Non-profits · Team settings
A non-profit's own team, under /org-admin/{slug}: the page, links, programs, the team, verification.
Needs your attention
org.read, built for the caller. Counts from the same reads as the surfaces they point at (0 included): join_requests and invites_waiting (the team view's lists; an expired invite waits to be resent), stripe_requirements, registry_renewal (within 30 days, with due), check_failed (the verification view's latest checks), authority_pending. fundly_approvals joins in phase 2. Plus the month-so-far card over the org's own Fundlies' counted gifts (label is the ISO month, e.g. 2026-10).
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Responses
OK
Read editable nonprofit settings
Requires org.update_settings. Returns the scoped nonprofit's editable page fields, private contact and mailing address, receipt preferences, and general fund preferences.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Responses
OK
Edit the page
org.update_settings. The page fields; legal_name and ein are refused (422 locked). A city change applies to Fundlies launched afterwards. Audited as organization.nonprofit_settings_updated; no event.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Request Body
Responses
OK
The page's links, for editing
org.update_settings. Flagged rows and 30-day clicks included.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Responses
OK
Replace the page's links
org.update_settings. The ordered list replaces the live one (a row with its id keeps it and its clicks). Normalized, deduped, at most 8, Web Risk on save; a staff-removed URL cannot come back. Mirrors the six fixed keys of social_links. Audited as organization.links_updated; no event.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Request Body
Responses
OK
The page's programs
org.update_settings.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Responses
OK
Replace the page's programs
org.update_settings. The ordered list, up to 12; a row with its id keeps it. Audited as organization.programs_updated.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Request Body
Responses
OK
The team
org.read. Emails, invites and join requests only for managers.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Responses
OK
Invite people to the team
nonprofit.team.manage. Up to 20 emails; each gets the org_invite email (link /nonprofits/invite/{token}, 30 days). Nobody grants above their own role. Audited as organization.invite_sent.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Request Body
Responses
OK
Resend an invite
nonprofit.team.manage. A new token and 30 days; 5 sends at most.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
The invite id.
"uuid"Responses
OK
Cancel an invite
nonprofit.team.manage. Idempotent.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
The invite id.
"uuid"Responses
Done
Approve a join request
nonprofit.team.manage. The person joins with the role and title and is emailed.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
The request id.
"uuid"Request Body
Responses
OK
Decline a join request
nonprofit.team.manage.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
The request id.
"uuid"Responses
Done
Transfer ownership
The owner only, to one of the admins; the old owner becomes an admin. Audited as organization.ownership_transferred.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Request Body
Responses
OK
Verification and tax status
org.read. The latest check per source, the documents (W-9 and bank documents only with org.upload_documents), the IRS record and how authority was shown.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Responses
OK
Run every check now
org.update_settings. At most once an hour (else 429 too_soon). Answers as GET.
Authorizations
In the browser, authentication rides on the httpOnly session cookies set by /cognito/signin or the Google / Apple sign-in at /cognito/oauth/{provider}. For scripts and for Swagger UI testing, paste an API key (fh_live_…, created with POST /api-keys); a Cognito JWT is accepted too. Sign-in does not return a token in its body.
Parameters
Path Parameters
The organization's slug (requireOrgPermission resolves it).
Responses
OK