Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceAccount and accessOrganizations

Record the caller's signed-in browser device

Records the Fingerprint visitor id of the browser a member is signed in from against an existing organization, and checks the device like a sign-in. It covers organizations created automatically at first sign-in, whose creation carries no device. Any member of the org may call it. Under an enforcing device policy, a device that fails the check places the org on a verification hold. It always returns 204 once authorized, including when the body is empty: a browser that blocked the agent must not see an error.

Required permission

Requires the org.signal permission. See Permissions for the roles and API key permissions that include it.

POST
/v1/orgs/{orgId}/device

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Path Parameters

orgId*string

Request Body

application/json
  1. body

Device intelligence the dashboard captured for this action from the Fingerprint JavaScript agent. Both fields are optional and CLIENT-REPORTED: the server records them and never refuses a request because of them or because they are missing, and a browser that blocked the agent must reach the same 204. Send BOTH: the server checks the event id against Fingerprint's Server API, and only a confirmed pair is indexed, clustered, or used to raise a review flag. Anything it cannot confirm is kept as a claim and joins nothing.

deviceFingerprint?string

Fingerprint visitor id, the stable per-device identifier.

Lengthlength <= 128
deviceEventId?string

Fingerprint event id for this identification. It is the half the server verifies with Fingerprint (the visitor id alone cannot be), so a visitor id sent without it is recorded but never clustered.

Lengthlength <= 128

Response Body

Recorded, or ignored when the body carried no device

Example Request
curl -X POST 'https://api.openrelay.inc/v1/orgs/string/device' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
Empty

Revoke a pending invite (owner/admin) DELETE

Deletes the pending invite for an email address so it can no longer be accepted. Returns 204, including when no invite exists; the email match ignores case.

Create an organization (caller becomes owner) POST

Creates an organization owned by the caller and returns its id and the owner role. A custom slug must be unique; one account owns at most five organizations. Requires a signed-in dashboard session token; API keys cannot call this endpoint.