Team and collaboration API

The calls behind Comments and mentions, Notifications and alerts and People.

Comments

Write a comment

bodystringrequired

The text, 1 to 5,000 characters.

parentIduuidoptional

To reply: the id of a top-level comment on the same file.

mentionedUserIdsuuid[]optional

Colleagues to tag, up to 50. They must be active people who can already see the file.

curl https://gridline-data-analysis-app.duckdns.org/api/files/FILE_ID/comments \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "body": "Why did the amount column turn into text?", "mentionedUserIds": ["USER_ID"] }'

Read the discussion

Comments come back oldest first. A reply points at its parent with parentId. Threads are one level deep: you can reply to a comment, but not to a reply.

Edit and delete

• PATCH /comments/{id}: only the author can edit. Edited comments carry editedAt.
• DELETE /comments/{id}: the author or an admin can delete.

A deleted comment is not removed from the thread. It becomes an empty tombstone (body is null, deletedAt is set) so replies keep their place and nobody is left wondering what they answered.

Mentions

• A mention sends the person a notification (comment.mentioned).
• Editing a comment notifies only the people newly mentioned.
• A mention never gives anyone access to a file. Only people who could already see it can be tagged.

Live

With a live connection, new, edited and deleted comments appear for everyone watching the file as they happen, along with who is looking at it and who is typing.

Notifications

Read your inbox

unreadbooleanoptional

true returns only what you have not read.

limit, cursoroptional

Newest first. See Pagination.

• GET /notifications/unread-count: just the number, for a badge.
• POST /notifications/{id}/read: mark one as read.
• POST /notifications/read-all: mark everything as read.

You only ever see your own notifications. Someone else's is a 404. Read notifications are removed after 90 days; unread ones stay until you read them.

What you can be told

Each notification has a type and a payload that holds ids, counts and names. It never holds a cell value.

Quota alerts

When your company reaches 80% of its files for the billing period, and again at 100%, every admin gets an inbox entry and the billing address gets an email. Each fires once per period.

It is written with the change

A notification is saved in the same step as the thing that caused it. If an upload is rolled back, it announces nothing. Live delivery to your open dashboard happens only after that step is complete.

People

Invite someone

emailstringrequired

Where the invitation goes. The person signs in with this address.

fullNamestringrequired

Their name, as colleagues will see it.

curl https://gridline-data-analysis-app.duckdns.org/api/employees \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "email": "tamar@acme.com", "fullName": "Tamar Beridze" }'

They get an email with a link. Following it, they choose a password or join with Google, and they are in.

An invitation holds a seat, but costs nothing yet

Your plan limits how many people you can have, and an invited person counts toward that limit straight away, so two admins cannot invite more people than the plan allows. You are not billed for them until they accept.

Inviting past the limit answers 409 and says so. Inviting an address that already has a password account with Gridline is refused up front, because one login email is one account.

See your people

Lists everyone with their role and status (invited, active or disabled). Filter with ?status= and ?role=, and page with ?page= and ?limit=.

Every signed-in person, admin or not, can use GET /companies/me/members to get a names-only list of colleagues: handy for picking who to share a file with, and nothing more.

Invitations that did not arrive

A new link is sent, and the old one stops working.

Remove someone

Removing a person is a soft disable. At once, in one step:

• their access stops, and they cannot sign in;
• their seat is freed, and billing stops counting them;
• their sessions, sign-in methods and file shares are revoked;
• their API keys stop working, and any open live connection is closed.

What they uploaded stays with the company, and the audit trail keeps showing what they did.

Bring someone back

Reactivating sends a fresh invitation: their old sign-in methods were deleted when they were removed, so they choose a password (or Google) again. They take a seat again, and the plan limit is checked again.