Teams
A team is your organisation's Trialflare account: the users who belong to it, the trials it owns and its settings. Your account belongs to one team at a time (the team on GET /users/me), and the team permissions you hold — users.create, users.manage, team.manage and so on — decide what you can do here.
Endpoints
| Method | Path | Description |
|---|---|---|
GET |
/teams |
The teams your account belongs to, as {"teams": [...]}. 20 requests per minute. |
GET |
/teams/<teamId> |
Your current team, with its settings and the features enabled on it. 10 requests per minute. |
PUT |
/teams/<teamId> |
Update team settings. Needs team.manage. 50 requests per minute. |
GET |
/teams/<teamId>/users |
The team's users, 30 to a page. Needs users.create. 30 requests per minute. |
POST |
/teams/<teamId>/users |
Create or invite a user. Needs users.create. 10 requests per minute. |
GET |
/teams/<teamId>/users/search?term= |
Find team users by name or email, for picking assignees and personnel. Needs users.create. |
GET |
/teams/<teamId>/logs |
The team event log. Needs team.manage. 10 requests per minute. |
Trials belong to a team, so listing and creating trials is done under the team too: see Trials.
Updating team settings
PUT /teams/<teamId> takes any of the following. All are optional; send only what you are changing.
| Field | Type | Notes |
|---|---|---|
name |
string | 2–30 characters. |
logo, darkLogo |
string | Stored file names of the team's logos, from an upload with forType=team. |
qrIcon, qrDotStyle, qrCornerSquareStyle, qrColour, qrBackgroundColour |
string | Branded QR code styling. |
emailDomain |
string | The email domain new users must belong to. |
activeDirectoryTenantId |
string | Microsoft Entra tenant for single sign-on. |
passwordMinimumLength, passwordMinimumCapitals, passwordMinimumSpecials, passwordMinimumNumbers |
integer | Password policy. |
allowedLoginAttempts |
integer | Failed attempts before an account is locked. |
sessionIdleMinutes |
integer | 5–1440. Sign a web session out after this long idle; null for never. Does not affect API keys. |
userCreationNotificationEmail |
Address told when a user is created. | |
defaultPermissions |
list of strings | Team permission keys given to every new user. |
Listing users
GET /teams/<teamId>/users takes these query parameters:
| Parameter | Default | Notes |
|---|---|---|
page |
1 |
30 users per page. |
term |
— | Filter by name or email. |
sort |
firstName |
Field to sort by, e.g. createdAt, lastSeenAt. |
sortOrder |
asc |
asc or desc. |
Each user carries their email, firstName, lastName, createdAt, lastSeenAt, permissions, whether an invitation is pending (invitePending, invitedAt), whether the account is disabled, and its sign-in state (otpEnabled, hasPasskey, hasPassword, incorrectLoginAttempts). Password hashes and passkeys are never returned.
Creating a user
POST /teams/<teamId>/users:
| Field | Type | Notes |
|---|---|---|
email |
Required. | |
firstName, lastName |
string | 2–30 characters. |
sendInvite |
boolean | true sends an invitation email and lets the person set their own password and details. false creates the account immediately with no password — they sign in through single sign-on or a password reset. |
termsAgreed |
boolean | Whether the person has agreed to the terms. |
If the address already has a Trialflare account on another team, an invitation to join yours is sent instead.
The new account starts with the team's default permissions. To give it more, use PUT /users/<userId>/permissions/<teamId> from Users once it exists — the response to this request includes the new user's _id.
The team event log
GET /teams/<teamId>/logs returns team-level events — users created, permissions changed, settings updated, sign-ins — newest first, as {"logs": [...]}, 30 to a page (?page=). Add ?format=csv to get the whole log as a CSV string in {"csv": "..."}; &limit=<n> caps the number of rows. Exporting the log is itself logged.
Each entry has createdAt, the userEmail of who acted, the event type, an event object with the details, a client (IP address and user agent) and, where the action came through an API key or connected application, an apiToken naming it. Trial-level events live on the trial: see Trials.