Montara PassAPI reference
Members
Sharing an item, changing a role and revoking access.
All routes are protected. See Sharing for the flow these routes are part of.
List members
GET /api/v1/items/:id/membersAny member may look. The owner is in the list.
{
"data": [
{ "user_id": "…", "name": "Ada", "email": "[email protected]", "role": "owner", "created_at": "…" }
],
"metadata": { "total": 1 }
}Share
POST /api/v1/items/:id/members{ "user_id": "…", "role": "viewer", "encrypted_item_key": "base64" }Owner only. role is editor or viewer; encrypted_item_key is the item
key wrapped with the recipient's public key. Answers 201.
| Status | When |
|---|---|
404 | The user does not exist or has not set up a vault |
409 | The item is already shared with this user |
Change a role
PUT /api/v1/items/:id/members/:userId{ "role": "editor" }Owner only.
Remove a member
DELETE /api/v1/items/:id/members/:userIdThe owner may remove anyone but themselves. Any other member may remove only
themselves, which is how they leave an item. Removing the owner answers 400:
delete the item instead.
After removing someone, the owner's client should rotate the item key.