nothing more), with userId, expiresOn (YYYY-MM-DD or null) and/or preset, expectedRevision and idempotencyKey. Extra permissions never outlast the end date. Administrator access is required. MCP calls also require accounting:admin; the web agent asks for approval before changing outside access. Direct API requests cannot perform these access-granting actions.

## accountants

- [`accountants.activity`](https://app.getoatmilk.com/docs/api/accountants.activity.md) — Read an accountant's retained activity timeline (sign-ins, downloads, exports, requests, decisions, end-date changes and removal), newest first. Supply userId and optionally beforeId.

- [`accountants.invite`](https://app.getoatmilk.com/docs/api/accountants.invite.md) — Invite an accountant by email with an access level (preset read, comment or prepare), an access end date (or null for no end date), optional name, firm and message, and an idempotency key. Returns the invitation and a private join link. Administrator access is required. MCP calls also require accounting:admin; the web agent asks for approval before changing outside access. Direct API requests cannot perform these access-granting actions.

- [`accountants.inviteMany`](https://app.getoatmilk.com/docs/api/accountants.inviteMany.md) — Invite up to 10 people from one accounting firm in one go. Each person has their own email, name, access level (preset) and end date; the firm name and message are shared. Returns which invitations were sent and which failed, each with its private join link. Administrator access is required. MCP calls also require accounting:admin; the web agent asks for approval before changing outside access. Direct API requests cannot perform these access-granting actions.

- [`accountants.list`](https://app.getoatmilk.com/docs/api/accountants.list.md) — List active and former accountants with their access, end dates and days left, plus pending invitations and access requests. Invitation links are never included.

- [`accountants.remove`](https://app.getoatmilk.com/docs/api/accountants.remove.md) — Remove an accountant now: ends access, revokes extra permissions and open requests, and removes the organization membership. Their history is kept. Requires userId, expectedRevision and idempotencyKey.

## accountants.comments

- [`accountants.comments.list`](https://app.getoatmilk.com/docs/api/accountants.comments.list.md) — List accountants' questions on transactions and receipts with the replies to each, newest first. Filter by status (active, open, answered, resolved, all) or by one record with targetType and targetId. Contributors never see these.

- [`accountants.comments.reply`](https://app.getoatmilk.com/docs/api/accountants.comments.reply.md) — Reply to an accountant's question with id, body and idempotencyKey. The accountant sees the reply and gets a short email.

- [`accountants.comments.resolve`](https://app.getoatmilk.com/docs/api/accountants.comments.resolve.md) — Mark an accountant's question resolved with id, expectedRevision and idempotencyKey.

## accountants.grants

- [`accountants.grants.revoke`](https://app.getoatmilk.com/docs/api/accountants.grants.revoke.md) — Revoke an extra permission granted to an accountant, with id, expectedRevision and idempotencyKey.

## accountants.invitations

- [`accountants.invitations.link`](https://app.getoatmilk.com/docs/api/accountants.invitations.link.md) — Return the private join link of a pending invitation again so it can be shared in your own message. Audited. Administrator access is required. MCP calls also require accounting:admin; the web agent asks for approval before changing outside access. Direct API requests cannot perform these access-granting actions.

- [`accountants.invitations.preview`](https://app.getoatmilk.com/docs/api/accountants.invitations.preview.md) — Preview the invitation email (subject, HTML and plain text) for an access level, end date, name and message before sending it. Sends nothing and contains no private link.

- [`accountants.invitations.resend`](https://app.getoatmilk.com/docs/api/accountants.invitations.resend.md) — Email a pending accountant invitation again and restart its 14-day link window, with expectedRevision and idempotencyKey. Administrator access is required. MCP calls also require accounting:admin; the web agent asks for approval before changing outside access. Direct API requests cannot perform these access-granting actions.

- [`accountants.invitations.revoke`](https://app.getoatmilk.com/docs/api/accountants.invitations.revoke.md) — Revoke a pending accountant invitation so its link stops working, with expectedRevision and idempotencyKey.

- [`accountants.invitations.update`](https://app.getoatmilk.com/docs/api/accountants.invitations.update.md) — Change a pending or expired accountant invitation: access level, end date, name, firm or message, with id, expectedRevision and idempotencyKey. Correcting the email address cancels the old link and sends a new invitation. Administrator access is required. MCP calls also require accounting:admin; the web agent asks for approval before changing outside access. Direct API requests cannot perform these access-granting actions.

## accountants.requests

- [`accountants.requests.decide`](https://app.getoatmilk.com/docs/api/accountants.requests.decide.md) — Approve or deny an accountant's access or more-time request with id, decision, optional expiresInDays (30, 90 or null), accessExpiresOn for more-time approvals, note, expectedRevision and idempotencyKey. Administrator access is required. MCP calls also require accounting:admin; the web agent asks for approval before changing outside access. Direct API requests cannot perform these access-granting actions.

## api_keys

- [`api_keys.create`](https://app.getoatmilk.com/docs/api/api_keys.create.md) — Create a scoped expiring API key within your current role and credential ceiling. The secret is returned once.

- [`api_keys.list`](https://app.getoatmilk.com/docs/api/api_keys.list.md) — List metadata for your API keys. Secret values are never returned.

- [`api_keys.revoke`](https://app.getoatmilk.com/docs/api/api_keys.revoke.md) — Revoke your API key; administrators may revoke organization keys.

- [`api_keys.rotate`](https://app.getoatmilk.com/docs/api/api_keys.rotate.md) — Replace your API key while preserving scope ceilings and revoking the original.

## company

- [`company.close`](https://app.getoatmilk.com/docs/api/company.close.md) — Permanently close the company: delete its stored files, every record it has in Oatmilk, and the company itself with its memberships. It can't be undone; export the data first with company.export. confirmName must be the company's name (case doesn't matter). Only an administrator, with their own credential (the web app, or the terminal app or an API key), can close it; AI apps and Ask AI can't. The installation's own company can't be closed. Returns the counts of rows and files deleted and whether the company's sign-in organization was deleted.

- [`company.export`](https://app.getoatmilk.com/docs/api/company.export.md) — Export all of the company's data as one ZIP: manifest.json, data/<table>.json with every row the company has in every table, files/<bucket>/<path> with its stored files (receipts, emails, statements, agreements, invoices) and a README. Secret values (encrypted credentials and bank or tax details, sealed keys, one-time codes, private link tokens) are replaced with "[redacted]" and listed in redactedColumns. One download holds at most 50 MB: the records come first and files fill the rest; files that don't fit are listed with included false, and company.export.files gives a link for each. includeFiles false leaves files out (default true). Returns a link valid for 5 minutes, the counts of tables, rows and files, and how many files were skipped. Administrators only.

- [`company.get`](https://app.getoatmilk.com/docs/api/company.get.md) — Read company identity, tax registrations, filing settings and source provenance. GST/HST dates require profile.gstHst.registered, frequency and yearEnd; null means not configured, not a permission failure. warnings identifies conflicting saved corporate fiscal year-ends that need administrator confirmation.

- [`company.update`](https://app.getoatmilk.com/docs/api/company.update.md) — Update company metadata and tax settings with the current revision and an idempotency key. Corporate annual returns remain distinct from tax periods.

## company.export

- [`company.export.files`](https://app.getoatmilk.com/docs/api/company.export.files.md) — List the company's stored files (all but its earlier company exports) with offset and limit (1 to 100, default 50), each with its bucket, path, size and a download link valid for 5 minutes, so a client can download every file, including those too large for company.export. Returns items, total and nextOffset (null on the last page). Administrators only.

## developers.requests

- [`developers.requests.list`](https://app.getoatmilk.com/docs/api/developers.requests.list.md) — List recent API and MCP requests, newest first, with the request ID returned in X-Request-Id, the action, method, status, error code, duration and the key or app that sent it. Filter by status (ok, client_error, server_error), source (api, mcp), key, action or request ID. Kept for 30 days. Administrators see the whole company; everyone else sees their own requests.

## developers

- [`developers.usage`](https://app.getoatmilk.com/docs/api/developers.usage.md) — Summarize API and MCP requests for the last 1, 7 or 30 days: totals, client and server errors, median and 95th percentile response times, requests per day, the busiest keys and apps, the busiest actions and the most common error codes. Administrators see the whole company; everyone else sees requests made with their own keys and apps. Inputs and responses are never recorded.

## email.domain

- [`email.domain.activate`](https://app.getoatmilk.com/docs/api/email.domain.activate.md) — Use a custom domain only after its sending and receiving DNS records are verified.

- [`email.domain.configure`](https://app.getoatmilk.com/docs/api/email.domain.configure.md) — Start verification of an organization-owned custom sending and receiving domain.

- [`email.domain.status`](https://app.getoatmilk.com/docs/api/email.domain.status.md) — Inspect the organization's custom email domain and the provider's public DNS records.

- [`email.domain.usePlatform`](https://app.getoatmilk.com/docs/api/email.domain.usePlatform.md) — Return new outbound and receiving addresses to the default Oatmilk domains.

- [`email.domain.verify`](https://app.getoatmilk.com/docs/api/email.domain.verify.md) — Ask the email provider to verify the current custom domain's DNS records.

## email.outbox

- [`email.outbox.list`](https://app.getoatmilk.com/docs/api/email.outbox.list.md) — List outbound platform emails with their sender identity, recipients, subject, delivery state, attempts, and related record.

## email

- [`email.status`](https://app.getoatmilk.com/docs/api/email.status.md) — Read outbound email readiness: the sending domain, each sender identity address, and whether delivery is enabled in this environment.

- [`email.test`](https://app.getoatmilk.com/docs/api/email.test.md) — Queue a test email from one sender identity to the requesting administrator to verify outbound delivery.

## experiments

- [`experiments.get`](https://app.getoatmilk.com/docs/api/experiments.get.md) — Read the experimental features the signed-in person can try in this workspace (such as RTS mode, which shows the workspace as a 3D strategy game), whether they turned experimental mode on, which experiments they turned on, and the revision. Each person chooses for themselves; the platform decides which experiments are offered.

- [`experiments.update`](https://app.getoatmilk.com/docs/api/experiments.update.md) — Turn experimental mode on or off for the signed-in person (mode), or turn one experiment on or off (experiment with enabled). Only an experiment offered to this workspace can be turned on. Pass expectedRevision from experiments.get and an idempotencyKey. It never changes anyone else's choice.

## identity

- [`identity.get`](https://app.getoatmilk.com/docs/api/identity.get.md) — Read the authenticated user, organization, whether it is a company or their personal workspace (workspaceKind), role and granted permissions without exposing credentials.

## members

- [`members.list`](https://app.getoatmilk.com/docs/api/members.list.md) — Read organization accounting membership and roles.

- [`members.update`](https://app.getoatmilk.com/docs/api/members.update.md) — Manage organization accounting roles and active access.

## notifications.checklist

- [`notifications.checklist.dismiss`](https://app.getoatmilk.com/docs/api/notifications.checklist.dismiss.md) — Mark a snooze reminder as seen for the signed-in member only. Requires an itemId and idempotencyKey. Repeated dismissal changes nothing.

- [`notifications.checklist.list`](https://app.getoatmilk.com/docs/api/notifications.checklist.list.md) — List the signed-in member's unseen reminders that a snoozed checklist item returned. Only their own open items in this organization, at most ten from the past 30 days.

## notifications.comments

- [`notifications.comments.dismiss`](https://app.getoatmilk.com/docs/api/notifications.comments.dismiss.md) — Mark one of the signed-in member's document comment notifications as read. Requires an idempotencyKey; other members' notifications cannot be changed.

- [`notifications.comments.list`](https://app.getoatmilk.com/docs/api/notifications.comments.list.md) — List the signed-in member's unread mentions and replies on organization documents, with a direct link to the comment thread.

## notifications.joins

- [`notifications.joins.dismiss`](https://app.getoatmilk.com/docs/api/notifications.joins.dismiss.md) — Mark one join notice as seen for the signed-in member only. Requires an idempotencyKey. Dismissing twice, or a notice that isn't theirs, changes nothing.

- [`notifications.joins.list`](https://app.getoatmilk.com/docs/api/notifications.joins.list.md) — List the signed-in member's unseen notices that someone joined by an invitation (a contractor, an outside accountant or a team member): who joined, who invited them and a link to the person. Only the member's own notices, from the last 30 days, at most 10.

## notifications.preferences

- [`notifications.preferences.get`](https://app.getoatmilk.com/docs/api/notifications.preferences.get.md) — Read the signed-in member's choice to get join notices by email and in Oatmilk. Both are on until they turn them off.

- [`notifications.preferences.update`](https://app.getoatmilk.com/docs/api/notifications.preferences.update.md) — Turn the signed-in member's join notices on or off, by email and in Oatmilk. Requires an idempotencyKey. It never changes another member's choice.

## onboarding

- [`onboarding.complete`](https://app.getoatmilk.com/docs/api/onboarding.complete.md) — Finish or skip onboarding for the workspace with an idempotencyKey (skipped true when skipping). Finishing again keeps the first time.

- [`onboarding.inboxPrompt`](https://app.getoatmilk.com/docs/api/onboarding.inboxPrompt.md) — Whether the signed-in member should see the optional read-only Gmail or Outlook connection suggestion, and which providers are configured. A connected inbox or this member's Not now answer hides it.

- [`onboarding.status`](https://app.getoatmilk.com/docs/api/onboarding.status.md) — Read a new workspace's setup: whether onboarding is finished, the receipt address, its kind (company or personal), and which steps are done (company details, a bank account or connection, a first receipt or connected inbox, a teammate, and AI keys that cover decisions or Oatmilk's AI credits; a personal workspace has only the bank, receipt and AI steps).

## onboarding.inboxPrompt

- [`onboarding.inboxPrompt.dismiss`](https://app.getoatmilk.com/docs/api/onboarding.inboxPrompt.dismiss.md) — Remember Not now for the signed-in member's optional inbox connection suggestion in this organization. Requires an idempotencyKey; it never changes another member's preference or any mailbox setting.

## platform.admin

- [`platform.admin.accessRequests.list`](https://app.getoatmilk.com/docs/api/platform.admin.accessRequests.list.md) — Platform administrators only: people who asked for access on the waitlist, newest first, with what they told us (email, name, company, role, size, website, kinds of financial data, banks, interests, notes) and the request's status and revision. status filters pending (default), approved, declined or all.

- [`platform.admin.accessRequests.review`](https://app.getoatmilk.com/docs/api/platform.admin.accessRequests.review.md) — Platform administrators only: approve or decline a waitlist request at its current revision. Approving emails the person a link to set up their workspace; platformAi lets their company use Oatmilk's AI credits instead of only its own keys. Declining sends nothing, and a declined request can be approved later.

- [`platform.admin.experiments.list`](https://app.getoatmilk.com/docs/api/platform.admin.experiments.list.md) — Platform administrators only: every experimental feature (such as RTS mode), who it is offered to (off, team for the platform's own workspace, or everyone), its Vercel flag key and that flag's value in Vercel Flags when the deployment is connected, plus the deployment-wide experimental-mode flag. People still turn each experiment on for themselves in Settings › Experimental.

- [`platform.admin.experiments.update`](https://app.getoatmilk.com/docs/api/platform.admin.experiments.update.md) — Platform administrators only: offer one experiment to nobody (off), only the platform's own workspace (team) or every workspace (everyone). A Vercel flag set to off in Vercel Flags still keeps it off. Turning it off stops it at once for everyone who had it on. Pass expectedRevision from platform.admin.experiments.list.

- [`platform.admin.organizations.get`](https://app.getoatmilk.com/docs/api/platform.admin.organizations.get.md) — Platform administrators only: one workspace in God Mode with aggregate numbers only: its counts, its access (approved or paused, AI credits), which AI providers it brought keys for (never the keys), AI usage by feature and model, what kinds of actions it took in the period with how many of each, and the waitlist request it came from.

- [`platform.admin.organizations.update`](https://app.getoatmilk.com/docs/api/platform.admin.organizations.update.md) — Platform administrators only: pause or resume a workspace (status approved or suspended) and turn Oatmilk's AI credits on or off for it (platformAi), at its current revision (0 for a workspace with no access record yet). The platform's own organization can't be changed.

- [`platform.admin.overview`](https://app.getoatmilk.com/docs/api/platform.admin.overview.md) — Platform administrators only (the platform's own organization): God Mode's overview. Signup mode, totals (workspaces, new ones, members, sign-ups, waiting requests, AI requests and cost) and every workspace with aggregate numbers only: members, transactions and receipts brought in, agreements, contractors, invoices, actions in the period, last activity, whose AI keys it uses and its AI usage and cost (AI Gateway's spend report when available, otherwise Oatmilk's own count). Never records, people or contents. days (1 to 90, default 30) sets the period.

## platform.branding

- [`platform.branding.confirmLogo`](https://app.getoatmilk.com/docs/api/platform.branding.confirmLogo.md) — Verify an uploaded logo's bytes and hash, then make it the organization letterhead logo.

- [`platform.branding.logo`](https://app.getoatmilk.com/docs/api/platform.branding.logo.md) — Get a short-lived link to the current organization logo.

- [`platform.branding.prepareLogo`](https://app.getoatmilk.com/docs/api/platform.branding.prepareLogo.md) — Prepare a private upload for the organization logo used on letterheads, agreements, and invoices. PNG or JPEG up to 2 MB.

## platform.settings

- [`platform.settings.get`](https://app.getoatmilk.com/docs/api/platform.settings.get.md) — Read workspace preferences for invoicing numbers and defaults, document branding, compliance reminders, and the inbox AI models: which model reads each email and which gives the second opinion, and at what effort.

- [`platform.settings.update`](https://app.getoatmilk.com/docs/api/platform.settings.update.md) — Update invoicing numbering and defaults, letterhead text, compliance reminder preferences, and the inbox AI models, with a revision check. inboxAi.reading reads each email and its attachments into a draft; inboxAi.checking is the second opinion on anything left unclear. Each takes a model, one of openai/gpt-6.1-sol (GPT-6.1 Sol), openai/gpt-6-luna (GPT-6 Luna), google/gemini-3.8-flash (Gemini 3.8 Flash), zai/glm-5.3-flash (GLM-5.3 Flash), and a low, medium or high effort; null puts that step back on the recommended GPT-6 Luna at medium effort for reading and GPT-6 Luna at medium for the second opinion.

## proposals

- [`proposals.create`](https://app.getoatmilk.com/docs/api/proposals.create.md) — Suggest a change to a record for someone to review. Nothing changes until the suggestion is approved. A newer suggestion for the same record and field replaces the older one. Supply subjectType, subjectId, field, proposedValue, reasoning, optional evidence, and idempotencyKey.

- [`proposals.decide`](https://app.getoatmilk.com/docs/api/proposals.decide.md) — Decline a suggested change, or approve it when a person is signed in to Oatmilk. API keys and agents can decline but can't approve; approving through them is refused with "Approve suggestions in Oatmilk." Approving applies the change through the normal audited action for that record, such as recording an invoice payment or recategorizing an entry. A partly paid suggestion without an amount needs paidAmountMinor. A failed or stale approval can be approved again or declined. Requires expectedRevision and idempotencyKey; an optional note is kept with the decision.

- [`proposals.get`](https://app.getoatmilk.com/docs/api/proposals.get.md) — Read one suggested change with its reasoning, evidence links, and decision history.

- [`proposals.list`](https://app.getoatmilk.com/docs/api/proposals.list.md) — List suggested changes to invoices, entries, mail, accounts, and Notion links, with the current and proposed values, plain-language reasoning, evidence, whether the evidence is newer or older, and status. Defaults to suggestions waiting for review.

## runs

- [`runs.get`](https://app.getoatmilk.com/docs/api/runs.get.md) — Read one run, or the latest run for a subject, with its ordered step events: steps started and finished, model calls, outputs, decisions, and errors. Use afterEventId to fetch only new events while a run is active.

- [`runs.list`](https://app.getoatmilk.com/docs/api/runs.list.md) — List AI and automation runs with their current step, status, and summary. Filter by kind (or a comma-separated kinds list), subject, or status. Contributors see only runs for their own submissions.

- [`runs.trace`](https://app.getoatmilk.com/docs/api/runs.trace.md) — Read an authorized process trace with its stage timeline, logs, model metadata, and linked Workflow SDK run, steps, and events. Restricted mail remains visible only to a security administrator.

## runs.workflows

- [`runs.workflows.catalog`](https://app.getoatmilk.com/docs/api/runs.workflows.catalog.md) — List organization-owned Workflow SDK jobs and indicate which job sources are unavailable while a database update is pending.

- [`runs.workflows.get`](https://app.getoatmilk.com/docs/api/runs.workflows.get.md) — Inspect an organization-owned Workflow SDK run with its steps, events, statuses, and redacted input and output.

- [`runs.workflows.list`](https://app.getoatmilk.com/docs/api/runs.workflows.list.md) — List organization-owned Workflow SDK jobs for receipts, mail, matching, Stripe, and accounting digest replies.

## senders

- [`senders.list`](https://app.getoatmilk.com/docs/api/senders.list.md) — Read exact approved employee sending addresses.

- [`senders.remove`](https://app.getoatmilk.com/docs/api/senders.remove.md) — Remove an approved sending address.

- [`senders.upsert`](https://app.getoatmilk.com/docs/api/senders.upsert.md) — Authorize an exact employee sending address with active membership.

## settings

- [`settings.get`](https://app.getoatmilk.com/docs/api/settings.get.md) — Read accounting fiscal settings and integration configuration. Administrator access required.

- [`settings.rotateMailbox`](https://app.getoatmilk.com/docs/api/settings.rotateMailbox.md) — Rotate the randomly generated receiving alias with revision checks.

- [`settings.update`](https://app.getoatmilk.com/docs/api/settings.update.md) — Update fiscal and bank configuration with revision checks.

## team.invitations

- [`team.invitations.link`](https://app.getoatmilk.com/docs/api/team.invitations.link.md) — Get the private link of a pending team invitation, to share it another way. Only organization administrators can manage the team. MCP calls also require the accounting:admin scope; the direct API cannot send team invitations or remove members.

- [`team.invitations.resend`](https://app.getoatmilk.com/docs/api/team.invitations.resend.md) — Email a pending team invitation again and give it another 14 days, with id, expectedRevision and idempotencyKey. Only organization administrators can manage the team. MCP calls also require the accounting:admin scope; the direct API cannot send team invitations or remove members.

- [`team.invitations.revoke`](https://app.getoatmilk.com/docs/api/team.invitations.revoke.md) — Cancel a pending team invitation so its link stops working, with source (oatmilk, or clerk for an invitation sent before Oatmilk sent its own), id, expectedRevision for an Oatmilk invitation, and idempotencyKey. Only organization administrators can manage the team. MCP calls also require the accounting:admin scope; the direct API cannot send team invitations or remove members.

## team

- [`team.invite`](https://app.getoatmilk.com/docs/api/team.invite.md) — Invite a new team member by email with a role (admin, finance or contributor), an optional message and an idempotency key. Oatmilk emails them a private link when email is enabled; the result always includes a link to share and a delivery status. The link works for 14 days. Only organization administrators can manage the team. MCP calls also require the accounting:admin scope; the direct API cannot send team invitations or remove members.

- [`team.list`](https://app.getoatmilk.com/docs/api/team.list.md) — List the team: everyone in the company's organization with their role and whether they can open Oatmilk, plus pending team invitations. Invitation links are never included.

## team.members

- [`team.members.remove`](https://app.getoatmilk.com/docs/api/team.members.remove.md) — Remove someone from the company: turns off their Oatmilk access and removes them from the organization. Their records stay. You can't remove yourself. Requires userId and idempotencyKey. Only organization administrators can manage the team. MCP calls also require the accounting:admin scope; the direct API cannot send team invitations or remove members.