Organization API: Customers: Staff

Part of Customers.

GET /api/v1/orgs/{org_slug}/staff/customers

Directory for this brand, separate from the mixed desk search.

status_filter is an account status or one of CUSTOMER_BUCKETS (unverified, new_7d, paying, free). counts carries one figure per status and per bucket. unverified is accounts whose email was never verified, new_7d signups inside the last seven days, paying accounts with at least one non-free service and free the rest. Every figure is counted under the audience the request carries, and none is narrowed by q, tag or the filter itself, so the tiles keep reading as the whole directory while the list is narrowed.

POST /api/v1/orgs/{org_slug}/staff/customers

An account for someone who ordered by phone or email. No password is set here; the customer gets a link to choose their own, so staff never know it.

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/customers/bulk

Suspend, unsuspend or terminate every order a selection of customers has, or ban the accounts outright.

The fleet's bulk route acts on servers picked one by one; this one is for the search that turned up a dozen accounts with the same email pattern. Same gate: support may suspend and unsuspend; anything that ends an order or an account is an org admin who has stepped up in the last ten minutes.

application/json (required)

GET /api/v1/orgs/{org_slug}/staff/customers/export.csv

The directory as it is filtered, as a CSV. Billing roles only: an export is every customer's contact details in one file. status_filter takes the same values as the directory, the tile buckets included.

GET /api/v1/orgs/{org_slug}/staff/customers/tags

Every label in use on this brand, with how many customers carry it.

GET /api/v1/orgs/{org_slug}/staff/customers/{customer_id}

One customer's record: the account (with display_name), their services, invoices, tickets and staff notes. Each ticket carries its department and assigned_agent_name (the team member's first and last name, else their email; null when unassigned), as the inbox shows them.

PATCH /api/v1/orgs/{org_slug}/staff/customers/{customer_id}

Fix the profile (support), or change the account's standing (admin).

A new email address is unverified again and gets a fresh verification mail: the old inbox proved nothing about the new one. Leaving active ends every session the customer has, so a ban is not decorative.

application/json (required)

GET /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/activity

One timeline, newest first: what staff did to the account, what the customer did, and what billing and support recorded.

POST /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/chat-mute

Silence a handle in community chat and the forum for a while, or lift it.

application/json

POST /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/close

Close and anonymise, with the same guard the customer's own close has: no active services, no unpaid invoices.

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/credit

application/json (required)

GET /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/credit-ledger

GET /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/data-export

Everything held about the customer, as one JSON file, for a privacy request.

The privacy policy promises a copy of their data to anyone who asks; this is the copy. Admin and stepped-up like closing the account, because it is the whole person in one download; rate-limited with the other exports; and audited before the document is built, so the document itself records that it was produced, by whom, and when.

GET /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/emails

Every transactional email the brand sent this customer and whether it went, so "we emailed your server details on this date" can be shown rather than asserted.

POST /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/impersonate

application/json

POST /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/mark-verified

Vouch for an address the customer proved another way (a call, a ticket from that inbox). Admin only, and on the record.

GET /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/notes

POST /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/notes

application/json (required)

GET /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/payment-methods

What the customer has on file, as the customer sees it: a label, a brand, the last four digits, the expiry. The gateway token never leaves the row.

GET /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/related

Other customers on this brand that share a sign-up IP, a sign-up fingerprint, a phone number or a recent session address with this one.

Signals, not verdicts: a household shares an IP. Each match says which signal it came from so the person reading can weigh it.

POST /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/resend-verification

POST /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/reset-mfa

For a customer who lost their phone: remove their second factor and end their sessions. They sign in again and, if the brand requires it, enrol.

POST /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/reset-password

application/json (required)

POST /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/revoke-sessions

application/json

GET /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/sessions

PUT /api/v1/orgs/{org_slug}/staff/customers/{customer_id}/tags

application/json (required)