Skip to main content
Each organization API key carries a permission set. Endpoints require a matching permission. A valid key with the wrong permissions returns 403. Dashboard session routes (organization settings, Discord, billing, audit) are not on this map. They require an owner or admin membership and reject API keys. Organization data export, owner transfer, and organization delete are owner session only. Paths below are relative to the Public API base URL https://api.squadvault.xyz/v1.

​
Permission map

​
Teams

​
Players

​
Documents

​
Tryout applications

Tryout list and get require organizationId as a query parameter. Tryout update and convert require organizationId in the JSON body. API keys need tryout:update to change status; converting also needs player:create.

​
Uploads

Requesting a document upload URL checks document:create on the organization, because the upload exists to create a document afterward.

​
Least privilege

Grant only the permissions your integration needs. For a read-only bot, enable team:read, player:read, and document:read. Add tryout:read when the integration should list or inspect applications, and tryout:update to change status or notes. To add an applicant to the roster, also grant player:create. For document automation, add document:create, document:update, and document:delete as required.