GET	/api/groups
GET	/api/groups/:id
POST	/api/groups
PUT	/api/groups/:id
GET	/api/groups/:id/delete-impact
DELETE	/api/groups/:id
PUT	/api/groups/:id/scope
POST	/api/groups/:id/members
DELETE	/api/groups/:id/members/:userId

List groups

GET/api/groups

Authentication: bearer token.
Permission: groups.view.

curl -X GET "https://shellius.example.com/api/groups" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Get group + members

GET/api/groups/:id

Authentication: bearer token.
Permission: groups.view.

Path parameters

Name	Type	Notes
id	string

curl -X GET "https://shellius.example.com/api/groups/{id}" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Create group

POST/api/groups

Authentication: bearer token.
Permission: groups.manage.

Request body

Name	Type	Required	Notes
name	string	Yes	1–200 characters.
description	string	No	At most 2000 characters. May be null.

curl -X POST "https://shellius.example.com/api/groups" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "…"
  }'

201 Created

{ "success": true, "data": { … } }

Update group

PUT/api/groups/:id

Authentication: bearer token.
Permission: groups.manage.

Path parameters

Name	Type	Notes
id	string

Request body

Name	Type	Required	Notes
name	string	No	1–200 characters.
description	string	No	At most 2000 characters. May be null.

curl -X PUT "https://shellius.example.com/api/groups/{id}" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "…",
    "description": "…"
  }'

200 OK

{ "success": true, "data": { … } }

Preview group delete impact

GET/api/groups/:id/delete-impact

Authentication: bearer token.
Permission: groups.manage.

Path parameters

Name	Type	Notes
id	string

curl -X GET "https://shellius.example.com/api/groups/{id}/delete-impact" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Delete group

DELETE/api/groups/:id

Authentication: bearer token.
Permission: groups.manage.

Path parameters

Name	Type	Notes
id	string

curl -X DELETE "https://shellius.example.com/api/groups/{id}" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }

Scope

PUT/api/groups/:id/scope

Set accessScope + the GroupCustomerScope rows (docs/rbac/customer-scope-spec.md). ALL is a deliberate widening path: every member whose own accessScope is CUSTOMERS becomes unscoped while in this group. CUSTOMERS is additive with each member's own scope, same as before.

Authentication: bearer token.
Permission: users.assign_scope.

Path parameters

Name	Type	Notes
id	string

Request body

Name	Type	Required	Notes
accessScope	string	Yes	One of ALL, CUSTOMERS.
customerIds	array	No	Default [].

curl -X PUT "https://shellius.example.com/api/groups/{id}/scope" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "accessScope": "ALL"
  }'

200 OK

{ "success": true, "data": { … } }

Add member

POST/api/groups/:id/members

Authentication: bearer token.
Permission: groups.manage.

Path parameters

Name	Type	Notes
id	string

Request body

Name	Type	Required	Notes
userId	string	Yes

curl -X POST "https://shellius.example.com/api/groups/{id}/members" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": "…"
  }'

201 Created

{ "success": true, "data": { … } }

Remove member

DELETE/api/groups/:id/members/:userId

Authentication: bearer token.
Permission: groups.manage.

Path parameters

Name	Type	Notes
id	string
userId	string

curl -X DELETE "https://shellius.example.com/api/groups/{id}/members/{userId}" \
  -H "Authorization: Bearer $SHELLIUS_TOKEN"

200 OK

{ "success": true, "data": { … } }