Flag-gated account operation over the existing hosted authorization boundary. Requires the approving account’s current party access. OAuth never grants administrator or reviewer authority. Returns at most 50 memberships by default (maximum 100), optionally filtered by side and stored case status. Follow the Link header with rel="next" using the same account and filters; its opaque after cursor is bound to them. Limit may change between pages. There is no nextCursor in the body. The website-specific request branch retains its separate hosted contract.
/api/caseslistAccountCases
Authentication and authority
Use one listed account-session, scoped OAuth, or partner credential alternative. Account tokens retain the approving account’s authority. Cookie-authenticated writes require same-origin authorization. Alternatives are OR; schemes in one alternative are AND.
CanonicalSession
AccountOAuth
Account tokens authorize only their approving account and case scope. S256 PKCE is mandatory on the code flow. Explicit reacceptance is required after Rules/disclosure changes.
Read the response status and stable error code. See errors and rate limits for recovery. Refresh the resource before resolving a state or digest conflict.
Idempotency and retries
For throttling, honor Retry-After when present. Back off on retryable server failures.