SC Orgs API

Build Discord bots, dashboards and integrations for your org: read its profile, roster, roles, events and RSVPs, and get a signed webhook when someone joins or an op is about to start.

Overview

The API lives at https://api.sc-orgs.space/api/v1. It's JSON over HTTPS, read-only for now, and every call is made with an org API key: a key belongs to one org and acts for the member who created it, never with more than they can do. An org's profile and its public events can be read without a key, for embedding on your org's site.

Quick start

On your org's page, open Manage → API and click Create key. You need the Manage API Keys permission (the owner has it and can give it to other roles). Pick a preset like Discord bot (read), keep the 90-day expiry, and copy the key: it's only shown once.
Check it works: GET /me with the header Authorization: Bearer sco_live_…
Read the roster and the upcoming events: GET /orgs/{org}/members and GET /orgs/{org}/events, where {org} is your org's SID or id.
Add a webhook in Manage → API → Webhooks, click Send test, and verify the signature.

Sandbox

Try the API before making a key: ~SANDBOX is a made-up org in the test realm, with a few members, roles, and upcoming events with RSVPs. Its read-only key is public and shown on this page. Test-realm keys start with sco_test_ and only ever see their own test org.

Keys and scopes

Send the key as Authorization: Bearer sco_live_…. Keys expire (90 days by default, at most 365) and can be rotated with a grace period. A key never exceeds its creator: each scope needs permissions the creator holds, checked when the key is made and again on every request. There is no catch-all scope.

org:read: Member view of the org profile: member count including hidden members, owner, Discord link status
members:read: The roster: handles, avatars, roles, ranks and join dates, including hidden members
roles:read: Role names, ranks, descriptions and Discord role ids (no permission lists)
events:read: The org's events, including members-only ones
rsvps:read: Who signed up for each event (with events:read)

Requests, pagination and errors

Answers are { "data": … }. Lists are paged with page and page_size (1-100, default 25) and include the real total. Times are ISO 8601 UTC, ids are UUIDs. Errors use the same format as the SC Market API.

Rate limits

Per key: 120 requests a minute, bursts of 30
Per org (all its keys together): 600 requests a minute
Anonymous (no key), per IP address: 60 requests a minute, bursts of 20
Invalid keys, per IP address: 20 per 15 minutes, then 429
Webhook test sends, per webhook: 10 an hour

Webhooks

Add up to 10 webhooks per org in Manage → API → Webhooks: an https:// URL, the events you want, and the key the webhook acts with. Deliveries are signed the Standard Webhooks way and retried for up to 24 hours. Event types:

member.joined
member.left
member.roles_updated
event.created
event.updated
event.cancelled
event.starting
ping

Privacy promises

Whatever the scopes, the API never gives out:

Citizen Intel dossiers and reports, HR reviews, documents and onboarding notes, and the answers in applications
Members' live in-game status and location from the companion app
Discord ids (a future opt-in for each member), email addresses, Citizen iD account ids, last activity
Two-factor and session details, notification settings, push subscriptions, site-admin and test-account flags
Who upvoted, and page-view analytics

API reference

The full endpoint reference is the OpenAPI spec at https://api.sc-orgs.space/api/v1/openapi.json (import it into Postman, Insomnia or a code generator).