Manage Projects, Members and Invitations From the API and MCP
API tokens and MCP agents can now create, rename and delete projects and invite and remove members, with a separate opt-in permission for each action.
What's changed
- List and read projects with GET /api/v1/projects, create one with POST /api/v1/projects, rename it with PATCH /api/v1/projects/{team} and invite someone by email with POST /api/v1/projects/{team}/invitations; the invitation goes through the usual email acceptance, and you get the same security email as when you invite from the console
- GET /api/v1/projects/{team}/members lists the owner first and then the accepted members with their id, name, email and role, and DELETE /api/v1/projects/{team}/members/{user} removes one; the owner cannot be removed, and the removed member's tokens locked to this project are revoked
- DELETE /api/v1/projects/{team} deletes an empty project: it is refused for a personal project, while any resource or retained data remains (including stopped or deleting resources, retained backups, registry repositories and customer-managed secrets), and while linked billing organizations or unpaid or uninvoiced charges remain; the console's Delete project now makes the same checks and lists what is left
- Each action has its own opt-in permission that existing tokens do not gain: project:read, project:create, project:write, project:invite, project:members:read, project:members:delete and project:delete; a token with all abilities, such as the one danube login creates, includes them
- Creating a project needs an account-wide token; renaming, inviting, removing members and deleting need you to be the project owner; a token locked to one project reaches only that project; and every change needs a verified email and shares a limit of 10 requests a minute per user
- The same operations are MCP tools in the account toolset: projects_list, projects_create, projects_get, projects_update, projects_invitations_create, projects_members_list, projects_members_delete and projects_delete
- MCP agents are now told to call user_teams first and use a returned project ID instead of guessing one, and a call refused for project access says how to pick a valid project