HTTP API – Member Management: Professional Version Usage Guide

1. Getting Started

Production Base URL: https://app.dicloak.com/gin

• Authentication: Send the current team’s HTTP API key in the X-HTTP-KEY header.
• Data format: JSON. Use Content-Type: application/json for request bodies, snake_case for field names, and strings for IDs.
• Success: code=0 indicates success; a nonzero code indicates failure. HTTP 200 alone does not indicate success. Parameter parsing errors may return HTTP 400.
• Examples: cURL commands use Bash syntax. Replace the API key, IDs, passwords, email addresses, and expiration dates with your actual values.

2. Endpoint Index

Section	Method	Path	Operation
3	GET	/v1/api/request/member/group	List member groups
4	GET	/v1/api/request/member	List members
5	GET	/v1/api/request/member/{id}	Get member details
6	POST	/v1/api/request/member	Create a member
7	PATCH	/v1/api/request/member/{id}	Partially update member details
8	PUT	/v1/api/request/member/{id}	Replace member details
9	GET	/v1/api/request/member/{id}/expiration	Get expiration settings
10	PATCH	/v1/api/request/member/{id}/expiration	Update expiration settings
11	DELETE	/v1/api/request/member/{id}	Delete a member
12	PATCH	/v1/api/request/member/{id}/password	Reset an internal member’s password
13	GET	/v1/api/request/member/{id}/permissions	Get member permissions
14	GET	/v1/api/request/member/{id}/login-verification	Get internal member login verification
15	PATCH	/v1/api/request/member/{id}/login-verification	Update internal member login verification
16	POST	/v1/api/request/member/{id}/totp	Generate and enable a new 2FA key

3. List Member Groups

List member groups in the current team. Use a returned group ID as member_group_id when creating or updating a member.

Endpoint

GET https://app.dicloak.com/gin/v1/api/request/member/group

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.

Request Parameters

Path parameters: None. Request body: None.

Parameter	Type	Required	Description
page_no	integer	No	Page number. Default: 1. Minimum: 1.
page_size	integer	No	Items per page. Default: 10. Range: 1–200.
name	string	No	Exact match on the member group name.

Request Example

curl --get 'https://app.dicloak.com/gin/v1/api/request/member/group' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --data-urlencode 'page_no=1' \  --data-urlencode 'page_size=20'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A list object on success; may be null on failure.
data.list	array	Items returned in this response.
data.total	integer	Total number of matching items.
data.summary	null	Not used by this endpoint.
data.page_token	null	Cursor pagination is not used by this endpoint.
data.list[].id	string	Member group ID. Use this value as member_group_id.
data.list[].name	string	Member group name.
data.list[].remark	string/null	Group remark.

Success Response Example

{  "code": 0,  "msg": "success",  "data": {    "list": [      {        "id": "member_group_001",        "name": "Customer Operations",        "remark": "Customer support permissions"      }    ],    "total": 1,    "summary": null,    "page_token": null  }}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
400009	page_no or page_size has an invalid type or is outside the allowed range.
500000	The request could not be processed.

Error response example:

{  "code": 400009,  "msg": "[page_size] must be an integer",  "data": null,  "next": null}

4. List Members

List internal and external members in the current team using pagination. Multiple filters are combined with AND. Name and account filters use exact matching.

Endpoint

GET https://app.dicloak.com/gin/v1/api/request/member

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.

Request Parameters

Path parameters: None. Request body: None.

Parameter	Type	Required	Description
page_no	integer	No	Default: 1. Minimum: 1.
page_size	integer	No	Default: 10. Range: 1–200.
id	string	No	Exact match on the member ID.
account	string	No	Exact match on the internal login account or external email address.
name	string	No	Exact match on the member’s display name.
type	string	No	INTERNAL / EXTERNAL. Omit to include both types.
status	string	No	ENABLED / DISABLED. Filters by effective status, including expiration.
authority	string	No	SUPER_ADMIN / ADMIN / MANAGER / MEMBER.
member_group_id	string	No	Member group ID in the current team.
profile_group_id	string	No	Profile group ID in the current team. Includes members with access to that specific group or to all profile groups.

Request Example

curl --get 'https://app.dicloak.com/gin/v1/api/request/member' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --data-urlencode 'page_no=1' \  --data-urlencode 'page_size=20' \  --data-urlencode 'type=INTERNAL' \  --data-urlencode 'status=ENABLED'

Exact lookup by an external email address:

curl --get 'https://app.dicloak.com/gin/v1/api/request/member' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --data-urlencode 'account=partner@example.com' \  --data-urlencode 'page_no=1' \  --data-urlencode 'page_size=20'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A list object on success; may be null on failure.
data.list	array	Items returned in this response.
data.total	integer	Total number of matching items.
data.summary	null	Not used by this endpoint.
data.page_token	null	Cursor pagination is not used by this endpoint.
data.list[].id	string	Member ID.
data.list[].name	string	Member display name.
data.list[].account	string	Login account for INTERNAL members; personal email address for EXTERNAL members.
data.list[].type	string	INTERNAL / EXTERNAL.
data.list[].status	string	ENABLED / DISABLED. A member whose fixed expiration time has passed is treated as DISABLED.
data.list[].authority	string	SUPER_ADMIN (Super Admin) / ADMIN (Admin) / MANAGER (Manager) / MEMBER (Staff).
data.list[].member_group_id	string/null	The member group ID that determines feature permissions; separate from the member role.
data.list[].member_group_name	string/null	Member group name.
data.list[].manager	object/null	Assigned manager; null if no manager is assigned.
data.list[].manager.id	string	Manager’s member ID.
data.list[].manager.name	string	Manager’s display name.
data.list[].all_profile_groups	boolean	Whether the member can access all profile groups.
data.list[].profile_group_list	array	Specifically authorized profile groups. Returns [] when all_profile_groups=true.
data.list[].profile_group_list[].id	string	Profile group ID, not an individual profile ID.
data.list[].profile_group_list[].name	string	Profile group name.
data.list[].disuse_remaining_time	integer/null	Milliseconds remaining before deactivation; may be negative or null. Use status to determine the member’s status.
data.list[].remark	string/null	Remark. Empty remarks are returned as null.
data.list[].create_time	string/null	Creation time in yyyy-MM-dd HH:mm:ss format. No time zone offset is included; do not assume UTC.
data.list[].update_time	string/null	Last update time in yyyy-MM-dd HH:mm:ss format. No time zone offset is included; do not assume UTC.

Success Response Example

{  "code": 0,  "msg": "success",  "data": {    "list": [      {        "id": "member_001",        "name": "Alice",        "account": "alice001",        "type": "INTERNAL",        "status": "ENABLED",        "authority": "MEMBER",        "member_group_id": "member_group_001",        "member_group_name": "Customer Operations",        "manager": {          "id": "manager_001",          "name": "Team Manager"        },        "all_profile_groups": false,        "profile_group_list": [          {            "id": "profile_group_001",            "name": "Customer Profiles"          }        ],        "remark": "Customer Operations",        "create_time": "2026-09-24 10:00:00",        "update_time": "2026-09-24 10:00:00",        "disuse_remaining_time": null      }    ],    "total": 1,    "summary": null,    "page_token": null  }}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
400009	page_no or page_size has an invalid type or range, or authority has an invalid value.
400017	Invalid type or status value.
300001	The member group or profile group used as a filter does not exist in the current team.
500000	The request could not be processed.

Error response example:

{  "code": 400009,  "msg": "[page_no] must be an integer",  "data": null,  "next": null}

5. Get Member Details

Get the specified member’s details, group access, and expiration settings in the current team.

Endpoint

GET https://app.dicloak.com/gin/v1/api/request/member/{id}

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	Member ID in the current team.

Query parameters: None.

Request Body

None.

Request Example

curl --request GET 'https://app.dicloak.com/gin/v1/api/request/member/member_001' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A data object on success; may be null on failure.
next	null	Not used by this endpoint.
data.id	string	Member ID.
data.name	string	Member display name.
data.account	string	Login account for INTERNAL members; personal email address for EXTERNAL members.
data.type	string	INTERNAL / EXTERNAL.
data.status	string	ENABLED / DISABLED. A member whose fixed expiration time has passed is treated as DISABLED.
data.authority	string	SUPER_ADMIN (Super Admin) / ADMIN (Admin) / MANAGER (Manager) / MEMBER (Staff).
data.member_group_id	string/null	The member group ID that determines feature permissions; separate from the member role.
data.member_group_name	string/null	Member group name.
data.manager	object/null	Assigned manager; null if no manager is assigned.
data.manager.id	string	Manager’s member ID.
data.manager.name	string	Manager’s display name.
data.all_profile_groups	boolean	Whether the member can access all profile groups.
data.profile_group_list	array	Specifically authorized profile groups. Returns [] when all_profile_groups=true.
data.profile_group_list[].id	string	Profile group ID, not an individual profile ID.
data.profile_group_list[].name	string	Profile group name.
data.remark	string/null	Remark. Empty remarks are returned as null.
data.create_time	string/null	Creation time in yyyy-MM-dd HH:mm:ss format. No time zone offset is included; do not assume UTC.
data.update_time	string/null	Last update time in yyyy-MM-dd HH:mm:ss format. No time zone offset is included; do not assume UTC.
data.expiration	object	Expiration settings. Contains only enabled=false when disabled.
data.expiration.enabled	boolean	Whether deactivation on expiration is enabled.
data.expiration.time_zone	string	Returned when enabled. An IANA time zone, such as America/New_York.
data.expiration.mode	string	Returned when enabled: INSTANT for a fixed expiration time; LOGIN_START for a validity period starting at the first login.
data.expiration.expires_at	string	Returned only for INSTANT. Local time in time_zone, formatted as yyyy-MM-dd HH:mm.
data.expiration.days	integer	Returned only for LOGIN_START. Number of days the member remains valid after the first login.

Success Response Example

{  "code": 0,  "msg": "success",  "data": {    "id": "member_001",    "name": "Alice",    "account": "alice001",    "type": "INTERNAL",    "status": "ENABLED",    "authority": "MEMBER",    "member_group_id": "member_group_001",    "member_group_name": "Customer Operations",    "manager": {      "id": "manager_001",      "name": "Team Manager"    },    "all_profile_groups": false,    "profile_group_list": [      {        "id": "profile_group_001",        "name": "Customer Profiles"      }    ],    "expiration": {      "enabled": true,      "time_zone": "America/New_York",      "mode": "INSTANT",      "expires_at": "2099-12-31 23:59"    },    "remark": "Customer Operations",    "create_time": "2026-09-24 10:00:00",    "update_time": "2026-09-24 10:00:00"  },  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
300001	The member does not exist, has been deleted, or does not belong to the current team.
500000	The request could not be processed.

Error response example:

{  "code": 300001,  "msg": "id does not identify an existing member in the current team",  "data": null,  "next": null}

6. Create a Member

Create an internal account and team membership, or add an external personal account to the current team. Save data.id for subsequent member requests.

Endpoint

POST https://app.dicloak.com/gin/v1/api/request/member

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.
Content-Type	string	Yes	Must be application/json.

Request Parameters

Path parameters: None. Query parameters: None.

JSON Body: Basic Fields

Parameter	Type	Required	Description
name	string	Yes	Required and nonblank. Up to 20 characters. Must be unique within the current team.
account	string	Yes	INTERNAL: 6–20 English letters or digits, with no spaces. EXTERNAL: a valid email address.
password	string	For INTERNAL	8–25 characters, including at least one English letter and one digit, with no leading or trailing whitespace. Submit the original password string over HTTPS without hashing, encoding, or encrypting it first. Omit for EXTERNAL members.
type	string	Yes	INTERNAL / EXTERNAL. Cannot be changed through the member details endpoints after creation.
authority	string	Yes	ADMIN / MANAGER / MEMBER.
member_group_id	string	Yes	An existing, enabled, assignable member group ID in the current team.
status	string	No	ENABLED / DISABLED. Default: ENABLED.
manager_id	string	No	Allowed only when authority=MEMBER. Must identify an enabled MANAGER in the current team. Omit if no manager is assigned.
all_profile_groups	boolean	No	Defaults to true for ADMIN and false for other roles. Must be true for ADMIN.
profile_group_ids	array of string	No	Profile group IDs in the current team. Default: []. Must be empty when all_profile_groups=true. IDs must not be blank or duplicated.
expiration	object	No	Omit to disable deactivation on expiration. If provided, enabled is required; enabling expiration requires a complete configuration for the selected mode.
login_verification	object	No	INTERNAL only. Omit to leave email verification and 2FA disabled. If provided, include at least one of email, check_email, check_2fa, or trigger. Cannot be null.
remark	string/null	No	Up to 200 characters. Omit for no remark.

JSON Body: All expiration Fields

Parameter	Type	Required	Description
expiration.enabled	boolean	If the object is provided	When false, the object must contain only enabled. When true, provide a time zone, mode, and expiration date or number of days. Configuration fields cannot be null.
expiration.time_zone	string	When enabling expiration	An IANA time zone, such as America/New_York, Europe/London, or Asia/Shanghai.
expiration.mode	string	When enabling expiration	INSTANT: deactivate at a specified time. LOGIN_START: start the validity period at the first login.
expiration.expires_at	string	When enabling or switching to INSTANT	Local time with minute precision: yyyy-MM-dd HH:mm. yyyy-MM-dd HH:mm:ss is also accepted, with seconds ignored. Must be in the future. Do not submit days together with this field.
expiration.days	integer	When enabling or switching to LOGIN_START	1–36500. Can only be set before the first activation. Do not submit expires_at together with this field. Use expires_at for renewal.

JSON Body: All login_verification Fields

Parameter	Type	Required	Description
login_verification.check_email	boolean	No	Default: false. Cannot be null. A valid email is required when enabled.
login_verification.email	string/null	No	Email address for receiving verification codes, not the login account. Can be updated without a verification code. Cannot be cleared while email verification is enabled.
login_verification.check_2fa	boolean	No	Default: false. Set true to enable 2FA. Cannot be null. Read the key from secret_2fa in the response; do not submit a key in the request.
login_verification.trigger	object	No	Default: EVERY_LOGIN. If provided, submit the complete trigger configuration. Cannot be null.
login_verification.trigger.mode	string	If trigger is provided	EVERY_LOGIN: verify at each team login. DEVICE_OR_INTERVAL: verify after a device change or when the specified interval has elapsed.
login_verification.trigger.interval	integer	For DEVICE_OR_INTERVAL	1–168. Must be omitted for EVERY_LOGIN.
login_verification.trigger.unit	string	For DEVICE_OR_INTERVAL	HOUR / DAY. Must be omitted for EVERY_LOGIN.
login_verification.trigger.logout_on_timeout	boolean	No	For DEVICE_OR_INTERVAL, defaults to false when omitted. Set true to log out automatically when the interval expires. Must be omitted for EVERY_LOGIN. Cannot be null.

Request Example: Internal Member

curl --request POST 'https://app.dicloak.com/gin/v1/api/request/member' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "name": "Alice",  "account": "alice001",  "password": "ExamplePass2026!",  "type": "INTERNAL",  "authority": "MEMBER",  "member_group_id": "member_group_001",  "status": "ENABLED",  "manager_id": "manager_001",  "all_profile_groups": false,  "profile_group_ids": [    "profile_group_001"  ],  "expiration": {    "enabled": true,    "time_zone": "America/New_York",    "mode": "INSTANT",    "expires_at": "2099-12-31 23:59"  },  "login_verification": {    "check_email": true,    "email": "alice.verify@example.com",    "check_2fa": true,    "trigger": {      "mode": "DEVICE_OR_INTERVAL",      "interval": 7,      "unit": "DAY",      "logout_on_timeout": false    }  },  "remark": "Customer Operations"}'

Request Example: External Member

curl --request POST 'https://app.dicloak.com/gin/v1/api/request/member' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "name": "Partner",  "account": "partner@example.com",  "type": "EXTERNAL",  "authority": "MEMBER",  "member_group_id": "member_group_001",  "status": "ENABLED",  "all_profile_groups": false,  "profile_group_ids": [    "profile_group_001"  ],  "expiration": {    "enabled": false  },  "remark": "External partner"}'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A data object on success; may be null on failure.
next	null	Not used by this endpoint.
data.id	string	Member ID.
data.name	string	Member display name.
data.account	string	Login account for INTERNAL members; personal email address for EXTERNAL members.
data.type	string	INTERNAL / EXTERNAL.
data.status	string	ENABLED / DISABLED. A member whose fixed expiration time has passed is treated as DISABLED.
data.authority	string	SUPER_ADMIN (Super Admin) / ADMIN (Admin) / MANAGER (Manager) / MEMBER (Staff).
data.member_group_id	string/null	The member group ID that determines feature permissions; separate from the member role.
data.member_group_name	string/null	Member group name.
data.manager	object/null	Assigned manager; null if no manager is assigned.
data.manager.id	string	Manager’s member ID.
data.manager.name	string	Manager’s display name.
data.all_profile_groups	boolean	Whether the member can access all profile groups.
data.profile_group_list	array	Specifically authorized profile groups. Returns [] when all_profile_groups=true.
data.profile_group_list[].id	string	Profile group ID, not an individual profile ID.
data.profile_group_list[].name	string	Profile group name.
data.remark	string/null	Remark. Empty remarks are returned as null.
data.create_time	string/null	Creation time in yyyy-MM-dd HH:mm:ss format. No time zone offset is included; do not assume UTC.
data.update_time	string/null	Last update time in yyyy-MM-dd HH:mm:ss format. No time zone offset is included; do not assume UTC.
data.expiration	object	Expiration settings. Contains only enabled=false when disabled.
data.expiration.enabled	boolean	Whether deactivation on expiration is enabled.
data.expiration.time_zone	string	Returned when enabled. An IANA time zone, such as America/New_York.
data.expiration.mode	string	Returned when enabled: INSTANT for a fixed expiration time; LOGIN_START for a validity period starting at the first login.
data.expiration.expires_at	string	Returned only for INSTANT. Local time in time_zone, formatted as yyyy-MM-dd HH:mm.
data.expiration.days	integer	Returned only for LOGIN_START. Number of days the member remains valid after the first login.
data.login_verification	object	Returned when creating an INTERNAL member; omitted for EXTERNAL members.
data.login_verification.check_email	boolean	Whether email verification is enabled.
data.login_verification.email	string	Email address for receiving verification codes. Returned only when check_email=true.
data.login_verification.check_2fa	boolean	Whether 2FA is enabled.
data.login_verification.secret_2fa	string	Returned only when check_2fa=true. This is an authenticator key, not a one-time verification code.
data.login_verification.trigger	object	Current verification trigger settings.
data.login_verification.trigger.mode	string	EVERY_LOGIN / DEVICE_OR_INTERVAL.
data.login_verification.trigger.interval	integer	Returned only for DEVICE_OR_INTERVAL. Interval: 1–168.
data.login_verification.trigger.unit	string	Returned only for DEVICE_OR_INTERVAL. HOUR / DAY.
data.login_verification.trigger.logout_on_timeout	boolean	Returned only for DEVICE_OR_INTERVAL. Whether to log out automatically when the interval expires.

Response header: Cache-Control: no-store. The password is not returned.

Success Response Example: Internal Member

{  "code": 0,  "msg": "success",  "data": {    "id": "member_001",    "name": "Alice",    "account": "alice001",    "type": "INTERNAL",    "status": "ENABLED",    "authority": "MEMBER",    "member_group_id": "member_group_001",    "member_group_name": "Customer Operations",    "manager": {      "id": "manager_001",      "name": "Team Manager"    },    "all_profile_groups": false,    "profile_group_list": [      {        "id": "profile_group_001",        "name": "Customer Profiles"      }    ],    "expiration": {      "enabled": true,      "time_zone": "America/New_York",      "mode": "INSTANT",      "expires_at": "2099-12-31 23:59"    },    "remark": "Customer Operations",    "create_time": "2026-09-24 10:00:00",    "update_time": "2026-09-24 10:00:00",    "login_verification": {      "check_email": true,      "email": "alice.verify@example.com",      "check_2fa": true,      "secret_2fa": "<SERVER_GENERATED_2FA_SECRET>",      "trigger": {        "mode": "DEVICE_OR_INTERVAL",        "interval": 7,        "unit": "DAY",        "logout_on_timeout": false      }    }  },  "next": null}

Success Response Example: External Member

{  "code": 0,  "msg": "success",  "data": {    "id": "member_external_001",    "name": "Partner",    "account": "partner@example.com",    "type": "EXTERNAL",    "status": "ENABLED",    "authority": "MEMBER",    "member_group_id": "member_group_001",    "member_group_name": "Customer Operations",    "manager": null,    "all_profile_groups": false,    "profile_group_list": [      {        "id": "profile_group_001",        "name": "Customer Profiles"      }    ],    "expiration": {      "enabled": false    },    "remark": "External partner",    "create_time": "2026-09-24 10:00:00",    "update_time": "2026-09-24 10:00:00"  },  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
400009	Missing required fields, conflicting access settings, or login verification settings submitted for an external member.
400017	Invalid internal account or external email format, a field exceeding its length limit, or a password submitted for an external member.
300001	The referenced member group, profile group, or manager does not exist or does not belong to the current team.
400011	The member group is disabled or cannot be assigned.
300108	The member name already exists in the current team.
300131	The external member’s email address already exists in the current team.
300164	The account cannot be linked as an external personal account, or is already in use.
300165	The internal account already exists.
300133	The team’s member limit has been reached.
300203	Invalid password format.
300204	Invalid time zone.
300205	Invalid expiration time or number of days.
300206	Assigning the SUPER_ADMIN role is not allowed.
500000	The request could not be processed.

Error response example:

{  "code": 300203,  "msg": "password must be 8-25 characters, contain an English letter and a digit, and have no leading or trailing spaces",  "data": null,  "next": null}

7. Partially Update Member Details

Update only the submitted fields. Omitted fields remain unchanged. Supports internal and external members. Super Admin cannot be modified.

Endpoint

PATCH https://app.dicloak.com/gin/v1/api/request/member/{id}

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.
Content-Type	string	Yes	Must be application/json.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	Member ID in the current team. Supports INTERNAL and EXTERNAL. SUPER_ADMIN cannot be modified.

Query parameters: None.

JSON Body Parameters

Submit at least one of the following eight fields. An empty object {} is rejected.

Parameter	Type	Required	Description
name	string	No	Nonblank, up to 20 characters, and unique within the current team. Omit to keep unchanged. Null is not allowed.
authority	string	No	ADMIN / MANAGER / MEMBER. Omit to keep unchanged. Null is not allowed. When changing from ADMIN to another role, also submit all_profile_groups and profile_group_ids.
status	string	No	ENABLED / DISABLED. Omit to keep unchanged. Null is not allowed.
member_group_id	string	No	An enabled, assignable member group in the current team. Omit to keep unchanged. Null or blank values are not allowed.
manager_id	string/null	No	Allowed only when authority=MEMBER. Must identify an enabled manager in the current team. Null clears the manager; omission keeps it unchanged.
all_profile_groups	boolean	No	Whether to allow access to all profile groups. Must be true for ADMIN. Null is not allowed.
profile_group_ids	array of string	No	Profile group IDs in the current team. Replaces the entire set of specific group grants. [] clears the set; null is not allowed; omission keeps it unchanged. Must be empty when all_profile_groups=true.
remark	string/null	No	Up to 200 characters. Null clears the remark; omission keeps it unchanged.

Request Example: Update Group Access and Remark

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "all_profile_groups": false,  "profile_group_ids": [    "profile_group_001"  ],  "remark": "Updated by API"}'

Request Example: Disable a Member

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "status": "DISABLED"}'

Request Example: Change an Admin to Staff

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "authority": "MEMBER",  "all_profile_groups": false,  "profile_group_ids": [    "profile_group_001"  ]}'

Request Example: Clear a Staff Member’s Manager and Remark

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "manager_id": null,  "remark": null}'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A data object on success; may be null on failure.
next	null	Not used by this endpoint.
data.id	string	Member ID.
data.name	string	Member display name.
data.account	string	Login account for INTERNAL members; personal email address for EXTERNAL members.
data.type	string	INTERNAL / EXTERNAL.
data.status	string	ENABLED / DISABLED. A member whose fixed expiration time has passed is treated as DISABLED.
data.authority	string	SUPER_ADMIN (Super Admin) / ADMIN (Admin) / MANAGER (Manager) / MEMBER (Staff).
data.member_group_id	string/null	The member group ID that determines feature permissions; separate from the member role.
data.member_group_name	string/null	Member group name.
data.manager	object/null	Assigned manager; null if no manager is assigned.
data.manager.id	string	Manager’s member ID.
data.manager.name	string	Manager’s display name.
data.all_profile_groups	boolean	Whether the member can access all profile groups.
data.profile_group_list	array	Specifically authorized profile groups. Returns [] when all_profile_groups=true.
data.profile_group_list[].id	string	Profile group ID, not an individual profile ID.
data.profile_group_list[].name	string	Profile group name.
data.remark	string/null	Remark. Empty remarks are returned as null.
data.create_time	string/null	Creation time in yyyy-MM-dd HH:mm:ss format. No time zone offset is included; do not assume UTC.
data.update_time	string/null	Last update time in yyyy-MM-dd HH:mm:ss format. No time zone offset is included; do not assume UTC.
data.expiration	object	Expiration settings. Contains only enabled=false when disabled.
data.expiration.enabled	boolean	Whether deactivation on expiration is enabled.
data.expiration.time_zone	string	Returned when enabled. An IANA time zone, such as America/New_York.
data.expiration.mode	string	Returned when enabled: INSTANT for a fixed expiration time; LOGIN_START for a validity period starting at the first login.
data.expiration.expires_at	string	Returned only for INSTANT. Local time in time_zone, formatted as yyyy-MM-dd HH:mm.
data.expiration.days	integer	Returned only for LOGIN_START. Number of days the member remains valid after the first login.

Success Response Example

Full success response for the request that updates group access and the remark:

{  "code": 0,  "msg": "success",  "data": {    "id": "member_001",    "name": "Alice",    "account": "alice001",    "type": "INTERNAL",    "status": "ENABLED",    "authority": "MEMBER",    "member_group_id": "member_group_001",    "member_group_name": "Customer Operations",    "manager": {      "id": "manager_001",      "name": "Team Manager"    },    "all_profile_groups": false,    "profile_group_list": [      {        "id": "profile_group_001",        "name": "Customer Profiles"      }    ],    "expiration": {      "enabled": true,      "time_zone": "America/New_York",      "mode": "INSTANT",      "expires_at": "2099-12-31 23:59"    },    "remark": "Updated by API",    "create_time": "2026-09-24 10:00:00",    "update_time": "2026-09-24 11:00:00"  },  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
400009	Empty request, null in a field that does not allow it, or conflicting manager or group access settings.
400017	Invalid field format, such as a name or remark exceeding its length limit.
300001	The member, referenced group, or manager does not exist in the current team.
400011	The member group is disabled or cannot be assigned.
300108	The member name already exists.
300205	The member has expired. Extend or disable expiration before re-enabling the member.
300206	Modifying Super Admin or assigning SUPER_ADMIN is not allowed.
300099	The request cannot be processed at this time. Please try again later.
500000	The request could not be processed.

Error response example:

{  "code": 400009,  "msg": "request_body must contain at least one editable member field",  "data": null,  "next": null}

8. Replace Member Details

Submit all editable member details. Missing required fields cause an error. Omitting the optional manager or remark clears it. Supports internal and external members. Super Admin cannot be modified.

Endpoint

PUT https://app.dicloak.com/gin/v1/api/request/member/{id}

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.
Content-Type	string	Yes	Must be application/json.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	Member ID in the current team. Supports INTERNAL and EXTERNAL. SUPER_ADMIN cannot be modified.

Query parameters: None.

JSON Body Parameters

Parameter	Type	Required	Description
name	string	Yes	Nonblank, up to 20 characters, and unique within the team.
authority	string	Yes	ADMIN / MANAGER / MEMBER. SUPER_ADMIN is not allowed.
status	string	Yes	ENABLED / DISABLED.
member_group_id	string	Yes	An enabled, assignable member group ID in the current team.
all_profile_groups	boolean	Yes	Whether to allow access to all profile groups. Must be true for ADMIN.
profile_group_ids	array of string	Yes	Profile group IDs in the current team. Replaces the entire set of specific group grants. Cannot be null. Must be [] when all_profile_groups=true.
manager_id	string/null	No	A non-null ID can be set only for MEMBER and must identify an enabled MANAGER in the current team. Omission or null clears the manager.
remark	string/null	No	Up to 200 characters. Omission or null clears the remark.

Request Example

curl --request PUT 'https://app.dicloak.com/gin/v1/api/request/member/member_001' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "name": "Alice Updated",  "authority": "MEMBER",  "status": "ENABLED",  "member_group_id": "member_group_001",  "all_profile_groups": false,  "profile_group_ids": [    "profile_group_001"  ],  "manager_id": null,  "remark": "Replaced by API"}'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A data object on success; may be null on failure.
next	null	Not used by this endpoint.
data.id	string	Member ID.
data.name	string	Member display name.
data.account	string	Login account for INTERNAL members; personal email address for EXTERNAL members.
data.type	string	INTERNAL / EXTERNAL.
data.status	string	ENABLED / DISABLED. A member whose fixed expiration time has passed is treated as DISABLED.
data.authority	string	SUPER_ADMIN (Super Admin) / ADMIN (Admin) / MANAGER (Manager) / MEMBER (Staff).
data.member_group_id	string/null	The member group ID that determines feature permissions; separate from the member role.
data.member_group_name	string/null	Member group name.
data.manager	object/null	Assigned manager; null if no manager is assigned.
data.manager.id	string	Manager’s member ID.
data.manager.name	string	Manager’s display name.
data.all_profile_groups	boolean	Whether the member can access all profile groups.
data.profile_group_list	array	Specifically authorized profile groups. Returns [] when all_profile_groups=true.
data.profile_group_list[].id	string	Profile group ID, not an individual profile ID.
data.profile_group_list[].name	string	Profile group name.
data.remark	string/null	Remark. Empty remarks are returned as null.
data.create_time	string/null	Creation time in yyyy-MM-dd HH:mm:ss format. No time zone offset is included; do not assume UTC.
data.update_time	string/null	Last update time in yyyy-MM-dd HH:mm:ss format. No time zone offset is included; do not assume UTC.
data.expiration	object	Expiration settings. Contains only enabled=false when disabled.
data.expiration.enabled	boolean	Whether deactivation on expiration is enabled.
data.expiration.time_zone	string	Returned when enabled. An IANA time zone, such as America/New_York.
data.expiration.mode	string	Returned when enabled: INSTANT for a fixed expiration time; LOGIN_START for a validity period starting at the first login.
data.expiration.expires_at	string	Returned only for INSTANT. Local time in time_zone, formatted as yyyy-MM-dd HH:mm.
data.expiration.days	integer	Returned only for LOGIN_START. Number of days the member remains valid after the first login.

Success Response Example

{  "code": 0,  "msg": "success",  "data": {    "id": "member_001",    "name": "Alice Updated",    "account": "alice001",    "type": "INTERNAL",    "status": "ENABLED",    "authority": "MEMBER",    "member_group_id": "member_group_001",    "member_group_name": "Customer Operations",    "manager": null,    "all_profile_groups": false,    "profile_group_list": [      {        "id": "profile_group_001",        "name": "Customer Profiles"      }    ],    "expiration": {      "enabled": true,      "time_zone": "America/New_York",      "mode": "INSTANT",      "expires_at": "2099-12-31 23:59"    },    "remark": "Replaced by API",    "create_time": "2026-09-24 10:00:00",    "update_time": "2026-09-24 11:00:00"  },  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
400009	Missing required fields, null in a field that does not allow it, or conflicting access settings.
400017	Invalid field format, such as a value exceeding its length limit.
300001	The member, group, or manager does not belong to the current team.
400011	The member group is disabled or cannot be assigned.
300108	The name already exists.
300205	An expired member cannot be re-enabled without first updating the expiration settings.
300206	Modifying or assigning Super Admin is not allowed.
300099	The request cannot be processed at this time. Please try again later.
500000	The request could not be processed.

Error response example:

{  "code": 400009,  "msg": "[profile_group_ids] is required",  "data": null,  "next": null}

9. Get Expiration Settings

Get whether deactivation on expiration is enabled, along with the fixed expiration time or validity period after the first login. Supports internal and external members.

Endpoint

GET https://app.dicloak.com/gin/v1/api/request/member/{id}/expiration

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	Member ID in the current team. Supports INTERNAL and EXTERNAL.

Query parameters: None.

Request Body

None.

Request Example

curl --request GET 'https://app.dicloak.com/gin/v1/api/request/member/member_001/expiration' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A data object on success; may be null on failure.
next	null	Not used by this endpoint.
data.enabled	boolean	Whether deactivation on expiration is enabled.
data.time_zone	string	Returned when enabled. An IANA time zone, such as America/New_York.
data.mode	string	Returned when enabled: INSTANT for a fixed expiration time; LOGIN_START for a validity period starting at the first login.
data.expires_at	string	Returned only for INSTANT. Local time in time_zone, formatted as yyyy-MM-dd HH:mm.
data.days	integer	Returned only for LOGIN_START. Number of days the member remains valid after the first login.

Success Response Example: Expiration Disabled

{  "code": 0,  "msg": "success",  "data": {    "enabled": false  },  "next": null}

Success Response Example: Fixed Expiration Time

{  "code": 0,  "msg": "success",  "data": {    "enabled": true,    "time_zone": "America/New_York",    "mode": "INSTANT",    "expires_at": "2099-12-31 23:59"  },  "next": null}

Success Response Example: Validity Period After First Login

{  "code": 0,  "msg": "success",  "data": {    "enabled": true,    "time_zone": "America/New_York",    "mode": "LOGIN_START",    "days": 30  },  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
300001	The member does not exist, has been deleted, or does not belong to the current team.
500000	The request could not be processed.

Error response example:

{  "code": 300001,  "msg": "id does not identify an existing member in the current team",  "data": null,  "next": null}

10. Update Expiration Settings

Enable, extend, change, or disable member expiration. Supports internal and external members. Super Admin cannot be modified.

Endpoint

PATCH https://app.dicloak.com/gin/v1/api/request/member/{id}/expiration

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.
Content-Type	string	Yes	Must be application/json.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	Member ID in the current team. Supports INTERNAL and EXTERNAL. SUPER_ADMIN cannot be modified.

Query parameters: None.

JSON Body Parameters

Submit at least one field. Null is not allowed. When expiration is enabled, omitted fields remain unchanged. When switching modes, provide the fields required for the new mode.

Parameter	Type	Required	Description
enabled	boolean	Conditional	Set true when enabling expiration. When setting false, submit this field alone.
time_zone	string	When enabling expiration	An IANA time zone, such as America/New_York, Europe/London, or Asia/Shanghai.
mode	string	When enabling expiration	INSTANT: deactivate at a specified time. LOGIN_START: start the validity period at the first login.
expires_at	string	When enabling or switching to INSTANT	Local time with minute precision: yyyy-MM-dd HH:mm. yyyy-MM-dd HH:mm:ss is also accepted, with seconds ignored. Must be in the future. Do not submit days together with this field.
days	integer	When enabling or switching to LOGIN_START	1–36500. Can only be set before the first activation. Do not submit expires_at together with this field. Use expires_at for renewal.

Request Example: Enable a Fixed Expiration Time

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001/expiration' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "enabled": true,  "time_zone": "America/New_York",  "mode": "INSTANT",  "expires_at": "2099-12-31 23:59"}'

Request Example: Expire 30 Days After First Login

This example applies only to members who have not yet been activated.

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001/expiration' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "enabled": true,  "time_zone": "America/New_York",  "mode": "LOGIN_START",  "days": 30}'

Request Example: Extend to a Fixed Expiration Time

This example requires INSTANT expiration to be enabled.

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001/expiration' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "expires_at": "2099-12-31 23:59"}'

Request Example: Disable Expiration

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001/expiration' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "enabled": false}'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A data object on success; may be null on failure.
next	null	Not used by this endpoint.
data.enabled	boolean	Whether deactivation on expiration is enabled.
data.time_zone	string	Returned when enabled. An IANA time zone, such as America/New_York.
data.mode	string	Returned when enabled: INSTANT for a fixed expiration time; LOGIN_START for a validity period starting at the first login.
data.expires_at	string	Returned only for INSTANT. Local time in time_zone, formatted as yyyy-MM-dd HH:mm.
data.days	integer	Returned only for LOGIN_START. Number of days the member remains valid after the first login.

Success Response Example: Fixed Expiration Time

{  "code": 0,  "msg": "success",  "data": {    "enabled": true,    "time_zone": "America/New_York",    "mode": "INSTANT",    "expires_at": "2099-12-31 23:59"  },  "next": null}

Success Response Example: Validity Period After First Login

{  "code": 0,  "msg": "success",  "data": {    "enabled": true,    "time_zone": "America/New_York",    "mode": "LOGIN_START",    "days": 30  },  "next": null}

Success Response Example: Expiration Disabled

{  "code": 0,  "msg": "success",  "data": {    "enabled": false  },  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
400009	Empty request, null values, incomplete settings when enabling expiration, or additional fields submitted when disabling expiration.
400017	mode must be INSTANT or LOGIN_START.
300001	The member does not exist or does not belong to the current team.
300204	time_zone is not a valid time zone.
300205	The expiration time, number of days, or renewal parameters do not meet the requirements.
300206	Super Admin cannot be modified.
300099	The request cannot be processed at this time. Please try again later.
500000	The request could not be processed.

Error response example:

{  "code": 300205,  "msg": "expires_at must be later than the current time",  "data": null,  "next": null}

11. Delete a Member

Deleting an internal member also deletes their internal account and signs out their logged-in devices. Deleting an external member only removes their membership in the current team; their personal account and other team memberships remain.

Endpoint

DELETE https://app.dicloak.com/gin/v1/api/request/member/{id}

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	Member ID in the current team. Supports INTERNAL and EXTERNAL. SUPER_ADMIN cannot be modified.

Query parameters: None.

Request Body

None. Do not submit JSON.

Request Example

curl --request DELETE 'https://app.dicloak.com/gin/v1/api/request/member/member_001' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	null	Null. No data is returned on success.
next	null	Not used by this endpoint.

Success Response Example

{  "code": 0,  "msg": "success",  "data": null,  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
300001	The member does not exist, has been deleted, or does not belong to the current team.
300206	Super Admin cannot be deleted.
300099	The request cannot be processed at this time. Please try again later.
500000	The request could not be processed.

Error response example:

{  "code": 300206,  "msg": "id identifies the Super Admin (team owner); this member cannot be modified by this API",  "data": null,  "next": null}

12. Reset an Internal Member’s Password

Reset an internal member’s password without providing the old password. The member must sign in again after a successful reset.

Endpoint

PATCH https://app.dicloak.com/gin/v1/api/request/member/{id}/password

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.
Content-Type	string	Yes	Must be application/json.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	An INTERNAL member ID in the current team. EXTERNAL and SUPER_ADMIN are not supported.

Query parameters: None.

JSON Body Parameters

Parameter	Type	Required	Description
password	string	Yes	8–25 characters, including at least one English letter and one digit, with no leading or trailing whitespace. Submit the original password string over HTTPS without hashing, encoding, or encrypting it first.

Request Example

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001/password' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "password": "NewExamplePass2026!"}'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	null	Null. No data is returned on success.
next	null	Not used by this endpoint.

Success Response Example

{  "code": 0,  "msg": "success",  "data": null,  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
400009	password is missing, blank, or has an invalid type.
300203	The password does not meet the length, letter-and-digit, or leading/trailing whitespace requirements.
300001	The member does not exist or does not belong to the current team.
300207	The member is EXTERNAL; resetting their personal password is not allowed.
300206	Super Admin cannot be modified.
500000	The request could not be processed.

Error response example:

{  "code": 300203,  "msg": "password must be 8-25 characters, contain an English letter and a digit, and have no leading or trailing spaces",  "data": null,  "next": null}

13. Get Member Permissions

Get feature permissions for the member specified by the path parameter id. Supports internal and external members.

Endpoint

GET https://app.dicloak.com/gin/v1/api/request/member/{id}/permissions

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	Member ID in the current team. Supports INTERNAL and EXTERNAL.

Query parameters: None.

Request Body

None.

Request Example

curl --request GET 'https://app.dicloak.com/gin/v1/api/request/member/member_001/permissions' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A list object on success; may be null on failure.
data.list	array	Items returned in this response.
data.total	integer	Total number of matching items.
data.summary	null	Not used by this endpoint.
data.page_token	null	Cursor pagination is not used by this endpoint.
data.list[].code	string	Feature permission code. Use the actual value returned.
data.list[].name	string	Feature permission name.

Success Response Example

The permission code and name below are placeholders. Use the actual values returned by the API.

{  "code": 0,  "msg": "success",  "data": {    "list": [      {        "code": "<PERMISSION_CODE>",        "name": "<PERMISSION_NAME>"      }    ],    "total": 1,    "summary": null,    "page_token": null  }}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
300001	The target member does not exist, has been deleted, or does not belong to the current team.
500000	The request could not be processed.

Error response example:

{  "code": 300001,  "msg": "id does not identify an existing member in the current team",  "data": null}

14. Get Internal Member Login Verification

Get an internal member’s email verification, 2FA, and verification trigger settings. When 2FA is enabled, the current key is returned and must be treated as sensitive information.

Endpoint

GET https://app.dicloak.com/gin/v1/api/request/member/{id}/login-verification

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	An INTERNAL member ID in the current team. EXTERNAL and SUPER_ADMIN are not supported.

Query parameters: None.

Request Body

None.

Request Example

curl --request GET 'https://app.dicloak.com/gin/v1/api/request/member/member_001/login-verification' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A data object on success; may be null on failure.
next	null	Not used by this endpoint.
data.check_email	boolean	Whether email verification is enabled.
data.email	string	Email address for receiving verification codes. Returned only when check_email=true.
data.check_2fa	boolean	Whether 2FA is enabled.
data.secret_2fa	string	Returned only when check_2fa=true. This is an authenticator key, not a one-time verification code.
data.trigger	object	Current verification trigger settings.
data.trigger.mode	string	EVERY_LOGIN / DEVICE_OR_INTERVAL.
data.trigger.interval	integer	Returned only for DEVICE_OR_INTERVAL. Interval: 1–168.
data.trigger.unit	string	Returned only for DEVICE_OR_INTERVAL. HOUR / DAY.
data.trigger.logout_on_timeout	boolean	Returned only for DEVICE_OR_INTERVAL. Whether to log out automatically when the interval expires.

Response header: Cache-Control: no-store.

Success Response Example: Verification Disabled

{  "code": 0,  "msg": "success",  "data": {    "check_email": false,    "check_2fa": false,    "trigger": {      "mode": "EVERY_LOGIN"    }  },  "next": null}

Success Response Example: Email Verification and 2FA Enabled

{  "code": 0,  "msg": "success",  "data": {    "check_email": true,    "email": "alice.verify@example.com",    "check_2fa": true,    "secret_2fa": "<CURRENT_2FA_SECRET>",    "trigger": {      "mode": "DEVICE_OR_INTERVAL",      "interval": 7,      "unit": "DAY",      "logout_on_timeout": false    }  },  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
300001	The member does not exist, has been deleted, or does not belong to the current team.
300162	This login verification endpoint does not support EXTERNAL members.
300206	This endpoint cannot access Super Admin’s security settings.
500000	The request could not be processed.

Error response example:

{  "code": 300162,  "msg": "id must identify an INTERNAL member; login verification is not editable for EXTERNAL members",  "data": null,  "next": null}

15. Update Internal Member Login Verification

Update the verification email address, email verification, 2FA, and verification trigger settings. Omitted top-level fields remain unchanged. If submitted, trigger replaces the entire trigger configuration.

Endpoint

PATCH https://app.dicloak.com/gin/v1/api/request/member/{id}/login-verification

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.
Content-Type	string	Yes	Must be application/json.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	An INTERNAL member ID in the current team. EXTERNAL and SUPER_ADMIN are not supported.

Query parameters: None.

JSON Body Parameters

Submit at least one of email, check_email, check_2fa, or trigger. An empty object is rejected.

Parameter	Type	Required	Description
check_email	boolean	No	Omit to keep unchanged. A valid email must be configured when enabling verification. Null is not allowed.
email	string/null	No	Email address for receiving verification codes, not the login account. Can be updated without a verification code. Cannot be cleared while email verification is enabled.
check_2fa	boolean	No	true enables 2FA; false disables it. Omit to keep unchanged. Null is not allowed. Read the key from secret_2fa in the response; do not submit a key in the request.
trigger	object	No	Omit to keep unchanged. If provided, replaces the entire trigger configuration. Cannot be null.
trigger.mode	string	If trigger is provided	EVERY_LOGIN: verify at each team login. DEVICE_OR_INTERVAL: verify after a device change or when the specified interval has elapsed.
trigger.interval	integer	For DEVICE_OR_INTERVAL	1–168. Must be omitted for EVERY_LOGIN.
trigger.unit	string	For DEVICE_OR_INTERVAL	HOUR / DAY. Must be omitted for EVERY_LOGIN.
trigger.logout_on_timeout	boolean	No	For DEVICE_OR_INTERVAL, defaults to false when omitted. Set true to log out automatically when the interval expires. Must be omitted for EVERY_LOGIN. Cannot be null.

Request Example: Enable Email Verification

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001/login-verification' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "check_email": true,  "email": "alice.verify@example.com",  "trigger": {    "mode": "EVERY_LOGIN"  }}'

Request Example: Enable 2FA with Interval-Based Verification

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001/login-verification' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "check_2fa": true,  "trigger": {    "mode": "DEVICE_OR_INTERVAL",    "interval": 7,    "unit": "DAY",    "logout_on_timeout": false  }}'

Request Example: Update Only the Verification Email

Only the email address for receiving verification codes changes. check_email and the login account remain unchanged.

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001/login-verification' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "email": "new.verify@example.com"}'

Request Example: Disable Email Verification and Clear the Email

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001/login-verification' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "check_email": false,  "email": null}'

Request Example: Disable All Login Verification

curl --request PATCH 'https://app.dicloak.com/gin/v1/api/request/member/member_001/login-verification' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>' \  --header 'Content-Type: application/json' \  --data-raw '{  "check_email": false,  "check_2fa": false}'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A data object on success; may be null on failure.
next	null	Not used by this endpoint.
data.check_email	boolean	Whether email verification is enabled.
data.email	string	Email address for receiving verification codes. Returned only when check_email=true.
data.check_2fa	boolean	Whether 2FA is enabled.
data.secret_2fa	string	Returned only when check_2fa=true. This is an authenticator key, not a one-time verification code.
data.trigger	object	Current verification trigger settings.
data.trigger.mode	string	EVERY_LOGIN / DEVICE_OR_INTERVAL.
data.trigger.interval	integer	Returned only for DEVICE_OR_INTERVAL. Interval: 1–168.
data.trigger.unit	string	Returned only for DEVICE_OR_INTERVAL. HOUR / DAY.
data.trigger.logout_on_timeout	boolean	Returned only for DEVICE_OR_INTERVAL. Whether to log out automatically when the interval expires.

Response header: Cache-Control: no-store. Returns the complete updated login verification settings.

Success Response Example: Enable Email Verification

This example assumes 2FA was disabled before the request.

{  "code": 0,  "msg": "success",  "data": {    "check_email": true,    "email": "alice.verify@example.com",    "check_2fa": false,    "trigger": {      "mode": "EVERY_LOGIN"    }  },  "next": null}

Success Response Example: Enable 2FA with Interval-Based Verification

This example assumes email verification was enabled before the request.

{  "code": 0,  "msg": "success",  "data": {    "check_email": true,    "email": "alice.verify@example.com",    "check_2fa": true,    "secret_2fa": "<CURRENT_2FA_SECRET>",    "trigger": {      "mode": "DEVICE_OR_INTERVAL",      "interval": 7,      "unit": "DAY",      "logout_on_timeout": false    }  },  "next": null}

Success Response Example: Disable All Verification

This example assumes the trigger was EVERY_LOGIN. Disabling verification leaves that trigger setting unchanged.

{  "code": 0,  "msg": "success",  "data": {    "check_email": false,    "check_2fa": false,    "trigger": {      "mode": "EVERY_LOGIN"    }  },  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
400009	Empty request, null in a field that does not allow it, or invalid trigger mode or interval settings.
400017	Email verification is enabled, but the email address is invalid.
300001	The member does not exist or does not belong to the current team.
300162	Login verification management is not supported for external members.
300206	Super Admin cannot be modified.
300099	The request cannot be processed at this time. Please try again later.
500000	The request could not be processed.

Error response example:

{  "code": 400009,  "msg": "trigger.mode is required",  "data": null,  "next": null}

16. Generate and Enable a New 2FA Key

Each successful request returns and immediately enables a new 2FA key. The previous key becomes invalid. No confirmation step is required.

Endpoint

POST https://app.dicloak.com/gin/v1/api/request/member/{id}/totp

Request Headers

Parameter	Type	Required	Description
X-HTTP-KEY	string	Yes	The current team’s HTTP API key.

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	An INTERNAL member ID in the current team. EXTERNAL and SUPER_ADMIN are not supported.

Query parameters: None.

Request Body

None. Do not submit an old key, a new key, or a verification code.

Request Example

curl --request POST 'https://app.dicloak.com/gin/v1/api/request/member/member_001/totp' \  --header 'X-HTTP-KEY: <YOUR_TEAM_HTTP_API_KEY>'

Response Fields

Field	Type	Description
code	integer	0 indicates success; a nonzero value indicates failure.
msg	string	Result message.
data	object/null	A data object on success; may be null on failure.
next	null	Not used by this endpoint.
data.check_2fa	boolean	true on success, indicating that the new key is enabled.
data.secret_2fa	string	The new authenticator key for 2FA. Takes effect immediately.

Response header: Cache-Control: no-store.

Success Response Example

{  "code": 0,  "msg": "success",  "data": {    "check_2fa": true,    "secret_2fa": "<NEW_SERVER_GENERATED_2FA_SECRET>"  },  "next": null}

Common Errors

code	Cause
400003	X-HTTP-KEY is missing or invalid.
300001	The member does not exist or does not belong to the current team.
300162	2FA management is not supported for external members.
300206	Super Admin cannot be modified.
400017	The email address in the currently enabled email verification settings is invalid.
400009	Unable to generate a new 2FA key.
300099	The request cannot be processed at this time. Please try again later.
500000	The request could not be processed.

Error response example:

{  "code": 300162,  "msg": "id must identify an INTERNAL member; login verification is not editable for EXTERNAL members",  "data": null,  "next": null}