anoman
Sign InGet API Key
Documentation home

Managed endusers

Give non-technical staff guarded AI through Copilot — no keys to hand out, spending capped by their member group, on your org's pool.

What an enduser is

Endusers are employees you manage centrally. They have no API key and no dashboard — they use Copilot (copilot.anoman.io) as their whole experience. With enduser routing, their chat spends the org's token pool, capped by their member group's per-member weighted caps and limited to the group's allowed model tiers.

So before you invite anyone, define the member group that will govern which models they reach and how much they can spend.

Invite one or invite in bulk

Invite a single enduser with POST /anoman/v1/accounts/{id}/members, or up to 500 at once with the bulk endpoint. Both are domain-gated by your member-domain allowlist. Bulk returns a per-row skip report — invalid_email, domain_not_allowed, duplicate_in_batch, already_invited, already_member — so you never wonder which addresses were dropped.

Invite one

# Invite one enduser into a member group (domain-gated).
curl https://api.anoman.io/anoman/v1/accounts/acct_9f2b.../members \
  -H "Authorization: Bearer anm-sk-..." \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "group_id": "grp_support" }'

Bulk invite

# Bulk invite up to 500 emails into one group. Returns a per-row skip
# report so you know exactly which addresses were dropped and why.
curl https://api.anoman.io/anoman/v1/accounts/acct_9f2b.../members/bulk \
  -H "Authorization: Bearer anm-sk-..." \
  -H "Content-Type: application/json" \
  -d '{
    "group_id": "grp_support",
    "emails": ["[email protected]", "[email protected]", "[email protected]"]
  }'
 
# 200 OK
# {
#   "invited": 2,
#   "skipped": [
#     { "email": "[email protected]", "reason": "already_member" }
#   ]
# }
# Skip reasons: invalid_email | domain_not_allowed |
#               duplicate_in_batch | already_invited | already_member

Endusers accept the same /invite/{token} flow as staff, then sign into Copilot — no key is ever issued to them.

Manage endusers over time

Admins run the full lifecycle from the API or the Members page: move an enduser to a different group, suspend them (which immediately blocks their completions — a suspended enduser gets 403) and reactivate, reset their password, or remove/offboard them. You can also change a staff member's role with a last-owner guard (an admin can't modify an owner).

Manage endusers

BASE=https://api.anoman.io/anoman/v1/accounts/acct_9f2b...
AUTH="Authorization: Bearer anm-sk-..."
 
# Change an enduser's group (moves their entitlement + caps).
curl -X PATCH "$BASE/members/usr_311.../group" -H "$AUTH" \
  -H "Content-Type: application/json" -d '{ "group_id": "grp_research" }'
 
# Suspend — immediately blocks their completions (a suspended enduser
# gets 403). Reactivate to restore access.
curl -X POST "$BASE/members/usr_311.../suspend"    -H "$AUTH"
curl -X POST "$BASE/members/usr_311.../reactivate" -H "$AUTH"
 
# Reset password (emails a reset link).
curl -X POST "$BASE/members/usr_311.../reset-pw" -H "$AUTH"
 
# Remove / offboard (conversations retained per retention policy).
curl -X DELETE "$BASE/members/usr_311..." -H "$AUTH"
 
# Change a STAFF member's role (last-owner guard; admin can't touch owner).
curl -X PATCH "$BASE/members/usr_990..." -H "$AUTH" \
  -H "Content-Type: application/json" -d '{ "role": "admin_read_only" }'

Offboarding keeps evidence. Removing an enduser blocks access immediately, but their conversations are retained per your retention policy — so audit trails survive the offboard.

Where to manage it

In the dashboard: Members page → Members tab (change role, suspend/reactivate, remove). Auditors (admin_read_only) see the tab read-only.

Onboard your team to Copilot

Invite staff in bulk, cap their spend, and give them guarded AI without a single API key.

On this page