> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dueflow.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Dueflow API

> Read and write your organization's Dueflow data over HTTPS.

The Dueflow API is a JSON API over HTTPS at `https://api.dueflow.co`. Every
endpoint is versioned under `/v1`.

```bash theme={"system"}
curl https://api.dueflow.co/v1/organization \
  -H "Authorization: Bearer $DUEFLOW_TOKEN"
```

```json theme={"system"}
{
  "id": "fEeIwmrA0SHPFZ3pQnJjR",
  "name": "Phi Kappa Psi National",
  "type": "national",
  "parentId": null,
  "currency": "usd",
  "contactEmail": "nationals@example.org",
  "website": null,
  "logoUrl": null,
  "isActive": true,
  "createdAt": "2026-02-09T04:48:25.813Z",
  "updatedAt": "2026-07-25T17:37:35.482Z"
}
```

Start with [Authentication](/authentication) to get a token, then
[Sync your roster](/guides/sync-your-roster) for a worked end-to-end example.

## What's in v1

| Area                 | Read                                             | Write                                                   |
| -------------------- | ------------------------------------------------ | ------------------------------------------------------- |
| Organization         | `GET /organization`                              | —                                                       |
| Chapters (nationals) | `GET /chapters`, `GET /chapters/:id/members`     | —                                                       |
| Members              | `GET /members`, `GET /members/:id`               | `POST /members`, `PATCH /members/:id`                   |
| Groups               | `GET /groups`, `GET /groups/:id`                 | `POST /groups`, `PATCH /groups/:id`, add/remove members |
| Payments             | `GET /payments`, `GET /payments/:id`             | —                                                       |
| Reimbursements       | `GET /reimbursements`, `GET /reimbursements/:id` | `POST /reimbursements/:id/review`                       |
| Reminders            | `GET /reminders`, `GET /reminders/:id`           | `POST /reminders/:id/send`                              |
| Activity             | `GET /audit-logs`                                | —                                                       |

Payments are read-only in v1: money movement stays in the dashboard, where it
has the confirmation and approval flows an API call can't reproduce.

## What you can access

A token is bound to exactly one organization, and every response is scoped to
it. A national organization can additionally read its direct child chapters
with the `chapters:read` scope.

Member responses deliberately exclude phone numbers, guardian and emergency
contacts, custom fields and internal notes. Payment responses exclude
payment-provider identifiers and raw provider payloads.

## Conventions

* **Errors** share one envelope with a stable `error.code`. See [Errors](/errors).
* **Writes** require an `Idempotency-Key`, so a retry can't apply twice. See
  [Idempotency](/idempotency).
* **Lists** are cursor-paginated and support `updatedSince`. See
  [Pagination and sync](/pagination).
* **Every response** carries an `X-Request-Id`. Include it when you contact
  support — it identifies the exact request in our logs.
* **Timestamps** are RFC 3339 in UTC; monetary amounts are decimal strings
  (`"50.00"`) with the organization's `currency`, never floats.

## Versioning

`/v1` will not change in a way that breaks a working integration. Concretely,
within `v1` we will not remove an endpoint or a response field, add a required
parameter, narrow an accepted value, or require a scope or role that your
existing token doesn't already hold. Every one of those is checked against the
published description on each change to this API, so it can't ship by accident.

What we will do is add: new endpoints, new response fields, new optional
parameters, new scopes. So parse responses leniently and ignore fields you don't
recognize. Anything genuinely incompatible goes in a `/v2`.

If an endpoint is ever retired, it is marked deprecated in the description below
and returns `Deprecation` and `Sunset` headers for at least 180 days before it
stops answering.

The machine-readable description of this version — the same one that generates
this reference — is served by the API itself:

```bash theme={"system"}
curl https://api.dueflow.co/v1/openapi.json
```