canonical: https://jentic.com/apis/cubic.dev/cubic

# cubic API

The cubic API manages the organizations and members tied to a cubic account. It lists the organizations a key can view, lists and reads the members of an organization, and updates a member by turning their seat on or off or changing their role. A personal key sees everything the key owner can, while a read-only organization key is limited to the read operations.

## For AI agents

List the organizations a key can view, read and list organization members, and update a member by toggling their seat or changing their role.

## Scope

Does not handle code review, repositories, or billing. Use for organization member and seat management only.

## Capabilities

- List the organizations your key can view
- List the members of an organization
- Read a single member by their GitHub user id
- Turn a member's seat on or off
- Change a member's role within the organization

## Use cases

### Agent-driven seat management

An AI agent handling access requests can list an organization's members and turn a member's seat on or off without a human opening the settings page. Because the cubic API addresses each member by their GitHub user id, the agent targets exactly the right person when it updates a seat.

Example prompt: List the members of an organization, then turn off the seat for the member with a given GitHub user id

### Membership and role audit

Reviewing who has access to an organization means reading the current member list and each member's role. The cubic API lists members and reads a single member, so an audit can enumerate the organization and flag anyone whose role is higher than expected. A read-only organization key can run this audit without the ability to change anything.

Example prompt: List the members of an organization and read each member's role to produce an access review

### Role changes on offboarding

When someone leaves a team, their seat and role need updating promptly. The cubic API updates a member to turn off their seat or change their role, so an offboarding workflow can revoke a seat as soon as the trigger fires. The update operation is the only write in the API, which keeps the blast radius small.

Example prompt: Turn off the seat for a departing member identified by their GitHub user id in a given organization

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/api/v1/organizations` | List the organizations the key can view |
| GET | `/api/v1/organizations/{org}/members` | List the members of an organization |
| GET | `/api/v1/organizations/{org}/members/{githubUserId}` | Read a single member |
| PATCH | `/api/v1/organizations/{org}/members/{githubUserId}` | Turn a seat on or off, or change a role |

## Key resources

- **Organizations** — List the organizations a key can view
- **Members** — List members, read a single member, and update a member's seat or role

## AI readiness

This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.

- **Score:** 65 / 100
- **Maturity:** AI-Aware
- **Dimensions:**
  - Foundational Compliance: 100 / 100
  - Developer Experience & Jentic Compatibility: 69 / 100
  - AI-Readiness & Agent Experience: 46 / 100
  - Agent Usability: 94 / 100
  - Security: 60 / 100
  - AI Discoverability: 59 / 100
- **View full report:** https://jentic.com/apis/cubic.dev/cubic/scorecard
- **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/
- **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview

### Score it yourself

Every API in the directory is allowlisted, so you can re-score it with no key required.

- **Score your own API:** https://jentic.com/scorecard.md
- **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md

```sh
npx @jentic/api-scorecard-cli score <openapi-url>
```

## Why Jentic

- **Setup:** Wiring the cubic API by hand means handling its bearer-token auth, the difference between personal (cbk_) and organization (cok_) keys, and the read-only limits on an org key yourself. Through Jentic you install once, import cubic from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** cubic puts the organization id in the URL path (`/api/v1/organizations/{org}/...`), so a rule can pin your agent to one organization and the member operations you pick. You choose the operations it may call, so the member update that toggles a seat or changes a role is not included unless you add it.
- **Credential handling:** Your cubic key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list organization members' or 'change a member's role', and Jentic returns the matching cubic operation with its input schema so the agent calls the right endpoint without reading the reference docs.

## Related APIs

- **Okta** — Okta manages users, groups, and roles across an organization, where cubic manages seats and roles for its own accounts.
- **Auth0** — Auth0 administers users and role assignments for an application, where cubic exposes member and seat operations for its platform.
- **PingOne** — PingOne adds enterprise identity and access governance around the member changes cubic makes.

## FAQ

### What authentication does the cubic API use?

The cubic API authenticates with a bearer token: a personal API key prefixed cbk_ or an organization key prefixed cok_, as declared in its OpenAPI spec. An organization key with read access can call only the GET operations. Through Jentic the key is stored once and injected at call time, so it never appears in your agent's prompt or logs.

### Can a read-only key still change member seats with the cubic API?

No. An organization key with read access can call only the GET operations, so it can list organizations and members and read a single member, but it cannot turn a seat on or off or change a role. A personal key is needed for the update operation.

### What are the rate limits for the cubic API?

The OpenAPI spec does not state numeric rate limits for the cubic API. Check the vendor documentation at https://www.cubic.dev for current limits before running frequent member audits.

### How do I manage members through Jentic with the cubic API?

Search Jentic for 'list organization members', which returns the GET `/api/v1/organizations/{org}/members` operation with its input schema, then call it for a given organization. To run it on your own infrastructure, install Jentic One from its GitHub repo.

### Can I limit what my agent is allowed to do with the cubic API?

Yes. Because cubic puts the organization id in the URL path, write a rule that allows only the member read operations under one organization, so the agent can list members and read roles but cannot toggle a seat or change a role, and every call it makes is logged.