Access review providers listing

[aureliensibiril]

Access review providers listing
===== BODY =====

Access-Review Provider Status & Roadmap

Index tracking access-review connectors: shipped, in progress, and on the roadmap.

Auth strategy: when a provider offers both an OAuth2 (partner) path and an API-key path, prefer OAuth2 — even when it requires going through the vendor's partner / marketplace program. The one-click customer install UX (redirect → approve → done) outweighs the upfront Probo-side onboarding cost. API-key path is the fallback.

Legend

Symbol	Meaning
✅	Implemented on main
🚧	In progress
🟢 Tier 1	Highest priority — high demand AND tractable auth
🟡 Tier 2	High value, medium friction (partner-review, per-tenant URL, mgmt-account, etc.)
🟠 Tier 3	Lower priority, narrower customer base or constrained API
🔴 Tier X	Not viable today (no admin API, deprecated, architectural mismatch)
★	High demand
🛂	Hard vendor approval required before customers can install at scale (marketplace listing / partner program / security review)
🔀	Hard approval bypassable via customer-supplied OAuth app pattern (customer registers their own client_id/secret in their vendor tenant)
🔁	Annual re-verification required

See the OAuth2 vendor-approval matrix section for the per-provider approval breakdown.

Conn. = connection method:

• OAuth2 = full auth-code flow third parties can offer
• OAuth2 CC = client-credentials (per-tenant — no install flow we control)
• Admin API key = customer mints a static key in vendor admin console
• SCIM = SCIM 2.0 bearer token (typically gated behind SSO/Enterprise plans)
• Cross-account role = AWS-style AssumeRole with ExternalId

---

🎯 Recommended implementation order — customer-demand-driven (2026-05)

Ranking derived from production vendor-occurrence data across the customer base (two snapshots, ~825 distinct vendor names). Excluded from the ranking: pentest/test artifacts, databases & libraries (Redis, Pinecone, Neo4j, npm, LangChain, Playwright…), raw model-inference APIs (Gemini, Perplexity, Cerebras, Lambda Labs…), data/IP feeds, and consumer apps — none expose reviewable human seat-holders. Demand = combined occurrence count across both snapshots (proxy for how many customers run it).

Source legend: ✅ shipped · ⬜ already on the roadmap below · 🆕 surfaced by this data, researched 2026-05 (detail table follows) · ✏️ corrects a prior entry. Symbols 🛂 / 🔀 as in the top legend.

🔥 Customer-validated priority bump (2026-07) — Hexa portfolio inventory

A live customer third-party inventory (~56 vendors, Hexa / ex-eFounders portfolio) was swept against shipped + roadmap on 2026-07-09. The connectors below appear in that real inventory and are priority-bumped on named customer demand. Net-new vendors (🆕) were researched and adversarially cross-verified (live vendor docs + Codex/GPT-5); full per-vendor findings in the 2026-07 sweep comment. 🔥 = customer-requested this cycle.

Vendor	Tier	Src	Conn.	Member endpoint
🔥 ★ Google Analytics (GA4)	1	🆕	OAuth2	GET analyticsadmin…/v1alpha/{accounts|properties}/accessBindings
🔥 Dotfile	1	🆕	API key	GET /v1/users
🔥 Segment (Twilio)	1	🆕✏️	API key	GET /users (+ /users/{id} for roles)
🔥 ★ Figma	1 🛂	⬜	OAuth2	/v1/teams/{id}/members
🔥 Revolut Business	1 🔀	⬜	OAuth2 CC	GET /api/1.0/team-members
🔥 ★ AWS IAM	1	⬜	Cross-account role	iam.ListUsers
🔥 ★ GCP (org/project IAM)	1	⬜	SA key / WIF	getIamPolicy
🔥 Square (Squareup)	2	🆕	OAuth2 / PAT	POST /v2/team-members/search
🔥 Odoo	2	🆕	API key	XML-RPC / JSON-2 res.users.search_read
🔥 Typeform	2	🆕	OAuth2	iterate GET /workspaces/{id} members[]
🔥 Qonto	2 🛂	⬜	OAuth2	GET /v2/memberships
🔥 Airtable	2	⬜	OAuth2 / PAT	enterprise users
🔥 Forest Admin	3	🆕	SCIM	GET /scim/v2/Users (Enterprise)
🔥 Replit	3	🆕	SCIM	GET /scim/v2/Users (Enterprise)
🔥 Lovable	3	🆕	SCIM	GET /scim/v2/Users (Enterprise + SSO)
🔥 Courier	3	🆕	SCIM	GET {scim_base}/Users (Enterprise)
🔥 Front	3	⬜	OAuth2	/teammates
🔥 Webflow	3	⬜	SCIM	/scim/v2/Users (Enterprise + SSO)

Also in the same customer inventory but not viable (no member-list API / defunct / individual product) — do not schedule: Mobbin, Claap, Phacet, TipTap Cloud, GetStream, Postmark, Prismy, INPI (Guichet Unique), Banking Circle, iBanFirst, Fundcraft, June, Cycle, Tandem, Logo.dev, Abstract API, Teledec, Leanear · re-verified Tier X: Wise, WorkOS, Pennylane. Per-vendor reasons in the 2026-07 sweep comment.

Build order — viable targets not yet shipped (demand ≥ 8)

#	Vendor	Demand	Src	Tier	Auth path to the member list
1	AWS IAM	193	⬜	1	Cross-account role + ExternalId
2	Stripe	110	⬜	2	SCIM 2.0 (Enterprise + SSO)
3	GCP (org/project IAM)	95	⬜	1	SA key / WIF + getIamPolicy
4	Figma	60	⬜	1 🛂	OAuth2 → /v1/teams/{id}/members
5	Rippling	49	⬜	1	OAuth2 → /platform/api/employees
6	SendGrid (Twilio)	49	🆕	1	API key → GET /v3/teammates
7	Attio	48	🆕	1 🔀	OAuth2 → GET /v2/workspace_members
8	MongoDB Atlas	46	⬜	3	API key (Digest) → /v2/orgs/{id}/users
9	Azure (RBAC + Entra)	43	⬜	2	App reg + client secret
10	Better Stack	36	🆕	1	API token → GET /api/v2/team-members
11	Mercury	33	🆕✏️	1 (was X)	API token → GET /api/v1/users (roles incl. administrator)
12	PayFit	32	🆕	2 🛂	OAuth2 partner → /companies/{id}/collaborators
13	Deel	30	⬜ (reverted)	2	OAuth2 (see reverted note)
14	Langfuse	28	🆕	1	API key + SCIM → /api/public/organizations/memberships
15	Atlassian Cloud	26	⬜	1 🔀	OAuth 3LO + Org Admin API
16	Clerk	26	⬜	2	Backend secret key → /v1/organizations/{id}/memberships
17	Apollo.io	25	🆕	1	Master API key → GET /api/v1/users/search
19	Grafana Cloud	25	⬜	2	OAuth / SA token → /api/org/users
20	OVHcloud	25	🆕	2	OAuth2 CC (self-serve) → GET /me/identity/user · regional host
21	Auth0	24	⬜	1 🔀	OAuth2 CC → /api/v2/users
22	Bitwarden	20	⬜	2	OAuth2 CC → GET /public/members
24	Airtable	19	⬜	2	OAuth2 / PAT → enterprise users
25	ClickHouse Cloud	18	🆕	1	API key (Basic) → GET /v1/organizations/{id}/members
26	Deepgram	17	🆕	1	API key → GET /v1/projects/{id}/members
27	Zoom	17	⬜	1 🛂	OAuth2 → /v2/users
28	ElevenLabs	16	🆕	2	API key (via groups) / SCIM enterprise
29	Scaleway	16	🆕	1	API key → GET /iam/v1alpha1/users
30	Pylon	14	🆕	1	API key → GET /users
31	Cal.com	13	🆕	1 🔀	API key / OAuth CC → /v2/organizations/{id}/memberships
32	New Relic	13	⬜	2	NerdGraph + API key
33	Tailscale	13	⬜	3	OAuth2 CC → /api/v2/tailnet/{tailnet}/users
34	Railway	12	🆕	1	Account/team token → GraphQL team{ members }
35	OpenRouter	12	🆕	1	Mgmt key → GET /api/v1/organization/members
36	Yousign	12	🆕	1	API key → GET /v3/users · sandbox/prod hosts
37	Webflow	12	🆕	3	SCIM (Enterprise Workspace + SSO)
38	Elastic Cloud	11	⬜	2	OAuth / key → /organizations/{org}/members
39	Front	11	⬜	3	OAuth2 → /teammates
40	Trello	11	⬜	3	API key + token → org members
41	Dropbox Business	10	⬜	1	OAuth2 → /2/team/members/list_v2
42	Customer.io	10	🆕	3	SCIM (Premium/Enterprise)
43	Zapier	10	🆕	3	SCIM (Team/Enterprise)
44	Qonto	10	🆕	2 🛂	OAuth2 → GET /v2/memberships
45	incident.io	9	🆕	1	API key → GET /v2/users
46	Brevo	9	🆕	1	API key → GET /v3/organization/invited/users
47	Revolut Business	9	🆕	1 🔀	OAuth2 CC (cert/JWT) → GET /api/1.0/team-members
48	Crisp	9	🆕	1	Token → GET /v1/website/{id}/operators
49	Infisical	9	🆕	2	Client-credentials → /api/v2/organizations/{id}/memberships
50	Snyk	8	⬜ (reverted)	1	OAuth2 (see reverted note)

Below demand 8, viable newly-researched vendors (Retool, Calendly, Nmbrs, Postman, Spendesk, W&B, Canva, SonarCloud, Braintrust, Twingate) are in the detail table below; lower-demand roadmap items keep their existing tier.

Re-tier callout: Anthropic — platform.claude.com (demand 168) shipped 2026-05-28 (PR #1256, self-serve admin-key path). Cursor (128) and Mercury (33, corrected) are now the biggest net-new wins.

🆕 Newly researched vendors (2026-05) — full assessment

Surfaced by the customer data and not previously in this issue. Researched against current vendor docs for a human-member-list endpoint, OAuth2 availability, and partner-program gating. Endpoints/auth cited from primary docs.

Vendor	Demand	Viable?	Member endpoint	Auth	Partner gate	Per-tenant URL	Notes
Cursor	128	✅ T1	GET /teams/members	Admin API key (Basic)	n/a (key)	no	Team-admin key; returns role.
SendGrid	49	✅ T1	GET /v3/teammates	API key	n/a (key)	no (US/EU region)	Teammates = dashboard seats, not contacts.
Attio	48	✅ T1	GET /v2/workspace_members	OAuth2 (user_management:read) / key	🔀 bypassable	no	Multi-workspace needs publication; own/customer app fine.
Mintlify	42	❌ X	—	API key	—	no	API covers deploys/analytics only; no member endpoint.
Better Stack	36	✅ T1	GET /api/v2/team-members	API token	n/a (key)	no	Includes pending invites + roles.
Mercury	33	✅ T1 ✏️	GET /api/v1/users	API token (+OAuth2)	None	no	Corrects prior Tier X. Returns organizationRole.
PayFit	32	⚠️ T2	GET /companies/{id}/collaborators	OAuth2 auth-code	Hard 🛂	no (shared host)	Must be a PayFit partner; scopes whitelisted.
Langfuse	28	✅ T1	/api/public/organizations/memberships (+ SCIM)	Org API key / SCIM	n/a (key)	regional (US/EU) + self-host	LLM observability.
Apollo.io	25	✅ T1	GET /api/v1/users/search	Master API key	🔀 (OAuth exists)	no	Users = teammates, not the prospect DB.
OVHcloud	25	⚠️ T2	GET /me/identity/user	OAuth2 CC (self-serve SA)	None	regional hosts	EU cloud IAM.
WorkOS	19	❌ X	—	API key	—	no	Membership API returns the customer's end-users, not WorkOS dashboard seats.
Render	19	✅ T1	GET /v1/owners/{id}/members	API key / PAT	n/a (key)	no	PaaS workspace members.
ClickHouse Cloud	18	✅ T1	GET /v1/organizations/{id}/members	API key (Basic)	n/a (key)	no	Managed DB org members.
Deepgram	17	✅ T1	GET /v1/projects/{id}/members	API key (members:read)	n/a (key)	no	Speech AI console.
Porter	16	❌ X	—	CLI token	—	—	CLI/dashboard only; no public member API.
Scaleway	16	✅ T1	GET /iam/v1alpha1/users?organization_id=	API key	n/a (key)	no	EU cloud IAM.
Rho	15	❌ X	—	embed APIs only	—	—	No team/users API; banking via Plaid only.
Pylon	14	✅ T1	GET /users	API key	n/a (key)	no	B2B support platform.
Cal.com	13	✅ T1	GET /v2/organizations/{id}/memberships	API key / OAuth CC	🔀 self-serve	cloud + self-host	Needs Orgs (paid) feature.
Pennylane	13	❌ X	— (only GET /me)	OAuth2 / token	Hard 🛂 (OAuth)	no	No member/collaborator roster endpoint.
Framer	12	❌ X	—	API key	—	no	Server API is content ops only.
Railway	12	✅ T1	GraphQL team{ members }	Account/team token	n/a (key)	no	PaaS.
Webflow	12	⚠️ T3	SCIM GET /scim/v2/Users	SCIM bearer	n/a (key)	no	Seats only via SCIM; Enterprise + SSO.
OpenRouter	12	✅ T1	GET /api/v1/organization/members	Mgmt API key	n/a (key)	no	LLM router.
Yousign	12	✅ T1	GET /v3/users	API key	n/a (key)	sandbox/prod hosts	EU e-signature.
DigitalOcean	11	❌ X	—	PAT / OAuth2	—	no	Public v2 API exposes no team-member endpoint (dashboard-only).
Modal	11	❌ X	—	SDK/CLI token	—	—	Workspace members are UI-only.
Customer.io	10	⚠️ T3	SCIM GET /v1/scim/v2/Users	SCIM bearer	n/a (key)	no	Premium/Enterprise only; people ≠ seats.
Zapier	10	⚠️ T3	SCIM GET /scim/v2/Users	SCIM token	n/a (key)	no	Team/Enterprise plans only.
Qonto	10	⚠️ T2	GET /v2/memberships	OAuth2 auth-code / key	Hard 🛂	env hosts	EU banking; prod needs partner approval.
incident.io	9	✅ T1	GET /v2/users	API key	n/a (key)	no	OAuth is outbound-only.
Brevo	9	✅ T1	GET /v3/organization/invited/users	API key	n/a (key)	no	Dashboard users, not contacts.
Revolut Business	9	✅ T1	GET /api/1.0/team-members	OAuth2 CC (cert/JWT)	🔀 self-serve	env hosts	Team-members not in sandbox.
Crisp	9	✅ T1	GET /v1/website/{id}/operators	Token tiers	🔀	no	Operators = agents, not visitors.
Infisical	9	⚠️ T2	GET /api/v2/organizations/{id}/memberships	Machine-identity client-creds	n/a (key)	cloud (US/EU) + self-host	Secrets mgmt; security-relevant.
Wise	8	❌ X	—	PAT / OAuth	—	env hosts	No team-member listing (multi-user access is app-only).
Retool	7	✅ T1	GET /api/v2/users (+ SCIM)	API token (users:read)	n/a (key)	{org}.retool.com	SCIM = Enterprise+SSO.
Stytch	7	❌ X	—	key	—	no	Members API = customer end-users, not Stytch dashboard seats.
Fly.io	7	⚠️ T3	GraphQL organization{ members }	PAT / org token	n/a (key)	no	Member query on undocumented internal GraphQL.
Pulley	7	⚠️ T3	undocumented	unknown	Hard / request-only	unknown	Docs are private; stakeholders ≠ login-holders.
Calendly	6	✅ T1	GET /organization_memberships	OAuth2 / PAT	None / 🔀	no	SCIM = Enterprise.
Nmbrs	6	✅ T1	Get-employee-list	OAuth2 auth-code	🔀 self-register	no	Dutch payroll (Visma).
Postman	6	⚠️ T2	SCIM GET /scim/v2/Users	SCIM key	n/a (key)	US/EU region	Enterprise + SCIM enabled.
Silae	6	⚠️ T3	undocumented	client-creds + access key	Hard 🛂	partner hosts	FR payroll; multi-week contract provisioning.
Spendesk	5	⚠️ T2	GET /v1/users	OAuth2 CC / key	Hard 🛂	no	Enterprise; sales-approved creds.
Weights & Biases	5	⚠️ T2	SCIM GET /scim/v2/Users	SCIM / SA key	n/a (key)	cloud + dedicated	Enterprise-gated.
GoCardless	5	❌ X	—	token	—	—	Users/roles endpoints removed; dashboard-only.
Canva	4	⚠️ T3	SCIM GET /Users	SCIM bearer	Hard 🛂 (Connect)	no	Connect API can't list members; SCIM = Enterprise only.
SonarCloud	4	✅ T1	api/organizations/search_members	User token	n/a (key)	EU/US region	Needs org-admin.
Braintrust	4	✅ T1	GET /v1/user	API key	n/a (key)	no	AI eval platform.
Twingate	4	⚠️ T2	GraphQL users (+ SCIM)	API key	n/a (key)	{network}.twingate.com	ZTNA; security-relevant.
ReadMe	4	❌ X	—	API key	—	no	Teammate mgmt is dashboard-only.
Algolia	5	❌ X	—	—	—	—	No team-member API and no SCIM (vendor-confirmed).

High demand but blocked (no usable member API today): Mintlify (42), WorkOS (19), Porter (16), Rho (15), Pennylane (13), Framer (12), DigitalOcean (11), Modal (11), Wise (8), Stytch (7). Recorded so we don't re-research; revisit if the vendor ships an admin/SCIM API. WorkOS/Stytch only expose the customer's end-users, never their own dashboard seat-holders.

---

✅ Implemented on main — 52

Provider	Conn.	Scopes / permissions	Members endpoint
★ Slack	OAuth2	users:read users:read.email	users.list
★ 🛂🔁 Google Workspace	OAuth2	admin.directory.user.readonly admin.directory.group.member.readonly admin.directory.customer.readonly	/admin/directory/v1/users
★ Microsoft 365 / Entra	OAuth2	openid profile offline_access User.Read.All Directory.Read.All RoleManagement.Read.Directory	MS Graph /users
Linear	OAuth2	read	/graphql users
★ GitHub	OAuth2	read:org	/orgs/{org}/members
HubSpot	OAuth2	settings.users.read	/settings/v3/users
🛂 DocuSign	OAuth2	signature	/restapi/v2.1/accounts/{id}/users
Notion	OAuth2	(none — owner=user)	/v1/users
🛂 Brex	OAuth2	openid offline_access	/v2/users
Sentry	OAuth2	org:read member:read	/api/0/organizations/{slug}/members/
Intercom	OAuth2	(declared at app level)	/admins
🛂 1Password	OAuth2 Users API for Partners (preferred — Hard partner program, public preview since 2026-03) or SCIM bridge (current implementation)	OAuth scopes: list users, get user, suspend users, reactivate users	GET /v1beta1/accounts/{account_id}/users (OAuth) or /scim/v2/Users (SCIM)
Tally	OAuth2 (preferred — Soft) or API key (current)	token	/organizations/{id}/users
★ Cloudflare	OAuth2 (preferred — Soft) or API key (current)	Account:Read User:Read	/accounts/{id}/members
OpenAI	Admin API key (no third-party OAuth2 for org admin)	sk-admin-...	/v1/organization/users
★ Anthropic — platform.claude.com	Admin API key (x-api-key; no third-party OAuth2 for org admin)	sk-ant-admin-...	/v1/organizations/users
Supabase	OAuth2 (preferred — Soft) or PAT (current)	org-scoped	/v1/organizations/{slug}/members
Resend	API key	key	/api-keys
★ GitLab	OAuth2	read_api	/api/v4/groups/{id}/members/all
Bitbucket Cloud	OAuth2	scopes on customer-owned consumer	/2.0/workspaces/{workspace}/members
Heroku	OAuth2	read	/teams/{id}/members
PagerDuty	OAuth2 (PKCE)	users.read	/users
Asana	OAuth2	workspaces:read users:read	/api/1.0/workspaces/{gid}/users
Netlify	OAuth2	(none — all-or-nothing)	/api/v1/{account}/members
ClickUp	OAuth2	(none)	/api/v2/team/{id} (members inline)
🛂 Vercel	OAuth2	(declared at integration creation)	/v3/teams/{id}/members
🛂 Monday.com	OAuth2	users:read account:read	GraphQL users

The GitLab → Monday.com block above shipped via the connector-provider registry consolidation (PR #1137 and follow-ups). All per-provider metadata now lives in pkg/connector/provider/<provider>.go.

---

| ★ PostHog | OAuth2 (public-client/CIMD) + API key | organization:read organization_member:read | /api/organizations/@current/members/ |
| ★ Cursor | Admin API key (Basic auth) | team-admin key | /teams/members |
| ★ 🛂 Datadog | OAuth2 (PKCE, multi-site) | user_access_read | /api/v2/users |
| ★ SendGrid | API key (Full Access) | n/a — key (Custom Access exposes no Teammates scope) | GET /v3/teammates (+ /{username} for MFA) |
| Clerk | API key (Backend Secret Key; no third-party OAuth2 for the Backend API) | sk_live_… (full admin) | /v1/users |
| ★ Okta | API token (SSWS) + org domain | SSWS token (inherits creator's admin role) | /api/v1/users |
| ★ 🛂 Zendesk | OAuth2 (multi-site, global client) | users:read | /api/v2/users?role[]=agent&role[]=admin |
| SigNoz (Cloud + self-hosted) | API key (SIGNOZ-API-KEY) + base URL | Admin role | /api/v1/user |
| Better Stack | API token + team name | global or team API token | /api/v2/team-members (+ team_name) |
| Qovery | API token + organization ID | read-only API token | /organization/{id}/member |
| Render | API key + Workspace ID | read-only API key (Bearer) | /v1/owners/{id}/members |
| Neon | API key + Organization ID | n/a — key (personal or org API key, Bearer) | /api/v2/organizations/{org_id}/members |
| Mercury | API token (Bearer) | n/a — key | /api/v1/users (maps organizationRole) |
| Apollo.io | API key (x-api-key) | n/a — master key | /api/v1/users/search (teammates) |
| Deepgram | API key (Authorization: Token) | n/a — key (members:read) | /v1/projects/{id}/members (aggregated across projects, deduped) |
| ClickHouse Cloud | API key (HTTP Basic keyId:keySecret) | n/a — key | /v1/organizations/{id}/members (org auto-discovered) |
| Langfuse | API key (HTTP Basic publicKey:secretKey) + base URL | n/a — key | /api/public/organizations/memberships (regional cloud or self-host) |
| Pylon | API key (Bearer) | n/a — key | /users (resolves role_id via /user-roles) |
| OpenRouter | API key (Bearer, management key) | n/a — key | /api/v1/organization/members (organization accounts only) |
| incident.io | API key (Bearer) | n/a — key | /v2/users (OAuth is outbound-only) |
| Brevo | API key (api-key header) | n/a — key | /v3/organization/invited/users (dashboard users, not contacts) |
| Scaleway | API key + Organization ID | n/a — key | /iam/v1alpha1/users?organization_id= (EU cloud IAM) |
| Yousign | API key | n/a — key | /v3/users (sandbox/prod hosts) |
| Railway | Account/team token | n/a — key | GraphQL me { workspaces { members } } |
| Crisp | Managed plugin token (Probo-held) | n/a — key | /v1/website/{id}/operators/list (operators = agents, not visitors) |

Mercury → Langfuse shipped via PR #1353 — five API-key, single-tenant (Pattern 3) connectors plus a new Basic user:pass API-key auth mode (APIKeyBasicAuthUserPass) for ClickHouse and Langfuse.

Pylon → Brevo shipped via PR #1413 — four API-key, single-tenant (Pattern 3) connectors. Brevo authenticates via the api-key header (Registration.APIKeyHeader); OpenRouter's connection probe rejects 404 (a personal, non-organization key) on top of 401/403.

Scaleway → Crisp shipped via PR #1420 — four API-key, single-tenant (Pattern 3) Tier-1 connectors. Crisp is a managed "Model B" connector: Probo holds the marketplace plugin token, the customer supplies only a Website ID and pastes a deterministic HMAC ownership code into the plugin settings, which the create resolver re-derives and constant-time compares before persisting the connection.

🚧 In progress

Provider	Tier	Conn.	Owner	Branch / PR
★ Google Analytics (GA4)	1	OAuth2	@aureliensibiril	#1482
Dotfile	1	API key	@aureliensibiril	#1482
Segment (Twilio)	1	API key	@aureliensibiril	#1482
Square	2	OAuth2 / PAT	@aureliensibiril	#1482

Prototyped, then reverted

Snyk, Ramp, Lever, and Deel were drafted (driver + scopes + logos) but dropped before shipping (commit c2db47e6, 2026-05-17) and are not on main. Research notes retained for whoever re-implements them:

Provider	Scopes (drafted)	Registration	Caveats
Snyk	org.read org.membership.read offline_access	Self-serve	⚠️ org.membership.read & offline_access NOT in official 26-scope list. Snyk pins scopes at app-registration time (not via the authorize URL) and issues refresh tokens automatically — the extras are likely silently ignored. PKCE required.
Ramp	users:read	Admin-only install	Token TTL 10 d.
Lever	users:read:admin offline_access	Partner-review	Rotating refresh.
Deel	people:read organizations:read	Self-serve dev / partner-review for App Store	⚠️ organizations:read NOT on Deel's published list. May request SOC 2.

---

🛒 Not yet implemented — ranked

🟢 Tier 1 — Ship next

Identity Providers

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
★ 🔀 Auth0	OAuth2 CC	Self-serve	read:users read:user_idp_tokens	/api/v2/users	Per-tenant {tenant}.auth0.com. Marketplace bypassable via customer-registered app. Max 1000 results.
🔀 PingOne / Ping Identity	OAuth2 CC	Self-serve (per-region API host)	p1:read:user	/v1/environments/{env}/users	Multi-region. PingPartner program bypassable via customer-registered app.

Cloud (from 2026-05-01-cloud-accounts.md)

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
★ AWS IAM (per-account)	Cross-account role + ExternalId	CloudFormation Quick-Create	iam:ListUsers, ListAttachedUserPolicies, ListUserPolicies, ListGroupsForUser, ListMFADevices, GenerateCredentialReport, GetCredentialReport	iam.ListUsers + per-user policy/group/cred report	Works on any account.
★ GCP (project/org/folder IAM)	SA JSON key OR WIF	Cloud Shell script (probo-scanner SA + custom role)	roles/iam.securityReviewer	cloudresourcemanager.getIamPolicy + cloudasset.searchAllIamPolicies	Scope-flexible.

Productivity / Storage / Design

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
★ 🔀 Atlassian Cloud (Jira / Confluence)	OAuth2 3LO + Org Admin API key	Self-serve	OAuth: read:account read:jira-user; Org API: admin:organization:admin (key)	/admin/v1/orgs/{orgId}/users (legacy — retires 2026-06-30); new path uses Directory / Users / Groups APIs	⚠️ Legacy org-users API EOL 2026-06-30 — implement against new Directory API. Dual-auth — 3LO doesn't list org members, separate Org Admin API key needed. Marketplace listing bypassable via customer registration.
★ 🔀 Salesforce	OAuth2	Self-serve	api refresh_token	SOQL SELECT Id,Name FROM User	Per-org {instance}.my.salesforce.com. AppExchange bypassable via customer-registered Connected App.
★ Dropbox Business	OAuth2	Self-serve	team_info.read members.read	/2/team/members/list_v2	Team scopes need admin authorization.
★ Box	OAuth2 3LO or JWT	Self-serve	manage_managed_users manage_app_users manage_groups	/2.0/users	Enterprise admin perms required. Some scopes need Box support ticket.
★ 🛂 Figma	OAuth2	Self-serve registration; public-app review required	team:read (verify)	/v1/teams/{team_id}/members	No bypass — Figma restricts team-member APIs.

Comms / Customer Support

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
★ 🛂 Zoom	OAuth2	Marketplace review	user:read:admin (verify 2026 granularity)	/v2/users	No clean customer-OAuth-client bypass.

ITSM / Enterprise platform

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
★ 🔀 ServiceNow	OAuth2	Self-serve (per-instance Application Registry — no Store listing needed)	Custom OAuth scope + ACL on sys_user table	/api/now/table/sys_user	Default scope insufficient — needs ACL setup. Customer registers OAuth credentials in their instance = zero Probo-side approval.

Observability / Security

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes

MDM

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
★ Jamf Pro	OAuth2 CC	Self-serve	API scopes	/api/v1/users + /api/v1/computers	Per-tenant {tenant}.jamfcloud.com. Top Mac MDM.
★ Kandji	REST API token	Self-serve	bearer	/api/v1/users	Modern Mac MDM.
Microsoft Intune	MS Graph (already authed via M365 ✅)	—	DeviceManagementManagedDevices.Read.All	/deviceManagement/managedDevices + MS Graph /users	Free-rides on existing M365 connector. Device listing for endpoint compliance evidence.

HRIS / Payroll

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
★ Rippling	OAuth2	Self-serve	employees:read	/platform/api/employees	Mid-market HRIS+IDP.
★ 🛂 BambooHR	OAuth2 / OpenID Connect (preferred — Hard partner program) or API key (Basic-auth, current fallback)	OAuth: BambooHR partner portal (Hard). Key: self-serve.	(key-based)	/api/gateway.php/{company}/v1/employees/directory	Top SMB HRIS.
Paylocity	OAuth2 CC	Self-serve (Dashboard > API Mgmt)	client_id + secret	/api/v2/companies/{companyId}/employees	Top US mid-market payroll.

🟡 Tier 2 — High value, medium friction

Cloud

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
AWS Identity Center (IDC)	Cross-account role + ExternalId	CloudFormation in mgmt account	sso-admin:List* + sso-admin:Describe* + identitystore:ListUsers + identitystore:ListGroups + identitystore:ListGroupMemberships + identitystore:DescribeUser + identitystore:DescribeGroup	sso-admin:ListAccountAssignments + identitystore:ListUsers (+ Describe* to hydrate principals)	Mgmt-account only.
★ Azure (RBAC + Entra)	App Reg + client secret / federated cred	App Reg + assign Reader at sub/MG + admin-consent app perms	RBAC Reader; Graph User.Read.All Directory.Read.All RoleManagement.Read.Directory	armauthorization.roleAssignments.list + MS Graph	MFA data NOT in RBAC API.
AWS GovCloud	Same as AWS IAM	Same	Same	Same	Implementation can free-ride on AWS IAM connector with region templating.

IDPs

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
OneLogin	OAuth2 bearer	Self-serve	Read Users (or Manage All)	/api/2/users	Per-tenant.
JumpCloud	OAuth2 service account (preferred — Soft) or API key (x-api-key, current fallback)	Self-serve	Admin or read-only billing admin	/api/systemusers (v2.0)	—
Duo Security	HMAC-SHA1 (ikey/skey)	Self-serve	(signature-based)	/admin/v1/users	Per-tenant. Custom signing — not OAuth.

Code / CI / DevOps

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
Azure DevOps	OAuth2	Self-serve	vso.memberentitlementmanagement	/_apis/userentitlements?api-version=7.1	Separate identity surface from M365. Per-org.

AI / Productivity

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
Anthropic — Claude Enterprise / Team (claude.ai paid plans)	SCIM 2.0 + Compliance API	Enterprise contract	SCIM bearer	SCIM /Users + Compliance API audit-log endpoint	Distinct from consumer claude.ai (Free/Pro = Tier X).
Metabase (self-hosted + Cloud)	API key	Self-serve	Admin role	/api/user	Per-tenant URL.
Airtable	OAuth2 or PAT	Self-serve	enterprise.scim.read (enterprise) / user:read (PAT)	/v0/meta/users or /v0/meta/enterpriseAccounts/{id}/users	Workspace listing differs from enterprise.

Finance / Payments / Expense

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
Stripe	SCIM 2.0 (Enterprise + SSO)	Enterprise agreement	SCIM bearer	POST/GET /scim/v2/Users at access.stripe.com/scim/v2	Gated behind enterprise + SSO contract.
🛂 Pleo	OAuth2 (preferred — Hard partner program) or API key (current fallback)	OAuth: partner program (Hard). Key: self-serve.	API key	GET /v1/employees	Public docs at developers.pleo.io. Returns firstName/lastName/email/departmentId/role.

Marketing / Analytics

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
Amplitude	SCIM 2.0	Self-serve	SCIM bearer	GET /scim/1/Users at core.amplitude.com	Supports startIndex, itemsPerPage, filter.
Mailgun	API key (Basic-auth)	Self-serve	account-admin role	GET /v5/users	—

Data / Analytics / DB

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
★ Snowflake	OAuth2 or key-pair	Self-serve	(OAuth authenticator=oauth)	SQL SHOW USERS or SNOWFLAKE.ACCOUNT_USAGE.USERS	Per-tenant {account}.snowflakecomputing.com.
★ Databricks	PAT or OAuth M2M	Self-serve	(workspace admin)	/api/2.1/accounts/{account_id}/scim/v2/Users (preferred) — /api/2.0/preview/scim/v2/Users legacy still works	Per-workspace URL.

Observability / SIEM

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
New Relic	NerdGraph + API key	Self-serve	Core/Full Platform + AuthDomain Manager role	NerdGraph actor { users { userSearch } }	Cursor paginated.
Splunk Cloud	REST + token	Per-tenant	admin role	/services/admin/users	Per-stack {stack}.splunkcloud.com.
Grafana Cloud	OAuth2 (preferred — Soft) or service account token (fallback)	Self-serve	Org admin	/api/instances/{stack}/api/org/users	—
Sumo Logic	OAuth2 (preferred — Soft) or API key (Basic-auth, fallback)	Self-serve	Manage Users capability	/api/v1/users	Per-deployment (us1/us2/eu/au/jp).
Elastic Cloud	OAuth2 token service (preferred — Soft) or API key (fallback)	Self-serve	Org admin	/api/v1/organizations/{org}/members	Cloud-only path.

Security / EDR / Vuln / Password Mgr

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
★ CrowdStrike Falcon	OAuth2 CC	Self-serve	user-management:read	/users/queries/user-uids/v1 + /users/entities/users/v1?ids=	Multi-region.
Wiz	OAuth2 CC	Self-serve (service account)	Role-based	GraphQL { users { edges { node { ... } } } }	Tenant api.{tenant}.wiz.io/graphql.
★ Bitwarden	OAuth2 CC (org API key)	Self-serve	scope=api.organization	GET /public/members	—
★ Mimecast	OAuth2 (v2) / HMAC (v1 legacy)	Self-serve	(token-based)	v2 RESTful user endpoint	⚠️ Returns managed users only — external/guest users require a separate call. Regional endpoint required.
CyberArk Identity	OAuth2 CC	Self-serve	read:user	/identity/api/Users/Get	Per-tenant {tenant}.id.cyberark.cloud.
Zscaler ZIA / ZPA	OAuth2 (preferred — Soft, recently added) or proprietary session-based auth (4-step API-user provisioning, fallback)	Self-serve	Admin or Auditor role	/api/v1/users (ZIA), /mgmtconfig/v1/admin/customers/{id}/users (ZPA)	Per-tenant cloud. Polling-only (no change-detection webhooks). 1000 req/hr rate cap.
Microsoft Defender / Sentinel	MS Graph (already authed via M365 ✅)	—	SecurityEvents.Read.All etc.	MS Graph /security/* v2 alerts API	⚠️ Graph Security API v1 retires April 2026 — implement against v2 alerts directly. Free-rides on M365 connector.

HRIS / ATS / Payroll

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
Personio	OAuth2 CC	Self-serve	Personio-Partner-ID header	/v1/company/employees	EU-heavy SMB.
HiBob	Service user token (Basic-auth)	Self-serve	HR admin role	/v1/people	EU/Israeli mid-market.
★ 🛂 Greenhouse	OAuth2 (preferred — Hard partner program, signed via [email protected]) or API key (Basic-auth, fallback)	OAuth: partner (Hard). Key: self-serve.	(key-based)	/v1/users	Top tech ATS.
Workable	OAuth2	Self-serve	r_jobs	/spi/v3/accounts/{id}/members	Per-tenant subdomain.
Ashby	OAuth2 via integrators (preferred — Soft) or API key (Basic-auth, fallback)	Self-serve	(key-based)	/v1/user.list	Modern ATS.
🛂 Gusto	OAuth2	Partner program	employees:read	/v1/companies/{id}/employees	Embedded Payroll. Compliance docs required.
Namely	OAuth2	Self-serve	(token-based)	/api/v1/profiles	Mid-market US HR.
🛂 Paychex Flex	OAuth2 CC	Partner program	(token-based)	/companies/{companyId}/workers	—
🛂 UKG Pro / Ready	OAuth2 + per-tenant	Partner program	Workforce API role	/workforce/v1/employees	Enterprise US HR.
🛂 Dayforce (Ceridian)	OAuth2 CC	Partner program	API user role	/Api/{ns}/V1/Employees	Enterprise US/Canada HR.

Productivity / ITSM

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
Adobe Admin Console (Creative Cloud)	OAuth2 CC (S2S)	Self-serve	User Management API scopes	/v2/usermanagement/users/{orgId}	JWT EOL 2025-01-27 → OAuth S2S.
Adobe Sign / Acrobat Sign	OAuth2	Self-serve	user_read:account	/api/rest/v6/users	—
Webex	OAuth2	Self-serve	spark:people_read (older spark-admin:people_read deprecated)	/v1/people	—
Jira Service Management	OAuth2 3LO (covered by Atlassian Cloud row)	—	—	—	Atlassian Org Admin API handles all Atlassian products.
FreshService	OAuth2 (preferred — Soft, via Freshworks marketplace) or API key (Basic-auth, fallback)	Self-serve (OAuth via Freshworks dev portal)	(key-based)	/api/v2/agents	Per-tenant {domain}.freshservice.com.

MDM

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
VMware Workspace ONE (AirWatch)	OAuth2 or API key	Per-tenant cn{N}.awmdm.com	API key or OAuth2	/system/users/search	Legacy enterprise.

CRM

Provider	Conn.	Registration	Scope / permission	Endpoint	Notes
Pipedrive	OAuth2	Self-serve	users:read	/v1/users	—

🟠 Tier 3 — Lower priority / narrower customer base

Provider	Conn.	Members endpoint	Notes
Tailscale	OAuth2 CC	/api/v2/tailnet/{tailnet}/users	Customer-minted client — acts like API key.
HCP Terraform	Bearer token	/api/v2/organizations/{name}/organization-memberships	—
Buildkite	API token	/v2/organizations/{org.slug}/members (verify — may need /v2/teams instead)	⚠️ Endpoint shape to re-verify on first implementation.
CircleCI	API key	/api/v2/me/collaborations (your orgs only); members via legacy private API	Surface is fragile.
JFrog Platform	API key	/access/api/v2/users	Per-tenant {tenant}.jfrog.io.
Docker Hub	PAT	/v2/orgs/{org}/members/	—
Front	OAuth2	/teammates (teammates:read)	—
Help Scout	OAuth2 CC	/v2/users	—
Freshdesk	OAuth2 (preferred — Soft, via Freshworks marketplace) or API key	/api/v2/agents	Per-tenant.
Discord	OAuth2 (bot)	/guilds/{id}/members	GUILD_MEMBERS privileged intent.
Mattermost	OAuth2 or PAT	/api/v4/users	Per-tenant URL.
Miro	OAuth2	/v2/orgs/{org}/members (verify — reference URL 404 on last check)	⚠️ Endpoint to re-verify on first implementation.
Smartsheet	OAuth2	/2.0/users (READ_USERS)	—
Basecamp	OAuth2	/people.json	—
Dropbox Sign (HelloSign)	OAuth2 or API key	/v3/team/members	—
PandaDoc	OAuth2 or API key	/public/v1/members	—
Trello	API key + token	/1/organizations/{id}/members	OAuth2 not supported on org endpoints.
Tenable.io	API key (access + secret)	https://cloud.tenable.com/users	—
SentinelOne	Bearer (ApiToken)	/web/api/v2.1/users	Inherits user scope.
LastPass Enterprise	OIDC / OAuth2 + SCIM 2.0 (preferred — Soft, recommended path since 2024-2025) or legacy Provisioning API (CID + hash, fallback)	POST /enterpriseapi.php cmd=getuserdata (legacy) / SCIM Users (modern)	No pagination on legacy.
Dashlane	SCIM 2.0	scim.dashlane.com/v2/Users	SSO prerequisite.
Proofpoint TAP	API key	/v2/people	—
Honeycomb	OAuth2 via MCP (preferred — Soft, launched 2025-07) or API key (fallback)	/1/teams	Regional.
Aikido	API key	/v1/users	Smaller security scanner.
MongoDB Atlas	OAuth2 Service Accounts (preferred — Soft, client-credentials, GA) or API key (HTTP Digest, fallback)	/v2/orgs/{orgId}/users	—
PlanetScale	OAuth2 (preferred — Soft, token prerequisites) or PAT	invitations-based	No direct list-members.
Looker	OAuth2 via SDK (preferred — Soft) or API3 client_id+secret (fallback)	/users	Per-tenant.
Tableau Cloud	OAuth or PAT	/api/3.x/sites/{site}/users	Per-tenant.
Hugging Face Hub	User token or OAuth	/api/organizations/{org}/members	read:org scope.
NetSuite	OAuth2 (TBA)	SuiteQL SELECT * FROM employee	Per-account.
🛂 QuickBooks Online	OAuth2	Query Employee entity	com.intuit.quickbooks.accounting. Intuit App Store + OAuth security audit.
🛂 Xero	OAuth2	/api.xro/2.0/Users	xero-tenant-id header. Xero App Partner Program.
Bill.com	Session-based API key	/v3/users	apiSession token.
Expensify	Integration Server Key	/api?command=Get&type=policy&fields=employees	Policy-employees join.
Charlie HR	API key	/employees	UK SMB HR.
Sapling (Kallidus)	API key	/v1/employees	—
Zenefits (TriNet HR Platform)	OAuth2	/core/companies/{id}/people	—
Factorial HR	OAuth2 + API key	/v1/employees	EU SMB.
TriNet	API (partner)	employees	PEO.
Bullhorn	OAuth2	/users	Staffing/recruiting.
Paycom	API key (partner)	/v1/employees	Mid-market US HR.
Paycor	OAuth2 (partner)	/v1/employees	—
isolved	API (partner)	employees	—
7shifts	OAuth2	/v2/users	Hospitality.
Square Payroll	OAuth2	/v2/team-members	—
Vetty	API key	candidates + admins	Background check.
Certn	API key	applicants + admins	Background check.
Coupa	OAuth2 + API key	/api/users	Procurement enterprise.
Axiom	API token	/v2/orgs/{id}/users	Logs/observability.
Coralogix	API key	/v1/teams/{id}/users	Observability.
Addigy	API key + secret	/users	Mac MDM.
Mosyle Business	API token	/users	Apple device mgmt.
Hexnode UEM	API key	/users or device-focused	Per-tenant {tenant}.hexnode.com.
Meraki Systems Manager	API key (Cisco DNA)	/networks/{id}/sm/users	—
FusionAuth	API key (self-hosted)	/api/user/search	Self-hosted IDP.
ClassLink	OAuth2	/v2/users	Education-only IDP.
Aha!	OAuth2 (preferred — None) or API key	/api/v1/users	Product roadmap.
Airtable (workspace)	OAuth2 (preferred — Soft) or PAT	/v0/meta/users	Workspace-level (Tier 2 has enterprise variant).
Teamwork.com	OAuth2 or API token	/projects/api/v3/people	—
ActiveCampaign	OAuth2 (preferred — None) or API key	/api/3/users	—
AWS CodeCommit	IAM (cross-account role)	(covered by AWS IAM Tier 1 connector)	Free-rides on AWS IAM access pattern.
SailPoint IdentityNow / IdentityIQ	OAuth2 CC or API key	/v3/identities + /v3/entitlements	IGA upstream. Per-tenant URL {tenant}.api.identitynow.com.
Saviynt	JWT bearer	/ECM/api/v5/getUsers	IGA upstream.
ConductorOne	OAuth2 CC (jwt-bearer)	/api/v1/grants?user_id=...	IGA upstream.
Veza	Bearer token	OAA /datasets + Mgmt API v1 /users	⚠️ Competitive risk if customer uses Veza as their access-review engine.
Lumos	Bearer token	/v1/users + /accounts	App-access mgmt — narrower than full IGA.
Avatier	API key	/users (per-tenant)	Self-hosted; legacy IGA.

🟡🔒 Tier 2 but partner-program gated (all 🛂)

Provider	Reason
🛂 Workday	OAuth2 + ISU credentials behind partner program
🛂 ADP Workforce Now	OAuth2 + mTLS certs (cert pinning) behind partner program
🛂 Justworks	Partner program; minimal public docs
🛂 Carta	Partner API invite-only since 2025; OAuth2 required for plugin auth — apply via Carta partner program

🔴 Tier X — Not viable today

Provider	Reason
Anthropic — claude.ai consumer (Free / Pro)	No public admin API for non-enterprise tiers. Enterprise/Team plans → Tier 2 (separate row).
Mercury	✏️ Corrected 2026-05 — now viable (Tier 1), see the demand-driven order table at the top. GET /api/v1/users returns every org user with organizationRole (administrator / bookkeeper / …), auth by a customer-minted Bearer token (no partner gate). The earlier "banking-ops only" assessment was wrong.
Mailchimp	lists/{id}/members = mailing-list subscribers, not dashboard admins. No /account-users endpoint.
Klaviyo	API covers Lists/Profiles/Metrics/Flows. No documented account-admins endpoint.
Twilio Communications	Workspace IAM has no standard /v1/Users for human admins. (Twilio Segment is in Tier 3.)
Cohere	Dashboard UI manages team members; no documented API endpoint.
Mistral AI	Admin Panel manages members; Admin API page exists but exposes no list-members endpoint.
Mixpanel	Service-Accounts API lists service accounts ≠ human members. No team-members endpoint.
Jenkins	Self-hosted, no central API — architectural mismatch with multi-tenant SaaS.
Sonatype Nexus Repository	Self-hosted only.
Keycloak	Self-hosted only.
Stilla	Ambiguous identifier — stilla.ai is a multiplayer AI agent platform with no admin API.
Checkr	No public API for listing Checkr dashboard admins. REST /v1/candidates lists job applicants (subjects of background checks), not admins. SCIM 2.0 not publicly documented. Access review of Checkr admins is typically performed via the customer's IDP (Okta/Entra), not via Checkr directly.

---

[aureliensibiril]

🔎 Newly researched vendors (2026-07) — customer-inventory sweep

Surfaced from a real customer third-party inventory (~56 vendors, Hexa portfolio). Each vendor was cross-referenced against shipped + roadmap; the net-new ones were researched against current vendor API docs for a human-member-list endpoint, auth, and gating — then adversarially re-verified (independent live-doc re-check + a Codex/GPT-5 cross-model pass). 30/31 findings confirmed unchanged; the only correction was the GA4 endpoint version (v1beta → v1alpha). Symbols per top legend.

Inventory breakdown: 14 already shipped (Slack, HubSpot, Datadog, OpenAI, PostHog, GitHub, Cursor, Linear, Notion, Sentry, Google Workspace, 1Password, Cloudflare, Metabase) · 1 in progress (YouSign) · 2 covered by an existing connector (Google Drive → Google Workspace; ChatGPT → OpenAI) · already-roadmapped (Figma, Revolut, Qonto, Airtable, Front, Webflow, AWS, GCP) · plus the net-new research below.

✅ Viable — add to the build order

Vendor	Tier	Conn.	Member endpoint	Notes
★ Google Analytics (GA4)	1	OAuth2 (analytics.manage.users.readonly)	GET analyticsadmin.googleapis.com/v1alpha/{accounts/*|properties/*}/accessBindings → user (email) + roles[]	⚠️ accessBindings is v1alpha only (v1beta 404s). Account- and property-level bindings = two loops. Self-serve. Distinct connector from Google Workspace.
Dotfile	1	API key (X-DOTFILE-API-KEY)	GET https://api.dotfile.com/v1/users → id/email/role(owner|admin|member)/suspended_at	French KYB. Self-serve workspace key. Explicitly the workspace's own seats (distinct from KYC'd "individuals").
Segment (Twilio)	1	API key (Public API token, Bearer)	GET /users (id/name/email) + per-user GET /users/{userId} for permissions[].roleId/roleName; GET /invites for pending	✏️ Upgrades the prior Tier-3 tag. Roles are an N+1 (list returns id/name/email only). Host api.segmentapis.com (US) / eu1.api.segmentapis.com (EU).
Square (Squareup)	2	OAuth2 (EMPLOYEES_READ) / PAT	POST /v2/team-members/search on connect.squareup.com → email/status/is_owner	(Client inventory row was labeled "Squarecasse" — confirmed to mean Square.)
Odoo	2	API key per instance	XML-RPC res.users.search_read (login/email/groups_id/active); Odoo 19+ JSON-2 POST /json/2/res.users/search_read (Bearer)	Per-tenant host + Custom plan on Odoo Online. ⚠️ XML-RPC/JSON-RPC slated for removal in Odoo 20 (~late 2026) — target the JSON-2 API.
Typeform	2	OAuth2 (workspaces:read)	iterate GET /workspaces → GET /workspaces/{id} inline members[] (email/name/role)	No single account-level list-users endpoint — iterate + dedupe across workspaces.
Forest Admin	3	SCIM 2.0	GET https://api.forestadmin.com/scim/v2/Users (email + role)	Enterprise; token auto-generated in project Security settings. Public REST API has no roster.
Replit	3	SCIM 2.0 (WorkOS-backed)	GET https://replit.com/scim/v2/Users (+ /Groups)	Enterprise only; no member API on Core/Teams.
Lovable	3	SCIM 2.0	GET https://api.lovable.dev/scim/v2/Users	Enterprise + active SSO gated.
Courier	3	SCIM 2.0 (support-issued base URL + token)	GET {scim_base}/Users (userName=email)	Enterprise; the self-serve REST API key cannot enumerate seats.

🔴 Has dashboard seats but no member-list API (blocked — revisit if they ship one)

Member management is UI-only or SCIM-inbound-only; recorded so we don't re-research. All confirmed by live-doc + Codex.

• Mobbin — only POST /v1/screens/search (design search); Enterprise "Directory Sync" is inbound SCIM into Mobbin, not a listable roster.
• Claap — REST is recordings/transcript/workspace/webhooks only; GET /v1/workspaces/mine returns an aggregate membersCount int.
• Phacet — members managed only in UI Settings > Members; no API.
• TipTap Cloud — Documents/Comments/Content-AI/Conversion APIs act on customer content; no members endpoint.
• GetStream (Stream) — app-level API key/JWT only; no Dashboard org-seat API.
• Postmark — account-token API, but no user/team listing endpoint.
• Prismy — OpenAPI covers content/translation only; no members/SCIM endpoint.
• INPI (Guichet Unique) — formalities/RNE APIs only; access is gated behind a mandataire de dépôt partner contract, and the collaborator list ("Gestion des accès") is web-UI only.
• Banking Circle — OAuth2 CC with mandatory mutual-TLS (partner-onboarding-gated); no team-member endpoint.
• iBanFirst — Client API (X-WSSE auth) exposes wallets/payments/trades/documents only; no users/team endpoint.
• Fundcraft — public API is fund data; full reference password-walled; only path is an Account-Manager-provisioned M2M credential; no members endpoint.

⚫ Not viable — no reviewable seats / defunct / individual product

• June (june.so) — acquired by Amplitude and sunset.
• Cycle (cycle.app) — central GraphQL endpoint decommissioned (NXDOMAIN); no workspace-members query.
• Tandem (tandem.chat) — defunct.
• Logo.dev — logo-image API; no team concept.
• Abstract API — validation-API suite; no member-list API.
• Teledec (teledec.fr) — legal-announcements service; no public admin API.
• Leanear — no identifiable vendor/product with a documented member API.

🔁 Re-verified (prior Tier X assessments hold, 2026-07)

• Wise — confirmed: API exposes only the single account owner + owned profiles; no team-member listing.
• WorkOS — confirmed: user_management APIs return the customer's end-users, not WorkOS dashboard seats.
• Pennylane — confirmed: only GET /api/external/v2/me (single authenticated user); no roster.

---

Findings researched + adversarially cross-verified (live vendor docs + Codex/GPT-5) on 2026-07-09.