# Community

Part of AppEngine API Documentation. Full index: https://appengine.appmint.io/documentation.md
## POST /community/connections/request

**Send a connection request**

`operationId: CommunityController_sendConnectionRequest`

Asks another member to connect. The request is pending until they respond — connecting is mutual, so nothing is visible to either side as a connection until it is accepted.

Self-requests, duplicates and requests to an already-connected member are all refused rather than silently ignored.

#### Signature

```http
POST /community/connections/request (body) -> The pending request
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `400` | SELF_CONNECT | Cannot connect with yourself | `targetId` is the caller. | Pick another member. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `PUT /community/connections/{id}/respond`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

Who to connect with.

```json
{
  "targetId": "MEM-7712",
  "message": "We met at the conference last week."
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The pending request |
| `400` | Cannot connect with yourself — `targetId` is the caller. |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## PUT /community/connections/{id}/respond

**Respond to a connection request**

`operationId: CommunityController_respondToConnection`

Accepts or rejects a request. Only the **recipient** may respond — the sender gets a 403.

#### Signature

```http
PUT /community/connections/{id}/respond (id: string, body) -> The updated connection
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | REQUEST_NOT_FOUND | Connection request not found | No request has that id. | Read the pending list. |
| `403` | NOT_RECIPIENT | Not authorized to respond to this request | The caller is not the recipient. | Only the recipient can accept or reject. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /community/connections/pending`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Connection request id. |

### Request body

The response.

```json
{
  "action": "accept"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The updated connection |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not authorized to respond to this request — The caller is not the recipient. |
| `404` | Connection request not found — No request has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/connections

**List connections**

`operationId: CommunityController_getConnections`

The caller's connections, optionally filtered by status.

#### Signature

```http
GET /community/connections (status?: string, limit?: integer, offset?: integer) -> Connections
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/connections/stats`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `status` | query | string | — |  |
| `limit` | query | integer | — |  |
| `offset` | query | integer | — |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Connections |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/connections/pending

**List pending requests received**

`operationId: CommunityController_getPendingRequests`

Requests waiting on the caller's response — their inbox.

#### Signature

```http
GET /community/connections/pending () -> Pending requests
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/connections/sent`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Pending requests |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/connections/sent

**List pending requests sent**

`operationId: CommunityController_getSentRequests`

Requests the caller has sent that are still unanswered.

#### Signature

```http
GET /community/connections/sent () -> Sent requests
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/connections/pending`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Sent requests |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/connections/stats

**Get connection statistics**

`operationId: CommunityController_getConnectionStats`

Counts of connections, pending requests in and out.

#### Signature

```http
GET /community/connections/stats () -> Statistics
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/connections`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Statistics |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /community/connections/accept-all

**Accept all pending requests**

`operationId: CommunityController_acceptAllRequests`

Accepts every request currently waiting on the caller in one call. Convenient, but indiscriminate — it connects the caller to everyone in the queue, including anyone they would have rejected. Review the pending list first.

#### Signature

```http
POST /community/connections/accept-all () -> What was accepted
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- Accepts everything pending, without review.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/connections/pending`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | What was accepted |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## DELETE /community/connections/{id}

**Remove a connection**

`operationId: CommunityController_removeConnection`

Disconnects from a member, or withdraws a request the caller sent. The connection disappears for both sides.

#### Signature

```http
DELETE /community/connections/{id} (id: string) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | CONNECTION_NOT_FOUND | Connection not found | No connection has that id. | Check the id. |
| `403` | NOT_AUTHORIZED | Not authorized | The caller is not part of the connection. | Only participants can remove it. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /community/blocks`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Connection id. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not authorized — The caller is not part of the connection. |
| `404` | Connection not found — No connection has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /community/messages

**Send a direct message**

`operationId: CommunityController_sendMessage`

Sends a message from the caller to another member. Blocks are enforced here — if either side has blocked the other the send is refused with 403, which is how blocking actually stops contact.

#### Signature

```http
POST /community/messages (body) -> The sent message
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `403` | CANNOT_MESSAGE | Cannot send message to this user | A block exists in either direction, or the recipient restricts messages. | Nothing to retry. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /community/messages/thread/{userId}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The message.

```json
{
  "recipientId": "MEM-7712",
  "content": "Are you free Thursday?"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The sent message |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Cannot send message to this user — A block exists in either direction, or the recipient restricts messages. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/messages/threads

**List conversation threads**

`operationId: CommunityController_getThreads`

The caller's conversations with their most recent message — the messaging inbox.

#### Signature

```http
GET /community/messages/threads (limit?: integer, offset?: integer) -> Threads
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/messages/thread/{userId}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `limit` | query | integer | — |  |
| `offset` | query | integer | — |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Threads |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/messages/thread/{userId}

**Get a conversation**

`operationId: CommunityController_getThread`

Messages exchanged with one member, newest first. `before` pages backwards through history — pass the oldest message's timestamp from the previous page.

#### Signature

```http
GET /community/messages/thread/{userId} (userId: string, limit?: integer, before?: string) -> Messages
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `POST /community/messages/thread/{userId}/read`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `userId` | path | string | yes | The other member. |
| `limit` | query | integer | — |  |
| `before` | query | string | — | Return messages older than this timestamp. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Messages |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /community/messages/read

**Mark messages read**

`operationId: CommunityController_markAsRead`

Marks specific messages as read by id. Use the thread form to clear a whole conversation.

#### Signature

```http
POST /community/messages/read (body) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `POST /community/messages/thread/{userId}/read`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The messages.

```json
{
  "messageIds": [
    "MSG-4820",
    "MSG-4821"
  ]
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /community/messages/thread/{userId}/read

**Mark a conversation read**

`operationId: CommunityController_markThreadAsRead`

Clears the unread state for an entire conversation — what a client calls when the thread is opened.

#### Signature

```http
POST /community/messages/thread/{userId}/read (userId: string) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/messages/unread-count`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `userId` | path | string | yes | The other member. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## DELETE /community/messages/{id}

**Delete a message**

`operationId: CommunityController_deleteMessage`

Deletes one of the caller's own messages. Someone else's message cannot be deleted — that returns 403.

#### Signature

```http
DELETE /community/messages/{id} (id: string) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | MESSAGE_NOT_FOUND | Message not found | No message has that id. | Check the id. |
| `403` | NOT_AUTHORIZED | Not authorized | The message is not the caller's. | Only the sender can delete. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /community/reports`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Message id. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not authorized — The message is not the caller's. |
| `404` | Message not found — No message has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/messages/unread-count

**Get the unread message count**

`operationId: CommunityController_getUnreadCount`

How many unread messages the caller has — the badge count.

#### Signature

```http
GET /community/messages/unread-count () -> The count
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/messages/threads`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The count |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

Example response:

```json
{
  "count": 3
}
```

## GET /community/meetings

**List meetings**

`operationId: CommunityController_getMeetings`

Meetings the caller organises or attends, filterable by status and date range.

#### Signature

```http
GET /community/meetings (status?: string, fromDate?: string, toDate?: string, limit?: integer) -> Meetings
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/meetings/upcoming`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `status` | query | string | — |  |
| `fromDate` | query | string | — |  |
| `toDate` | query | string | — |  |
| `limit` | query | integer | — |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Meetings |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /community/meetings

**Create a meeting**

`operationId: CommunityController_createMeeting`

Schedules a meeting between the caller and one or more participants. The caller becomes the organiser, and only the organiser can later edit it. Give either `endTime` or `duration`; `timezone` matters when participants are in different ones.

#### Signature

```http
POST /community/meetings (body) -> The meeting
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `400` | PARTICIPANT_REQUIRED | At least one participant is required | `participantIds` is empty. | Invite someone. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `PUT /community/meetings/{id}/respond`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The meeting.

```json
{
  "title": "Intro call",
  "participantIds": [
    "MEM-7712"
  ],
  "startTime": "2026-09-03T14:00:00.000Z",
  "duration": 30,
  "locationType": "virtual",
  "meetingLink": "https://meet.example.com/abc"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The meeting |
| `400` | At least one participant is required — `participantIds` is empty. |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/meetings/upcoming

**List upcoming meetings**

`operationId: CommunityController_getUpcomingMeetings`

The caller's next meetings — what a home screen shows.

#### Signature

```http
GET /community/meetings/upcoming (limit?: integer) -> Upcoming meetings
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/meetings`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `limit` | query | integer | — |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Upcoming meetings |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/meetings/{id}

**Get a meeting**

`operationId: CommunityController_getMeeting`

One meeting with its participants and their responses. Only participants may read it.

#### Signature

```http
GET /community/meetings/{id} (id: string) -> The meeting
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | MEETING_NOT_FOUND | Meeting not found | No meeting has that id. | Check the id. |
| `403` | NOT_PARTICIPANT_VIEW | Not authorized to view this meeting | The caller is neither organiser nor participant. | Ask the organiser to invite you. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `PUT /community/meetings/{id}/respond`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Meeting id. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The meeting |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not authorized to view this meeting — The caller is neither organiser nor participant. |
| `404` | Meeting not found — No meeting has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## PUT /community/meetings/{id}

**Update a meeting**

`operationId: CommunityController_updateMeeting`

Changes a meeting's details. **Organiser only** — participants get a 403. Moving the time re-opens the RSVPs, so participants who had accepted need to respond again.

#### Signature

```http
PUT /community/meetings/{id} (id: string, body) -> The updated meeting
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | MEETING_NOT_FOUND | Meeting not found | No meeting has that id. | Check the id. |
| `403` | ORGANIZER_ONLY | Only organizer can update the meeting | The caller is a participant, not the organiser. | Ask the organiser to make the change. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `DELETE /community/meetings/{id}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Meeting id. |

### Request body

Fields to change.

```json
{
  "startTime": "2026-09-03T15:00:00.000Z"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The updated meeting |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Only organizer can update the meeting — The caller is a participant, not the organiser. |
| `404` | Meeting not found — No meeting has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## DELETE /community/meetings/{id}

**Cancel a meeting**

`operationId: CommunityController_cancelMeeting`

Cancels a meeting and notifies its participants. Organiser only. A `reason` is passed on to the participants, so it is worth writing one.

#### Signature

```http
DELETE /community/meetings/{id} (id: string, body) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- Notifies participants.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | MEETING_NOT_FOUND | Meeting not found | No meeting has that id. | Check the id. |
| `403` | NOT_AUTHORIZED_CANCEL | Not authorized to cancel this meeting | The caller is not the organiser. | Only the organiser can cancel. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `PUT /community/meetings/{id}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Meeting id. |

### Request body

Optional reason, shown to participants.

```json
{
  "reason": "Rescheduling to next week"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not authorized to cancel this meeting — The caller is not the organiser. |
| `404` | Meeting not found — No meeting has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## PUT /community/meetings/{id}/respond

**Respond to a meeting invitation**

`operationId: CommunityController_respondToMeeting`

Records the caller's RSVP. Only an invited participant can respond.

#### Signature

```http
PUT /community/meetings/{id}/respond (id: string, body) -> The updated meeting
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | MEETING_NOT_FOUND | Meeting not found | No meeting has that id. | Check the id. |
| `403` | NOT_PARTICIPANT | Not a participant of this meeting | The caller was not invited. | Only invitees can respond. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `PUT /community/meetings/{id}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Meeting id. |

### Request body

The response.

```json
{
  "response": "accepted"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The updated meeting |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not a participant of this meeting — The caller was not invited. |
| `404` | Meeting not found — No meeting has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/blocks

**List blocked members**

`operationId: CommunityController_getBlockedUsers`

Who the caller has blocked. Does not show who has blocked the caller — that is deliberately not disclosed.

#### Signature

```http
GET /community/blocks () -> Blocked members
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `POST /community/blocks`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Blocked members |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /community/blocks

**Block a member**

`operationId: CommunityController_blockUser`

Blocks another member. The block is enforced at the messaging layer in **both** directions — neither side can message the other afterwards, regardless of who blocked whom.

Setting `report: true` files a moderation report at the same time, which is the right choice when the behaviour warrants review rather than only personal avoidance.

#### Signature

```http
POST /community/blocks (body) -> The block
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `DELETE /community/blocks/{userId}`
- `POST /community/reports`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

Who to block.

```json
{
  "blockedId": "MEM-7712",
  "reason": "harassment",
  "report": true,
  "reportDetails": "Repeated unsolicited messages after being asked to stop."
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The block |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## DELETE /community/blocks/{userId}

**Unblock a member**

`operationId: CommunityController_unblockUser`

Lifts a block, allowing contact again. Any report filed alongside the block stands — unblocking does not withdraw it.

#### Signature

```http
DELETE /community/blocks/{userId} (userId: string) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | BLOCK_NOT_FOUND | Block not found | That member is not blocked. | Read the block list. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/blocks`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `userId` | path | string | yes | The blocked member. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `404` | Block not found — That member is not blocked. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /community/reports

**Reports waiting for review**

`operationId: CommunityController_getPendingReports`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` |  |

## POST /community/reports

**Report a member**

`operationId: CommunityController_reportUser`

Files a moderation report against another member. `details` is required and is what a moderator acts on — a report with no substance cannot be assessed.

Reporting does not block: to also stop contact, use `POST /community/blocks` with `report: true`, or block separately.

#### Signature

```http
POST /community/reports (body) -> The report
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- Filing a report does not block the member.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `POST /community/blocks`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The report.

```json
{
  "reportedId": "MEM-7712",
  "reason": "harassment",
  "details": "Sent repeated unsolicited messages after being asked to stop."
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The report |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /community/reports/{id}/review

**Review a report: action_taken or dismissed**

`operationId: CommunityController_reviewReport`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes |  |
| `id` | path | string | yes |  |

### Responses

| Status | Meaning |
| --- | --- |
| `201` |  |

## POST /client/community/connections/request

**Send a connection request**

`operationId: CommunitySocialClientController_sendConnectionRequest`

Asks another member to connect. The request is pending until they respond — connecting is mutual, so nothing is visible to either side as a connection until it is accepted.

Self-requests, duplicates and requests to an already-connected member are all refused rather than silently ignored.

#### Signature

```http
POST /client/community/connections/request (body) -> The pending request
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `400` | SELF_CONNECT | Cannot connect with yourself | `targetId` is the caller. | Pick another member. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `PUT /community/connections/{id}/respond`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

Who to connect with.

```json
{
  "targetId": "MEM-7712",
  "message": "We met at the conference last week."
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The pending request |
| `400` | Cannot connect with yourself — `targetId` is the caller. |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## PUT /client/community/connections/{id}/respond

**Respond to a connection request**

`operationId: CommunitySocialClientController_respondToConnection`

Accepts or rejects a request. Only the **recipient** may respond — the sender gets a 403.

#### Signature

```http
PUT /client/community/connections/{id}/respond (id: string, body) -> The updated connection
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | REQUEST_NOT_FOUND | Connection request not found | No request has that id. | Read the pending list. |
| `403` | NOT_RECIPIENT | Not authorized to respond to this request | The caller is not the recipient. | Only the recipient can accept or reject. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /community/connections/pending`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Connection request id. |

### Request body

The response.

```json
{
  "action": "accept"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The updated connection |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not authorized to respond to this request — The caller is not the recipient. |
| `404` | Connection request not found — No request has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /client/community/connections

**List connections**

`operationId: CommunitySocialClientController_getConnections`

The caller's connections, optionally filtered by status.

#### Signature

```http
GET /client/community/connections (status?: string, limit?: integer, offset?: integer, page?: integer) -> Connections
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/connections/stats`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `status` | query | string | — |  |
| `limit` | query | integer | — |  |
| `offset` | query | integer | — |  |
| `page` | query | integer | — | Page number (1-based). |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Connections |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /client/community/connections/pending

**List pending requests received**

`operationId: CommunitySocialClientController_getPendingRequests`

Requests waiting on the caller's response — their inbox.

#### Signature

```http
GET /client/community/connections/pending (limit?: integer, page?: integer) -> Pending requests
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/connections/sent`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `limit` | query | integer | — |  |
| `page` | query | integer | — | Page number (1-based). |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Pending requests |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /client/community/connections/sent

**List pending requests sent**

`operationId: CommunitySocialClientController_getSentRequests`

Requests the caller has sent that are still unanswered.

#### Signature

```http
GET /client/community/connections/sent (limit?: integer, page?: integer) -> Sent requests
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/connections/pending`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `limit` | query | integer | — |  |
| `page` | query | integer | — | Page number (1-based). |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Sent requests |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /client/community/connections/stats

**Get connection statistics**

`operationId: CommunitySocialClientController_getConnectionStats`

Counts of connections, pending requests in and out.

#### Signature

```http
GET /client/community/connections/stats () -> Statistics
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/connections`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Statistics |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /client/community/connections/accept-all

**Accept all pending requests**

`operationId: CommunitySocialClientController_acceptAllRequests`

Accepts every request currently waiting on the caller in one call. Convenient, but indiscriminate — it connects the caller to everyone in the queue, including anyone they would have rejected. Review the pending list first.

#### Signature

```http
POST /client/community/connections/accept-all () -> What was accepted
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- Accepts everything pending, without review.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/connections/pending`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | What was accepted |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## DELETE /client/community/connections/{id}

**Remove a connection**

`operationId: CommunitySocialClientController_removeConnection`

Disconnects from a member, or withdraws a request the caller sent. The connection disappears for both sides.

#### Signature

```http
DELETE /client/community/connections/{id} (id: string) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | CONNECTION_NOT_FOUND | Connection not found | No connection has that id. | Check the id. |
| `403` | NOT_AUTHORIZED | Not authorized | The caller is not part of the connection. | Only participants can remove it. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /community/blocks`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Connection id. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not authorized — The caller is not part of the connection. |
| `404` | Connection not found — No connection has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /client/community/messages

**Send a direct message**

`operationId: CommunitySocialClientController_sendMessage`

Sends a message from the caller to another member. Blocks are enforced here — if either side has blocked the other the send is refused with 403, which is how blocking actually stops contact.

#### Signature

```http
POST /client/community/messages (body) -> The sent message
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `403` | CANNOT_MESSAGE | Cannot send message to this user | A block exists in either direction, or the recipient restricts messages. | Nothing to retry. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /community/messages/thread/{userId}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The message.

```json
{
  "recipientId": "MEM-7712",
  "content": "Are you free Thursday?"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The sent message |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Cannot send message to this user — A block exists in either direction, or the recipient restricts messages. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /client/community/messages/threads

**List conversation threads**

`operationId: CommunitySocialClientController_getThreads`

The caller's conversations with their most recent message — the messaging inbox.

#### Signature

```http
GET /client/community/messages/threads (limit?: integer, offset?: integer, page?: integer) -> Threads
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/messages/thread/{userId}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `limit` | query | integer | — |  |
| `offset` | query | integer | — |  |
| `page` | query | integer | — | Page number (1-based). |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Threads |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /client/community/messages/thread/{userId}

**Get a conversation**

`operationId: CommunitySocialClientController_getThread`

Messages exchanged with one member, newest first. `before` pages backwards through history — pass the oldest message's timestamp from the previous page.

#### Signature

```http
GET /client/community/messages/thread/{userId} (userId: string, limit?: integer, before?: string, page?: integer) -> Messages
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `POST /community/messages/thread/{userId}/read`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `userId` | path | string | yes | The other member. |
| `limit` | query | integer | — |  |
| `before` | query | string | — | Return messages older than this timestamp. |
| `page` | query | integer | — | Page number (1-based). |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Messages |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /client/community/messages/read

**Mark messages read**

`operationId: CommunitySocialClientController_markAsRead`

Marks specific messages as read by id. Use the thread form to clear a whole conversation.

#### Signature

```http
POST /client/community/messages/read (body) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `POST /community/messages/thread/{userId}/read`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The messages.

```json
{
  "messageIds": [
    "MSG-4820",
    "MSG-4821"
  ]
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /client/community/messages/thread/{userId}/read

**Mark a conversation read**

`operationId: CommunitySocialClientController_markThreadAsRead`

Clears the unread state for an entire conversation — what a client calls when the thread is opened.

#### Signature

```http
POST /client/community/messages/thread/{userId}/read (userId: string) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/messages/unread-count`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `userId` | path | string | yes | The other member. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## DELETE /client/community/messages/{id}

**Delete a message**

`operationId: CommunitySocialClientController_deleteMessage`

Deletes one of the caller's own messages. Someone else's message cannot be deleted — that returns 403.

#### Signature

```http
DELETE /client/community/messages/{id} (id: string) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | MESSAGE_NOT_FOUND | Message not found | No message has that id. | Check the id. |
| `403` | NOT_AUTHORIZED | Not authorized | The message is not the caller's. | Only the sender can delete. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /community/reports`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Message id. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not authorized — The message is not the caller's. |
| `404` | Message not found — No message has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /client/community/messages/unread-count

**Get the unread message count**

`operationId: CommunitySocialClientController_getMessageUnreadCount`

How many unread messages the caller has — the badge count.

#### Signature

```http
GET /client/community/messages/unread-count () -> The count
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/messages/threads`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The count |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

Example response:

```json
{
  "count": 3
}
```

## GET /client/community/meetings

**List meetings**

`operationId: CommunitySocialClientController_getMeetings`

Meetings the caller organises or attends, filterable by status and date range.

#### Signature

```http
GET /client/community/meetings (status?: string, fromDate?: string, toDate?: string, limit?: integer, page?: integer) -> Meetings
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/meetings/upcoming`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `status` | query | string | — |  |
| `fromDate` | query | string | — |  |
| `toDate` | query | string | — |  |
| `limit` | query | integer | — |  |
| `page` | query | integer | — | Page number (1-based). |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Meetings |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /client/community/meetings

**Create a meeting**

`operationId: CommunitySocialClientController_createMeeting`

Schedules a meeting between the caller and one or more participants. The caller becomes the organiser, and only the organiser can later edit it. Give either `endTime` or `duration`; `timezone` matters when participants are in different ones.

#### Signature

```http
POST /client/community/meetings (body) -> The meeting
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `400` | PARTICIPANT_REQUIRED | At least one participant is required | `participantIds` is empty. | Invite someone. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `PUT /community/meetings/{id}/respond`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The meeting.

```json
{
  "title": "Intro call",
  "participantIds": [
    "MEM-7712"
  ],
  "startTime": "2026-09-03T14:00:00.000Z",
  "duration": 30,
  "locationType": "virtual",
  "meetingLink": "https://meet.example.com/abc"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The meeting |
| `400` | At least one participant is required — `participantIds` is empty. |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /client/community/meetings/upcoming

**List upcoming meetings**

`operationId: CommunitySocialClientController_getUpcomingMeetings`

The caller's next meetings — what a home screen shows.

#### Signature

```http
GET /client/community/meetings/upcoming (limit?: integer) -> Upcoming meetings
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/meetings`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `limit` | query | integer | — |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Upcoming meetings |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /client/community/meetings/{id}

**Get a meeting**

`operationId: CommunitySocialClientController_getMeeting`

One meeting with its participants and their responses. Only participants may read it.

#### Signature

```http
GET /client/community/meetings/{id} (id: string) -> The meeting
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | MEETING_NOT_FOUND | Meeting not found | No meeting has that id. | Check the id. |
| `403` | NOT_PARTICIPANT_VIEW | Not authorized to view this meeting | The caller is neither organiser nor participant. | Ask the organiser to invite you. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `PUT /community/meetings/{id}/respond`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Meeting id. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The meeting |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not authorized to view this meeting — The caller is neither organiser nor participant. |
| `404` | Meeting not found — No meeting has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## PUT /client/community/meetings/{id}

**Update a meeting**

`operationId: CommunitySocialClientController_updateMeeting`

Changes a meeting's details. **Organiser only** — participants get a 403. Moving the time re-opens the RSVPs, so participants who had accepted need to respond again.

#### Signature

```http
PUT /client/community/meetings/{id} (id: string, body) -> The updated meeting
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | MEETING_NOT_FOUND | Meeting not found | No meeting has that id. | Check the id. |
| `403` | ORGANIZER_ONLY | Only organizer can update the meeting | The caller is a participant, not the organiser. | Ask the organiser to make the change. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `DELETE /community/meetings/{id}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Meeting id. |

### Request body

Fields to change.

```json
{
  "startTime": "2026-09-03T15:00:00.000Z"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The updated meeting |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Only organizer can update the meeting — The caller is a participant, not the organiser. |
| `404` | Meeting not found — No meeting has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## DELETE /client/community/meetings/{id}

**Cancel a meeting**

`operationId: CommunitySocialClientController_cancelMeeting`

Cancels a meeting and notifies its participants. Organiser only. A `reason` is passed on to the participants, so it is worth writing one.

#### Signature

```http
DELETE /client/community/meetings/{id} (id: string, body) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- Notifies participants.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | MEETING_NOT_FOUND | Meeting not found | No meeting has that id. | Check the id. |
| `403` | NOT_AUTHORIZED_CANCEL | Not authorized to cancel this meeting | The caller is not the organiser. | Only the organiser can cancel. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `PUT /community/meetings/{id}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Meeting id. |

### Request body

Optional reason, shown to participants.

```json
{
  "reason": "Rescheduling to next week"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not authorized to cancel this meeting — The caller is not the organiser. |
| `404` | Meeting not found — No meeting has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## PUT /client/community/meetings/{id}/respond

**Respond to a meeting invitation**

`operationId: CommunitySocialClientController_respondToMeeting`

Records the caller's RSVP. Only an invited participant can respond.

#### Signature

```http
PUT /client/community/meetings/{id}/respond (id: string, body) -> The updated meeting
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | MEETING_NOT_FOUND | Meeting not found | No meeting has that id. | Check the id. |
| `403` | NOT_PARTICIPANT | Not a participant of this meeting | The caller was not invited. | Only invitees can respond. |

Plus the standard platform errors: `429`, `500`.

#### See also

- `PUT /community/meetings/{id}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `id` | path | string | yes | Meeting id. |

### Request body

The response.

```json
{
  "response": "accepted"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The updated meeting |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | Not a participant of this meeting — The caller was not invited. |
| `404` | Meeting not found — No meeting has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /client/community/blocks

**List blocked members**

`operationId: CommunitySocialClientController_getBlockedUsers`

Who the caller has blocked. Does not show who has blocked the caller — that is deliberately not disclosed.

#### Signature

```http
GET /client/community/blocks () -> Blocked members
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `POST /community/blocks`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Blocked members |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /client/community/blocks

**Block a member**

`operationId: CommunitySocialClientController_blockUser`

Blocks another member. The block is enforced at the messaging layer in **both** directions — neither side can message the other afterwards, regardless of who blocked whom.

Setting `report: true` files a moderation report at the same time, which is the right choice when the behaviour warrants review rather than only personal avoidance.

#### Signature

```http
POST /client/community/blocks (body) -> The block
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `DELETE /community/blocks/{userId}`
- `POST /community/reports`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

Who to block.

```json
{
  "blockedId": "MEM-7712",
  "reason": "harassment",
  "report": true,
  "reportDetails": "Repeated unsolicited messages after being asked to stop."
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The block |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## DELETE /client/community/blocks/{userId}

**Unblock a member**

`operationId: CommunitySocialClientController_unblockUser`

Lifts a block, allowing contact again. Any report filed alongside the block stands — unblocking does not withdraw it.

#### Signature

```http
DELETE /client/community/blocks/{userId} (userId: string) -> The result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |
| `404` | BLOCK_NOT_FOUND | Block not found | That member is not blocked. | Read the block list. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `GET /community/blocks`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `userId` | path | string | yes | The blocked member. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The result |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `404` | Block not found — That member is not blocked. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /client/community/reports

**Report a member**

`operationId: CommunitySocialClientController_reportUser`

Files a moderation report against another member. `details` is required and is what a moderator acts on — a report with no substance cannot be assessed.

Reporting does not block: to also stop contact, use `POST /community/blocks` with `report: true`, or block separately.

#### Signature

```http
POST /client/community/reports (body) -> The report
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- Filing a report does not block the member.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `401` | NOT_AUTHENTICATED | Not authenticated | No member could be resolved from the token. | Sign in; these endpoints always act as the caller. |

Plus the standard platform errors: `403`, `429`, `500`.

#### See also

- `POST /community/blocks`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The report.

```json
{
  "reportedId": "MEM-7712",
  "reason": "harassment",
  "details": "Sent repeated unsolicited messages after being asked to stop."
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The report |
| `401` | Not authenticated — No member could be resolved from the token. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |