Build your agency workspace

Read shared capacity before onboarding

GET /v1/capacity reports the existing agency subscription and total, occupied, reserved and available creator slots. API and portal share them. This is a snapshot, not a reservation: existing CRD checks atomically enforce capacity. Extra seats remain an explicit agency billing action.

Follow impersonation cases

Report a supported impersonation URL with the existing case-report POST. Read the native records using GET /v1/creators/{id}/impersonations and handle impersonation.created, impersonation.updated and impersonation.deleted. These use the same signing, retries and event replay as other webhooks. Initial synchronization can emit created for historical records. Private notes and recipient contacts are excluded.

Display an accurate activity history

GET /v1/creators/{id}/activity lists detections, recorded sends and removals, newest first. Follow its opaque next_cursor. A notice.sent record is not an inbox receipt. leak.status is the current native status with timestamp_basis record_updated; it does not invent an exact historical transition time. Source records do not reconstruct every old status. Preserve future webhook changes in your own integration if you need a full history.

Render and export findings

Cases include domain, favicon_url and stable English status_code alongside the original native status. Group display rows by domain. Fetch every page before reporting a model’s total; one page is not a total count. Favicons use the portal’s Google favicon service: render a fallback if unavailable. Escalation billing follows separate site and mirror-family grouping.

GET /v1/creators/{id}/report returns a CSV page, not JSON. Use response.text(), follow the X-Next-Cursor header as after, and combine all pages for a full report. Maximum 100 rows per page. Records can change while paging; deduplicate by id. Cells are quoted and spreadsheet formulas escaped.

Resend invitations and remove incomplete onboarding

POST /v1/creators/{id}/resend-invitation takes an empty JSON body and Idempotency-Key. It resends an API-created pending or expired invitation using the existing branded email, invalidates the old link and grants seven days. A replay does not send again. One resend per minute and five per 24 hours are allowed; expired reservations must fit current capacity. email_sent means provider acceptance. An uncertain result needs review, not a stream of new keys.

DELETE /v1/creators/{id} cancels a pending API invitation or detaches an accepted creator before onboarding completes. It pauses API protection and retains the user and legal/leak records. Completed creators return creator_onboarding_completed. Accepted creators needing another login link use the existing portal recovery controls. Authorization is never signed or approved by an API key.

Request & response example

curl --request GET 'https://api.crd.systems/v1/capacity' \
  --header "Authorization: Bearer $CRD_API_KEY"

{
  "plan": "growth",
  "subscription_status": "active",
  "protection_eligible": true,
  "total_slots": 25,
  "occupied_slots": 10,
  "reserved_slots": 2,
  "available_slots": 13,
  "overflow_slots": 0,
  "api_included": true,
  "checked_at": "2026-09-25T00:00:00Z"
}

Illustrative response. Replace example resource IDs with the IDs returned by your API requests. View endpoint details.