GET /v1/sites/{siteId}/collaborators

Authentication

Send an API key as a bearer token. The endpoint checks sites.collaborators.manage; a key without it is refused with 403, not 404.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X GET https://api.zinndigital.com/v1/sites/{siteId}/collaborators \
  -H "Authorization: Bearer zdk_live_…"

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

Per-site collaborators — one person's access to ONE site, rather than to the whole organisation. Every grant on this site, newest first, live and lapsed alike: a revoked grant is kept because "who could reach this site in March" is the question an incident asks, and a deleted row cannot answer it. ⛔ Read and write share the sites.collaborators.manage permission. The list is the access-control state of the site — who else is in it, at what level, and why — and that is an account owner's business rather than a developer's. Among the customer roles only owner holds the key; dev deliberately does not, because a developer who could grant site access could grant it to themselves on a site they were never given. A site outside the caller's scope, and a site they can see but may not administer, both answer 404. Same code, two reasons: a 403 on the second would tell a developer that a collaborator list exists on their client's site, and a 403 on the first is an existence oracle.

Parameters

Response

Errors this endpoint can return

401 · 403 · 404 · 429