post_ownership_transfers_by_orgid
Calls POST /api/ownership-transfers/{orgId} as the signed-in person · REST reference
Start transferring an organization to one of its members
Only the organization's OWNER may, and only to a current member (not invited, removed or deleted); one pending transfer per organization. A single-use code is emailed to each side — the owner's own address and the member's — naming the organization, the other person and when the codes expire. Ownership moves only when both have confirmed. If either email cannot be sent the transfer is cancelled and the answer is 502. Refused while impersonating.
Arguments
| Argument | Type | Description | |
|---|---|---|---|
orgIdpath | string (uuid) | required | |
bodyJSON | object | required | The request body, as a JSON object. Its fields are listed below. |
Fields of body
| Field | Type | Description | |
|---|---|---|---|
toUserId | string (uuid) | required |
Example call
A client sends this over the MCP session; Claude and other agents build it for you. The values are placeholders — the shape is real.
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "post_ownership_transfers_by_orgid",
"arguments": {
"orgId": "11111111-1111-4111-8111-111111111111",
"body": {
"toUserId": "11111111-1111-4111-8111-111111111111"
}
}
}
}Result
On success (HTTP 201) the tool returns one text item holding the API's JSON, pretty-printed.
The transfer is pending; both codes were sent.
{
"data": {
"createdAt": 1,
"expiresAt": 1,
"from": {
"email": "string",
"side": "FROM",
"userId": "11111111-1111-4111-8111-111111111111",
"verified": true,
"firstName": "string",
"lastName": "string",
"verifiedAt": 1
},
"id": "11111111-1111-4111-8111-111111111111",
"orgId": "11111111-1111-4111-8111-111111111111",
"orgName": "string",
"status": "PENDING",
"to": {
"email": "string",
"side": "FROM",
"userId": "11111111-1111-4111-8111-111111111111",
"verified": true,
"firstName": "string",
"lastName": "string",
"verifiedAt": 1
},
"cancelReason": "string",
"cancelledAt": 1,
"completedAt": 1
},
"success": true
}Fields
| Field | Type | Description |
|---|---|---|
data | object | |
data.cancelReason | string | null | |
data.cancelledAt | integer | null | |
data.completedAt | integer | null | |
data.createdAt | integer | Epoch milliseconds. |
data.expiresAt | integer | Epoch milliseconds — the deadline both sides must confirm by. The same lifetime as every other code (OTP_EXPIRY_SECONDS). |
data.from | object | |
data.from.email | string | |
data.from.firstName | string | null | |
data.from.lastName | string | null | |
data.from.side | "FROM" | "TO" | FROM is the current owner who started the transfer; TO is the member who becomes the owner. |
data.from.userId | string (uuid) | |
data.from.verified | boolean | Whether this side has confirmed with their code. |
data.from.verifiedAt | integer | null | Epoch milliseconds. |
data.id | string (uuid) | |
data.orgId | string (uuid) | |
data.orgName | string | |
data.status | "PENDING" | "COMPLETED" | "CANCELLED" | "EXPIRED" | |
data.to | object | |
data.to.email | string | |
data.to.firstName | string | null | |
data.to.lastName | string | null | |
data.to.side | "FROM" | "TO" | FROM is the current owner who started the transfer; TO is the member who becomes the owner. |
data.to.userId | string (uuid) | |
data.to.verified | boolean | Whether this side has confirmed with their code. |
data.to.verifiedAt | integer | null | Epoch milliseconds. |
success | true |
When it fails
A failed call returns isError: true with the API's message as text. A change the person declines, or lets time out, also comes back this way and nothing changes.
400The request was malformed or failed a guard.
403Authenticated, but the caller holds none of the required permissions.
404No such resource — or none this caller may see.
409The resource is not in a state that allows this operation.
429Per-identifier abuse control tripped.
502A code could not be delivered; the transfer was cancelled.
What the model is shown
This is the tool exactly as the server lists it in tools/list. The description starts with the REST call it makes.
{
"name": "post_ownership_transfers_by_orgid",
"description": "POST /api/ownership-transfers/{orgId} — Only the organization's OWNER may, and only to a current member (not invited, removed or deleted); one pending transfer per organization. A single-use code is emailed to each side — the owner's own address and the member's — naming the organization, the other person and when the codes expire. Ownership moves only when both have confirmed. If either email cannot be sent the transfer is cancelled and the answer is 502. Refused while impersonating.\n\nThis changes data. The person is asked to confirm it before it runs, and nothing happens if they decline.",
"inputSchema": {
"type": "object",
"properties": {
"orgId": {
"type": "string"
},
"body": {
"type": "string",
"description": "The JSON request body: { toUserId*: string }"
}
},
"required": [
"orgId",
"body"
]
},
"annotations": {
"readOnlyHint": false,
"destructiveHint": true,
"idempotentHint": false,
"openWorldHint": false
}
}