Account

Identity issued by MagnusID. Plan, ToS acceptance state, training opt-out, and link-outs to billing / API keys / agent grants.

Identity

Wire to GET /api/v1/me. Returns the account row + the most recent ToS acceptance (version, IP, user-agent, timestamp).

Plan

Free / Starter / Growth / Business / Enterprise. Change at /billing.

Training opt-out

Per-account toggle. When ON, your samples are excluded from /agent/v1/training-samples exports (returned with redacted: true). Defaults to OFF on signup.

Set via POST /api/v1/signup with trainingOptOut: true.

API keys

Mint a programmatic key (Business+ for live, Starter+ for test). Manage at the API:

POST /api/v1/apikeys
  { "name":"prod", "mode":"live" }

Agent grants

Issue a per-session token to an external agent for read-only or scoped scan access on a specific site allowlist. Time-bounded (max 24h).

POST /api/v1/agent-grants
  { "agentLabel":"my-agent", "siteIds":["…"], "ttlMinutes":60 }

Invites

Bring a teammate onto your account. Roles: viewer / editor / admin. L1 surface only; the membership table ships in L2.

POST /api/v1/invites
  { "email":"colleague@…", "role":"editor" }