You and your company

GET/v1/organisation/people

The company's people, each with their role and the shops it covers, as the People page lists them.

What it does

Only when the person who made the key may see People in the app, and only the people that page shows them: a manager of some shops sees the CEO and the people inside their own shops. Read only: a key can never add, change or remove a person or a role. Never an email address or a phone number. A key whose maker may not see People answers 403.

Who may call it

A key whose maker's role holds figures (see the figures), after the fence, for the shop or category it names.

Request

HTTP

GET https://panlytics.net/api/v1/organisation/people

Parameters

Name	In	Type	Required	What it is
`cursor`	query	string	No	The `nextCursor` of the page before. Leave it out for the first page. Treat it as an opaque string.
`limit`	query	integer	No	How many rows on one page: 1 to 200, 50 when left out.
`Authorization`	header	string	Yes	Bearer, a space, then the key.

Example request

curl https://panlytics.net/api/v1/organisation/people \
  -H "Authorization: Bearer $PANLYTICS_KEY"

import os

import requests

response = requests.get(
    "https://panlytics.net/api/v1/organisation/people",
    headers={"Authorization": f"Bearer {os.environ['PANLYTICS_KEY']}"},
    timeout=60,
)
response.raise_for_status()
print(response.json())

const response = await fetch("https://panlytics.net/api/v1/organisation/people", {
  headers: {
    Authorization: `Bearer ${process.env.PANLYTICS_KEY}`,
  },
});
if (!response.ok) throw new Error(`Panlytics answered ${response.status}`);
console.log(await response.json());

Response

200: The answer, as JSON.

Field	Type	Always there	What it is
`data[]`	object[]	Yes	The rows of this page.
`data[].memberId`	integer	Yes	The person's membership id in the company.
`data[].name`	string	Yes	The person's name, or their username when they gave none.
`data[].username`	string	Yes	Their username.
`data[].role`	string	Yes	"CEO", or the name of their role.
`data[].tier`	string: ceo, manager, operator	Yes	ceo, manager or operator.
`data[].scope`	string: all, shops, categories	Yes	What their role covers: every shop, chosen shops, or chosen categories of one shop.
`data[].shopIds[]`	integer[]	Yes	The shops their role names. Empty when it covers every shop.
`data[].categoryIds[]`	integer[]	Yes	The categories their role names, when it covers chosen categories.
`data[].signedInYet`	boolean	Yes	False for a person who was added and has not finished their first sign-in.
`data[].disabled`	boolean	Yes	True when their account is switched off.
`data[].lastActiveAt`	string (ISO 8601) or null	Yes	When they last did or read something, in UTC, or null.
`data[].joinedAt`	string (ISO 8601)	Yes	When they were added to the company, in UTC.
`nextCursor`	string or null	Yes	Send it as `cursor` for the next page. Null on the last page.
`total`	integer	Yes	How many rows the whole list has.

Example response

200

{
  "data": [
    {
      "memberId": 4,
      "name": "Anna Virtanen",
      "username": "anna",
      "role": "Manager",
      "tier": "manager",
      "scope": "shops",
      "shopIds": [
        12
      ],
      "categoryIds": [],
      "signedInYet": true,
      "disabled": false,
      "lastActiveAt": "2026-10-25T09:00:00.000Z",
      "joinedAt": "2026-09-01T08:00:00.000Z"
    }
  ],
  "nextCursor": null,
  "total": 1
}

Errors

A refusal is JSON with a code, a sentence in error, and a requestId when the fault is ours. Read the code, not the sentence. Every code is listed on Errors.

Status	Code	When	What to do
400	`api.invalid`	A path id, a query parameter, a header or a body field is missing or not valid. `detail` names the field.	Read that endpoint in the API reference, correct the field and call again.
401	`api.key_missing`	The call had no Authorization header.	Send the key in the Authorization header as Bearer, then call again.
401	`api.key_refused`	The key is wrong, revoked, past its end, or its maker or company no longer allows it (developer mode off, the maker removed or switched off, or the maker's role lost the developer ability).	Ask the person who gave you the key to make a new one.
401	`api.wrong_key_kind`	This key does not open these endpoints.	Use the key these endpoints were made for, or ask the person who gave you the key.
403	`refused`	The key's maker may not do this here: their role lacks the ability, or the shop or category is outside their reach.	Ask the CEO for a role that allows it, or call it for a shop or category the role reaches.
403	`auth.not_fresh`	This step needs you to prove it is you.	Confirm your password or passkey, then try again.
429	`api.rate_limited`	The key made more than 120 calls in this minute. Wait the seconds in Retry-After.	Wait the seconds in Retry-After, then call again.
500	`server`	Something failed on our side. The answer carries a requestId to quote.	Try again in a minute; if it keeps happening, report it.
503	`developer.unavailable`	API keys are not set up on this deployment yet.	Report it, and we will switch them on.