Where the caller's organization stands

GET /api/auth/mode

Where the caller's organization stands: read-only (Manifold writes nothing outside itself for it — no push to a sales channel or a ledger, no mail to its customers or suppliers, no webhook to an app) or live, with who last changed it and when.

An organization nobody has decided stands at the deployment's default, which is read-only. A sandbox is always read-only and never goes live; its mailDomains are the one exception — the company domains of its own people, the only addresses its mail may reach (never a public mailbox provider's). This is what every service that writes outward asks at the moment it would, so an app acting for a organization asks it too.

Access

Requires a signed-in session: Any person, service or app holding a tenant JWT reads its own organization's mode, and no other

How scopes come from roles: Scopes and roles. Getting a token: Authentication and app tokens.

AI agent tool

No agent tool. Whether the organization is read-only is the badge across the admin and what each service asks before it writes outward; the MCP server does not reach the auth service, and a refused push says why.

Connecting an agent: AI agents.

Example

curl

curl -X GET 'https://auth.getmanifold.io/api/auth/mode' \
  -H "Authorization: Bearer $MANIFOLD_TOKEN"

JavaScript (fetch)

const response = await fetch("https://auth.getmanifold.io/api/auth/mode", {
  method: "GET",
  headers: { Authorization: `Bearer ${process.env.MANIFOLD_TOKEN}` },
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);
const answer = await response.json();

Response · 200 · application/json

{
  "organizationId": "org_01a156d2-8680-7738-ab2e-ff985e454887",
  "mode": "read-only",
  "changedAt": "2026-10-20T01:00:02.000Z",
  "changedBy": "usr_01a15709-7582-7646-b491-261a138f0650"
}

The panel writes this call in other languages. It does not send it: Manifold's APIs do not take calls from a web page on another site, so run the call from your own code or terminal. The whole API as OpenAPI: auth-service.openapi.json. Base URL https://auth.getmanifold.io.

Errors

Every refusal is a status and a JSON body whose _tag names it. A refused call changes nothing.

`401`

Refusal	What it means	What to do
`Unauthorized` reason	The token is missing, expired or not one Manifold issued.	Get a fresh token and send the call again.
`TokenAlreadyUsed` tokenId	A single-use app token was already spent.	Mint a new token for this call.

`402`

Refusal	What it means	What to do
`SubscriptionRequired` status	The organization's subscription has lapsed, so writes are refused.	An owner settles billing. Reads still work meanwhile.

`403`

Refusal	What it means	What to do
`TenantRequired` userId	The token names no organization.	Choose the organization, then get a new token.
`ScopeRequired` required	The token's roles do not grant the scope this call needs.	Ask an owner or admin for a role that grants it.

`409`

Refusal	What it means	What to do
`MirroredFromSource` source	This area is fed by your source system until the organization goes live.	Make the change in the source system, or go live first.

`503`

Refusal	What it means	What to do
`RequestLogUnavailable` tokenId, reason	The service could not record the request, so it did nothing.	Try again shortly.

How refusals work everywhere: Errors.

Used in

Run beside your old system, then go live, step 1: Read where the organization stands
Run beside your old system, then go live, step 9: Read it back