Reseller staff accounts

Begin reseller staff sign-in

Access: Public · Success: 200

Separate reseller email/password identity on the central app host. No public signup or customer/platform account fallback. Returns a five-minute password-bound challenge, never a session before MFA. Shared Redis allows30 attempts per IP and10 per email per15 minutes.

JSON request

Response

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/login' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "person@example.com",
  "password": "<Own staff password>"
}'

Prepare staff authenticator enrollment

Access: Public · Success: 200

Requires a valid unused password challenge for a staff account without MFA. Returns a private secret and QR code; only that human should add it to their authenticator. Setup grants no session or organization access.

JSON request

Response

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/mfa/setup' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{
  "challenge": "<value>"
}'

Complete staff authenticator sign-in

Access: Public · Success: 200

Requires current unused TOTP or one unused recovery code. Enrollment returns ten one-time recovery codes only once. Challenges allow ten incorrect proofs and expire after five minutes. Session cookie is host-only HttpOnly Secure SameSite=Strict, path=/api/reseller; maximum four hours, idle15 minutes. Does not select an organization.

JSON request

Response

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/mfa' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{
  "challenge": "<value>",
  "code": "<Current TOTP or unused recovery code>"
}'

End reseller staff session

Access: Public · Success: 200

Deletes only the presented reseller cookie session and clears its host-only cookie. Missing/already ended sessions also return success; customer/platform sessions are unaffected.

No request body is required.

Response

Use OK.

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/logout' \
  --header 'Origin: https://app.drykraft.com'

Inspect own staff session

Access: Reseller MFA session · Success: 200

Current account/MFA/auth-version and session deadlines are revalidated. Own account and selected enabled organization metadata only. Account security remains available while an organization is paused.

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/session' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Rotate staff account password

Access: Reseller MFA session · Success: 200

Own current password plus unused TOTP/recovery proof, and a different12-128 character password required. Atomically advances authentication version, revokes all staff sessions/challenges and issues a fresh unselected session. Customer/platform credentials are unchanged.

JSON request

Response

Use OK.

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/password' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{
  "current_password": "<Current staff password>",
  "new_password": "<Private password>",
  "code": "<Unused authenticator/recovery proof>"
}'

Replace staff recovery codes

Access: Reseller MFA session · Success: 200

Own current password and an unused authenticator/recovery proof required. Invalidates old recovery codes and shows ten replacements once. Does not enroll a factor for someone else.

JSON request

Response

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/mfa/recovery' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{
  "current_password": "<Own password>",
  "code": "<Unused proof>"
}'

End other staff sessions

Access: Reseller MFA session · Success: 200

Retains the current valid staff session, ends all other sessions and pending sign-ins for this account across organizations, and appends immutable account audit. Available while an organization is paused.

JSON request

Response

Use OK.

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/sessions/revoke' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{}'

List own reseller organizations

Access: Reseller MFA session · Success: 200

Only enabled memberships for this account, 25 per UUID cursor. Includes own pending/paused organization labels and availability so staff can select another active parent. No other staff or customer data.

Query parameters

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/organizations' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Select own active organization

Access: Reseller MFA session · Success: 200

The account must hold an enabled owner/admin/support/billing membership in this active contracted organization. The selection is saved on this session; a customer workspace header cannot choose a parent. No cross-parent lookup or membership creation.

JSON request

Response

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/organizations/00000000-0000-4000-8000-000000000001/select' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{}'

Read selected organization overview

Access: Reseller MFA session · Success: 200

Requires a current enabled membership and active contract. Safe own organization name/key/status/role, customer count, wholesale version/limits/features and eight aggregate live-resource gauges. No private customer data or consumed settlement ledger.

No request body is required.

Response

object.

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/overview' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

List own linked customer workspaces

Access: Reseller MFA session · Success: 200

Only workspaces currently linked to the selected active organization, 25 per UUID cursor. Safe id/name/slug/created_at, assignment version, retail plan label/version and effective suspension. No customer users, CRM, messages or provider credentials.

Query parameters

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/customers' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Read own retail catalog

Access: Reseller owner, administrator or billing · Success: 200

Current selected organization retail catalog with currency/minor-unit price metadata, trial, limits and features. Support cannot read commercial prices. 25 per UUID cursor. Retail publication stores catalog metadata; it does not collect payment.

Query parameters

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/plans' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Inspect current retail publication allowance

Access: Reseller owner, administrator or billing · Success: 200

Current active selected organization only. Safe wholesale grant version, maximum trial days, per-workspace limits and enabled features. Support cannot read commercial allowances. Publication revalidates this allowance at commit.

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/plans/allowance' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Read own immutable retail plan versions

Access: Reseller owner, administrator or billing · Success: 200

Selected active organization only. Returns id/key/reseller_id/current_version, 25 immutable versions newest first and next_before. before selects older history. Staff authors show their name; platform authors show a generic label. Other parent IDs return404; support cannot read prices.

Query parameters

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/plans/00000000-0000-4000-8000-000000000001' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Publish own retail plan

Access: Reseller owner or administrator · Success: 201

Current owner/admin role and active selected organization required. Cannot choose another parent or platform actor. Definition limits/features/trial must stay within the current wholesale grant; prices use supported currency minor units. Explicit request_id and reason required. Same actor/request/input retries return200 with the same immutable receipt; changed input conflicts. Records actual reseller staff authorship and audit. Does not collect payment or reassign existing customers.

JSON request

Response

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/plans' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{
  "definition": {
    "name": "<Retail version name>",
    "currency": "<Supported ISO currency>",
    "monthly_price_minor": 0,
    "annual_price_minor": 0,
    "setup_price_minor": 0,
    "trial_days": 0,
    "limits": {
      "users": "<Maximum live resources; null means no ceiling at this level>",
      "contacts": "<Maximum live resources; null means no ceiling at this level>",
      "custom_records": "<Maximum live resources; null means no ceiling at this level>",
      "pipelines": "<Maximum live resources; null means no ceiling at this level>",
      "workflows": "<Maximum live resources; null means no ceiling at this level>",
      "active_workflows": "<Maximum live resources; null means no ceiling at this level>",
      "integrations": "<Maximum live resources; null means no ceiling at this level>",
      "calendars": "<Maximum live resources; null means no ceiling at this level>"
    },
    "features": {
      "crm": false,
      "sales": false,
      "finance": false,
      "automation": false,
      "outreach": false,
      "calendar": false
    }
  },
  "reason": "<Required reason recorded in immutable platform audit>",
  "request_id": "00000000-0000-4000-8000-000000000001",
  "key": "<value>"
}'

Publish own next retail version

Access: Reseller owner or administrator · Success: 201

Current optimistic plan version, request_id and reason required. Revalidates active contract, selected parent, role and current wholesale allowance. Concurrent differing publications yield one new version and a409 conflict. Identical same-actor retries return200 and the saved receipt even after later versions. Customer assignments remain pinned to their previous immutable version; no provider charge occurs.

JSON request

Response

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/plans/00000000-0000-4000-8000-000000000001/versions' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{
  "definition": {
    "name": "<Retail version name>",
    "currency": "<Supported ISO currency>",
    "monthly_price_minor": 0,
    "annual_price_minor": 0,
    "setup_price_minor": 0,
    "trial_days": 0,
    "limits": {
      "users": "<Maximum live resources; null means no ceiling at this level>",
      "contacts": "<Maximum live resources; null means no ceiling at this level>",
      "custom_records": "<Maximum live resources; null means no ceiling at this level>",
      "pipelines": "<Maximum live resources; null means no ceiling at this level>",
      "workflows": "<Maximum live resources; null means no ceiling at this level>",
      "active_workflows": "<Maximum live resources; null means no ceiling at this level>",
      "integrations": "<Maximum live resources; null means no ceiling at this level>",
      "calendars": "<Maximum live resources; null means no ceiling at this level>"
    },
    "features": {
      "crm": false,
      "sales": false,
      "finance": false,
      "automation": false,
      "outreach": false,
      "calendar": false
    }
  },
  "reason": "<Required reason recorded in immutable platform audit>",
  "request_id": "00000000-0000-4000-8000-000000000001",
  "version": 1
}'

Recover own saved publication receipt

Access: Reseller owner or administrator · Success: 200

Only the original currently authorized owner/admin, selected organization and active contract can recover a saved publication after timeout or reload. Missing, other-actor and other-parent receipts return404. This read creates no plan or version.

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/plans/publications/00000000-0000-4000-8000-000000000001' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Read own aggregate resource allowance

Access: Reseller MFA session · Success: 200

Requires the selected active organization and current membership. Returns reseller_id, eight live-resource usage gauges and aggregate_limits. No consumed credits, customer records or revenue/margin fabrication.

No request body is required.

Response

object.

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/usage' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Read own organization team

Access: Reseller owner or administrator · Success: 200

Current owner/admin membership and active contract required. Safe own staff identity/membership/MFA readiness only, 25 per UUID cursor. No hashes, factors, recovery codes or other organization memberships.

Query parameters

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/members' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Read own team member

Access: Reseller owner or administrator · Success: 200

Current owner/admin membership, selected parent and active contract required. Exact member detail independent of list pagination. Wrong parent or missing member returns404. No credentials or other organization memberships.

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/members/00000000-0000-4000-8000-000000000001' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Recover own saved team membership

Access: Reseller owner or administrator · Success: 200

Only the original currently authorized owner/admin in the selected active organization can recover a membership creation after timeout or reload. Other actors, parents and missing receipts return404. This read creates no membership and returns no initial password.

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/members/creations/00000000-0000-4000-8000-000000000001' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'

Add organization team member

Access: Reseller owner or administrator · Success: 201

Current active owner/admin role required and revalidated at commit. Admin cannot create owners. Explicit new/existing account mode; same actor/request_id/input retry returns200 saved result. Initial passwords are never returned or emailed. The new person enrolls their own MFA.

JSON request

object or object. Explicitly create a separate staff identity or attach an existing reseller identity without changing its credentials. The first enabled team member must be an owner. This creates no customer membership and sends no invitation email.

Response

curl --request POST \
  --url 'https://app.drykraft.com/api/reseller/members' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "person@example.com",
  "role": "owner",
  "request_id": "00000000-0000-4000-8000-000000000001",
  "reason": "<Required reason recorded in immutable platform audit>",
  "mode": "new_account",
  "name": "<Name>",
  "initial_password": "<Private password>"
}'

Change own team role or access

Access: Reseller owner or administrator · Success: 200

Version and reason required. Admin cannot manage/promote owners; owner may manage owners except removing the last enabled owner. Changed roles/access revoke all reseller sessions/challenges for the target account across organizations; customer memberships and records remain.

JSON request

Response

curl --request PUT \
  --url 'https://app.drykraft.com/api/reseller/members/00000000-0000-4000-8000-000000000001' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>' \
  --header 'Origin: https://app.drykraft.com' \
  --header 'Content-Type: application/json' \
  --data '{
  "role": "owner",
  "disabled": false,
  "version": 1,
  "reason": "<Required reason recorded in immutable platform audit>"
}'

Inspect organization team audit

Access: Reseller owner or administrator · Success: 200

Own organization immutable team change audit only, 25 per UUID cursor. Platform actors display a generic Platform administrator label. No other organizations, platform account emails or secret values.

Query parameters

No request body is required.

Response

curl --request GET \
  --url 'https://app.drykraft.com/api/reseller/audit' \
  --cookie 'drykraft_reseller_session=<YOUR_SESSION_TOKEN>'