Embedded identities
Provision partner-managed identities for embedded experiences or redirect login, then assign project or location access by your stable external_user_id.
viewer and editor apply to both embedded and hosted access. admin enables project or location settings and partner-managed user administration after redirect login. Embed sessions never receive admin privileges; an admin grant is capped to editor in the embeddable.identities:manage. Send it as Authorization: Bearer ceyo_platform_... on every request. The key selects the workspace, so paths do not include a workspace identifier. Keep the key on your server.customer/user 42 becomes customer%2Fuser%2042.GETList embedded identities
/embedded-identitiesReturns embedded identities in the workspace selected by the API key, including their direct project and location grants.
List embedded identities
/embedded-identitiesQuery parameters
qstringCase-insensitive search across external_user_id, email, and name.
statusactive | disabledReturn identities in one lifecycle status.
project_idproject UUID | project external IDReturn identities with direct access to this project or one of its locations.
location_idlocation UUID | location external IDReturn identities with direct access to this location. When location_id is an external ID, project_id is required.
roleviewer | editor | adminReturn identities with at least one matching direct project or location grant.
pageintegerThe 1-based page number.
per_pageintegerNumber of identities per page. Minimum: 1; maximum: 100.
Response envelope
embedded_identities:EmbeddedIdentity[],pagination:Pagination}embedded_identitiesEmbeddedIdentity[]Matching identities ordered by creation time newest first.
paginationPaginationPagination metadata.
EmbeddedIdentity
external_user_idstringStable, case-sensitive identifier supplied by your application.
emailstring | nullOptional contact or display email. It is profile data and is not used to sign in.
namestring | nullOptional display name.
avatar_urlstring | nullOptional absolute HTTPS URL for a display avatar.
metadataobjectPartner-defined JSON object. Values are returned as supplied and must not contain credentials or secrets.
statusactive | disabledActive identities can receive access and use embed sessions or redirect login. Disabling an identity revokes active access sessions and pending login links.
project_accessProjectAccess[]Direct project grants for the identity.
location_accessLocationAccess[]Direct location grants for the identity.
created_atdatetimeIdentity creation time in ISO 8601 format.
updated_atdatetimeTime the identity profile or status was most recently updated, in ISO 8601 format.
ProjectAccess
project_iduuidCeyo UUID of the granted project.
roleviewer | editor | adminRole granted across the project and all of its locations.
granted_atdatetimeTime the direct project grant was first created, in ISO 8601 format.
LocationAccess
project_iduuidCeyo UUID of the project containing the location.
location_iduuidCeyo UUID of the granted location.
roleviewer | editor | adminRole granted for this location.
granted_atdatetimeTime the direct location grant was first created, in ISO 8601 format.
Pagination
pageintegerCurrent 1-based page.
per_pageintegerNumber of identities requested per page.
totalintegerTotal identities matching the request.
total_pagesintegerTotal available pages.
project_id matches direct project grants and direct grants for locations in that project. location_id matches direct location grants only. Combine filters to narrow the same result set; an identity must satisfy every supplied filter.Request and response
curl --request GET \
--url 'https://api.signal.ceyo.ai/v1/embedded-identities?q=avery&status=active&project_id=e6c96c98-d777-40e0-94ec-48931f57782f&role=viewer&page=1&per_page=25' \
--header 'Authorization: Bearer ceyo_platform_...'{
"embedded_identities": [
{
"external_user_id": "customer-user-4821",
"email": "avery.quinn@example.com",
"name": "Avery Quinn",
"avatar_url": "https://cdn.example.com/avatars/customer-user-4821.png",
"metadata": {
"account_tier": "enterprise",
"region": "emea"
},
"status": "active",
"project_access": [
{
"project_id": "e6c96c98-d777-40e0-94ec-48931f57782f",
"role": "editor",
"granted_at": "2026-07-31T09:30:00Z"
}
],
"location_access": [
{
"project_id": "e6c96c98-d777-40e0-94ec-48931f57782f",
"location_id": "a1308d14-149c-4dd7-a4c5-295ac9090f58",
"role": "viewer",
"granted_at": "2026-07-31T09:35:00Z"
}
],
"created_at": "2026-07-31T09:20:00Z",
"updated_at": "2026-07-31T09:35:00Z"
}
],
"pagination": {
"page": 1,
"per_page": 25,
"total": 1,
"total_pages": 1
}
}ErrorsResponse format and status codes+
Error response envelope
errorErrorStructured error payload.
Error
codestringStable snake_case code suitable for programmatic handling.
messagestringHuman-readable explanation of the failure.
detailsobject | array | nullStructured validation or request context when available.
request_idstringIdentifier to provide when requesting support.
{
"error": {
"code": "invalid_api_key",
"message": "The Bearer API key is invalid.",
"details": null,
"request_id": "req_01K1F8M7QX4R2V9N6Y3Z0A5BCT"
}
}Status codes
400invalid_requestA path value, query parameter, or JSON body is malformed.
401invalid_api_keyThe Bearer API key is absent or invalid.
403forbiddenThe API key cannot perform this operation.
422validation_failedOne or more fields are invalid, the role is unsupported, or the location does not belong to the selected project.
429rate_limit_exceededToo many requests were made.
POSTUpsert embedded identity
/embedded-identities/{external_user_id}Creates an embedded identity for external_user_id or updates the supplied profile fields on the existing identity.
Upsert embedded identity
/embedded-identities/{external_user_id}Path parameters
external_user_idstringYour stable, case-sensitive identifier for the embedded identity. URL-encode the value before placing it in the path.
Request body
emailstring | nullOptional valid email address. Send null to clear it. The address is profile data only.
namestring | nullOptional display name, up to 200 characters. Send null to clear it.
avatar_urlstring | nullOptional absolute HTTPS avatar URL, up to 2,048 characters. Send null to clear it.
metadataobjectOptional partner-defined JSON object. When supplied, it replaces the complete metadata object; send {} to clear it.
statusactive | disabledOptional lifecycle status. New identities default to active.
201 Created; existing identities return 200 OK. Omitted fields stay unchanged on an existing identity and use their documented defaults on creation. The path value cannot be changed.status to disabled preserves project and location grants while preventing new embedded sessions and revoking active embedded sessions. Set it back to active before minting another session.Response envelope
embedded_identity:EmbeddedIdentity}The requested or resulting embedded identity.
EmbeddedIdentity
external_user_idstringStable, case-sensitive identifier supplied by your application.
emailstring | nullOptional contact or display email. It is profile data and is not used to sign in.
namestring | nullOptional display name.
avatar_urlstring | nullOptional absolute HTTPS URL for a display avatar.
metadataobjectPartner-defined JSON object. Values are returned as supplied and must not contain credentials or secrets.
statusactive | disabledActive identities can receive access and use embed sessions or redirect login. Disabling an identity revokes active access sessions and pending login links.
project_accessProjectAccess[]Direct project grants for the identity.
location_accessLocationAccess[]Direct location grants for the identity.
created_atdatetimeIdentity creation time in ISO 8601 format.
updated_atdatetimeTime the identity profile or status was most recently updated, in ISO 8601 format.
ProjectAccess
project_iduuidCeyo UUID of the granted project.
roleviewer | editor | adminRole granted across the project and all of its locations.
granted_atdatetimeTime the direct project grant was first created, in ISO 8601 format.
LocationAccess
project_iduuidCeyo UUID of the project containing the location.
location_iduuidCeyo UUID of the granted location.
roleviewer | editor | adminRole granted for this location.
granted_atdatetimeTime the direct location grant was first created, in ISO 8601 format.
Request and response
curl --request POST \
--url 'https://api.signal.ceyo.ai/v1/embedded-identities/customer-user-4821' \
--header 'Authorization: Bearer ceyo_platform_...' \
--header 'Content-Type: application/json' \
--data '{
"email": "avery.quinn@example.com",
"name": "Avery Quinn",
"avatar_url": "https://cdn.example.com/avatars/customer-user-4821.png",
"metadata": {
"account_tier": "enterprise",
"region": "emea"
},
"status": "active"
}'HTTP/1.1 201 Created
{
"embedded_identity": {
"external_user_id": "customer-user-4821",
"email": "avery.quinn@example.com",
"name": "Avery Quinn",
"avatar_url": "https://cdn.example.com/avatars/customer-user-4821.png",
"metadata": {
"account_tier": "enterprise",
"region": "emea"
},
"status": "active",
"project_access": [],
"location_access": [],
"created_at": "2026-07-31T09:20:00Z",
"updated_at": "2026-07-31T09:20:00Z"
}
}ErrorsResponse format and status codes+
Error response envelope
errorErrorStructured error payload.
Error
codestringStable snake_case code suitable for programmatic handling.
messagestringHuman-readable explanation of the failure.
detailsobject | array | nullStructured validation or request context when available.
request_idstringIdentifier to provide when requesting support.
{
"error": {
"code": "invalid_api_key",
"message": "The Bearer API key is invalid.",
"details": null,
"request_id": "req_01K1F8M7QX4R2V9N6Y3Z0A5BCT"
}
}Status codes
400invalid_requestA path value, query parameter, or JSON body is malformed.
401invalid_api_keyThe Bearer API key is absent or invalid.
403forbiddenThe API key cannot perform this operation.
409conflictThe requested change conflicts with the current identity or resource state.
422validation_failedOne or more fields are invalid, the role is unsupported, or the location does not belong to the selected project.
429rate_limit_exceededToo many requests were made.
GETGet embedded identity
/embedded-identities/{external_user_id}Returns one embedded identity and all of its direct project and location grants.
Get embedded identity
/embedded-identities/{external_user_id}Path parameters
external_user_idstringYour stable, case-sensitive identifier for the embedded identity. URL-encode the value before placing it in the path.
Response envelope
embedded_identity:EmbeddedIdentity}The requested or resulting embedded identity.
EmbeddedIdentity
external_user_idstringStable, case-sensitive identifier supplied by your application.
emailstring | nullOptional contact or display email. It is profile data and is not used to sign in.
namestring | nullOptional display name.
avatar_urlstring | nullOptional absolute HTTPS URL for a display avatar.
metadataobjectPartner-defined JSON object. Values are returned as supplied and must not contain credentials or secrets.
statusactive | disabledActive identities can receive access and use embed sessions or redirect login. Disabling an identity revokes active access sessions and pending login links.
project_accessProjectAccess[]Direct project grants for the identity.
location_accessLocationAccess[]Direct location grants for the identity.
created_atdatetimeIdentity creation time in ISO 8601 format.
updated_atdatetimeTime the identity profile or status was most recently updated, in ISO 8601 format.
ProjectAccess
project_iduuidCeyo UUID of the granted project.
roleviewer | editor | adminRole granted across the project and all of its locations.
granted_atdatetimeTime the direct project grant was first created, in ISO 8601 format.
LocationAccess
project_iduuidCeyo UUID of the project containing the location.
location_iduuidCeyo UUID of the granted location.
roleviewer | editor | adminRole granted for this location.
granted_atdatetimeTime the direct location grant was first created, in ISO 8601 format.
Request and response
curl --request GET \
--url 'https://api.signal.ceyo.ai/v1/embedded-identities/customer-user-4821' \
--header 'Authorization: Bearer ceyo_platform_...'{
"embedded_identity": {
"external_user_id": "customer-user-4821",
"email": "avery.quinn@example.com",
"name": "Avery Quinn",
"avatar_url": "https://cdn.example.com/avatars/customer-user-4821.png",
"metadata": {
"account_tier": "enterprise",
"region": "emea"
},
"status": "active",
"project_access": [
{
"project_id": "e6c96c98-d777-40e0-94ec-48931f57782f",
"role": "editor",
"granted_at": "2026-07-31T09:30:00Z"
}
],
"location_access": [
{
"project_id": "e6c96c98-d777-40e0-94ec-48931f57782f",
"location_id": "a1308d14-149c-4dd7-a4c5-295ac9090f58",
"role": "viewer",
"granted_at": "2026-07-31T09:35:00Z"
}
],
"created_at": "2026-07-31T09:20:00Z",
"updated_at": "2026-07-31T09:35:00Z"
}
}ErrorsResponse format and status codes+
Error response envelope
errorErrorStructured error payload.
Error
codestringStable snake_case code suitable for programmatic handling.
messagestringHuman-readable explanation of the failure.
detailsobject | array | nullStructured validation or request context when available.
request_idstringIdentifier to provide when requesting support.
{
"error": {
"code": "invalid_api_key",
"message": "The Bearer API key is invalid.",
"details": null,
"request_id": "req_01K1F8M7QX4R2V9N6Y3Z0A5BCT"
}
}Status codes
400invalid_requestA path value, query parameter, or JSON body is malformed.
401invalid_api_keyThe Bearer API key is absent or invalid.
403forbiddenThe API key cannot perform this operation.
404embedded_identity_not_foundNo embedded identity has the supplied external_user_id in this workspace.
429rate_limit_exceededToo many requests were made.
DELETEDelete embedded identity
/embedded-identities/{external_user_id}Permanently deletes an embedded identity and removes every direct project and location grant assigned to it.
Delete embedded identity
/embedded-identities/{external_user_id}Path parameters
external_user_idstringYour stable, case-sensitive identifier for the embedded identity. URL-encode the value before placing it in the path.
204 No Content. Project and location resources are unchanged, but every access grant for this identity is removed. Active embedded sessions are revoked, and subsequent session creation or identity lookup fails until you upsert the external_user_id again.external_user_id after deletion creates a new identity with no project or location access. Grant each required scope again before minting a session.Request and response
curl --request DELETE \
--url 'https://api.signal.ceyo.ai/v1/embedded-identities/customer-user-4821' \
--header 'Authorization: Bearer ceyo_platform_...'HTTP/1.1 204 No ContentErrorsResponse format and status codes+
Error response envelope
errorErrorStructured error payload.
Error
codestringStable snake_case code suitable for programmatic handling.
messagestringHuman-readable explanation of the failure.
detailsobject | array | nullStructured validation or request context when available.
request_idstringIdentifier to provide when requesting support.
{
"error": {
"code": "invalid_api_key",
"message": "The Bearer API key is invalid.",
"details": null,
"request_id": "req_01K1F8M7QX4R2V9N6Y3Z0A5BCT"
}
}Status codes
400invalid_requestA path value, query parameter, or JSON body is malformed.
401invalid_api_keyThe Bearer API key is absent or invalid.
403forbiddenThe API key cannot perform this operation.
404embedded_identity_not_foundNo embedded identity has the supplied external_user_id in this workspace.
409conflictThe requested change conflicts with the current identity or resource state.
429rate_limit_exceededToo many requests were made.