--- title: "List members" method: GET path: "/v1/lists/{id}/members" tags: ["Lists"] --- # List members `GET /v1/lists/{id}/members` ## Request - Base URL: `https://api.trayo.ai` - URL: `https://api.trayo.ai/v1/lists/{id}/members` - Auth: HTTP bearer **Required permissions:** `people:read`. A page of the list's live members, most recently added first. PAGINATES: follow `nextCursor` until `hasMore` is false. Each row is a MEMBERSHIP: its `id` is what `DELETE …/members/{memberId}` takes, and `personId` / `accountId` say what it points at. Fetch the person or account itself from its own route. Rows whose person or account has since been deleted, and rows the app has marked `excluded`, are omitted. ## Path parameters - `id` string, uuid, required ## Query parameters - `kind` string - `limit` integer - `cursor` string ## Response `200` - ListMemberListDto - `data` object[], required: Members, most recently added first. - `id` string, uuid, required - `listId` string, uuid, required - `kind` 'person' | 'account', required - `personId` string, nullable, required: Set on `kind: person`. Null on an account entry. - `accountId` string, nullable, required: On `kind: account`, THE member. On `kind: person`, provenance — the account the person belonged to when pinned — and may be null. - `via` 'manual' | 'account' | 'signal' | 'find' | 'import', required - `eventId` string, nullable, required - `per` integer, nullable, required: Account entries only: how many contacts the app resolves for this account (1 = best contact). Members added here get 1. Null on person rows. - `excluded` boolean, required: A negative membership set in the app — "not this person" against a re-resolving account entry. Read-only here; excluded rows are not counted in `memberCount` and are omitted from `GET …/members`. - `createdAt` string, date-time, required - `person` object, nullable: On the members listing: who the person is. Null on an account entry. - `fullName` string, required - `title` string, nullable, required - `company` string, nullable, required: The person's current account name, when they have one. - `account` object, nullable: On the members listing: the account the row names, as `accountId` does (the member on `kind: account`, where the person worked on `kind: person`). Null when `accountId` is, or when that account has been removed. - `name` string, required - `website` string, required: The account's website URL. - `hasMore` boolean, required: Another page exists. When `false` you have reached the end — stop requesting pages. - `nextCursor` string, nullable, required: Pass verbatim as the next request's `cursor` to fetch the next page. Null exactly when `hasMore` is false. ## Other responses - `400`: `validation_failed` (`retry: fix_input`) — The request did not pass input validation: a missing or malformed body field, a bad `limit`, a path parameter that is not a UUID, a `signalKey` that already exists or is reserved. `message` lists every failed constraint; `param` names the first offending field when one can be identified. `malformed_cursor` (`retry: fix_input`) — `cursor` was not a value this API issued. Send a previous page's `nextCursor` verbatim, or omit it to start over. - `401`: Missing, malformed, or incorrect bearer token. Every way authentication can fail returns the identical body, so do not try to infer which one it was, and do not repeat the call with the same key. `unauthorized` (`retry: do_not_retry`) — Missing, malformed, or incorrect bearer token. Identical body for every cause. - `403`: The key grant and its owner's current workspace role must both include every scope required by the operation. `insufficient_scope` (`retry: do_not_retry`) — Scope denial details distinguish missing_key_scope (use a key granting every missing scope), owner_permission_limit (the owner needs the missing workspace permissions), and invalid_key_scope (replace the key with supported scopes). Membership and undeclared-route denials remain generic. - `404`: `list_not_found` (`retry: do_not_retry`) — No such list for this key. Lists are scoped to the user your key acts as, so a list another user created in the same workspace is indistinguishable from a non-existent one. - `429`: Every route is rate limited per workspace across REST, MCP, all keys and OAuth users, `GET /v1/whoami` included, so a balance poll competes with the work it is watching. For `rate_limited`, wait `Retry-After` seconds (also `details.retryAfterSeconds`), then send the same request once; do not retry sooner. `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` describe the workspace's bucket, and they come back on successful responses too: read them and slow down BEFORE you are refused. A burst from one network can also be refused before the key is checked; that 429 carries `Retry-After` and no `RateLimit-*` headers. `rate_limited` (`retry: retry_later`) — The workspace or source network exhausted its request budget for one bucket. `details.retryAfterSeconds` (and `Retry-After` on REST) is the wait: wait that long, then retry the same request once. Do not poll or retry sooner; an early retry is refused again. If you cannot wait, stop and tell the user when to retry; do not fill the wait with other calls. `details.limit` and `details.bucket` name the exhausted budget. When present, RateLimit-* headers describe the active budget and reset. - `500`: Something failed on our side. Nothing about the request needs changing. `internal_error` (`retry: retry_later`) — Something failed on our side. `message` never describes it — quote `requestId` when reporting. Retry with exponential backoff and GIVE UP after a few attempts: `retry_later` here does not mean the failure is known to be transient, only that nothing about your request needs changing. A request that fails this way repeatedly will not start working. --- [API](https://skmtc.dev/trayo/apis/trayo-api.md) · [All operations](https://skmtc.dev/trayo/apis/trayo-api/llms.txt) · [OpenAPI document](https://skmtc.dev/trayo/apis/trayo-api/revisions/0af452dce6de?raw)