Skip to main content
POST
Error

Authorizations

Authorization
string
header
required

A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.

Headers

X-Organization-Id
string

The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing: the answer is not_a_member (403), which does not mean the session is over. Absent, the session's default organization answers, or — if that membership was revoked while the session was open — any other one the caller still holds.

Query Parameters

environment
enum<string>
default:live

Which environment to act in. A view parameter, valid only on the staff surface — a machine credential never chooses its environment, it is resolved from the key.

Available options:
live,
test

Body

application/json
name
string
required
Maximum string length: 60
rank
integer

Its place in the ladder, unique per environment. Omit for the top.

Required range: 1 <= x <= 1000
requirements
object[]

What this rung asks for. ALL of them must hold. Send the whole set: on an update it REPLACES what is there, [] leaves the rung asking for nothing (and reachable by nobody), and omitting the field leaves the conditions alone. Never two about the same thing — two point thresholds on one rung is two answers rather than a stricter rung.

Maximum array length: 8
icon
string | null

An emoji or short glyph. null clears it.

Maximum string length: 16

Response

The level.

level
object

A rung on the ladder, and everything it asks for. A level is a FUNCTION of what somebody holds and is stored on nobody: it is derived on every read as the highest rank whose every requirement is satisfied, which is what keeps it from disagreeing with the ledger, the tallies and the badges it describes.