The App access panel of a client
const url = 'http://localhost:8000/api/clients/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/access/';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url http://localhost:8000/api/clients/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/access/ \ --header 'Authorization: Bearer <token>'Everyone with access to the card — invited, active, expired or revoked, oldest first — and the card’s portal settings: auto_share and upload_monthly_cap. minor says whether only a guardian can be invited (null: no date of birth yet, so the athlete invite waits for one).
A coach of the team, on a card of the active team. Every route answers 404 while client access is switched off on the environment. A partner API key and a client’s own account get 403. Open on every plan: a coach on a team whose plan no longer includes client access still sees who has it and can revoke it.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Query Parameters
Section titled “Query Parameters”en (default) · ru · es: the fallback name of a coach who gave none.
Responses
Section titled “Responses”GET /api/clients/<id>/access/ — the App access panel
(ClientAccessOverview).
object
Release new completed sessions to the client’s side automatically (off by default).
Clips the card’s Contribute people may send per calendar month; 0 turns uploads off.
True for a minor (under 18 by the date of birth, or declared so): only a guardian can be invited. Null when the card has no date of birth and nothing declared — the athlete invite waits for one.
One person with access to a card, as the coach sees it
(ClientAccessRecord).
object
The address the invite went to.
The person’s name once they accepted; empty until then.
invited · active · expired · revoked. expired is an invite whose 14-day link lapsed; the coach can resend it.
invited- Invitedactive- Activeexpired- Expiredrevoked- Revoked
The invite’s language. Later e-mails to this person use it too.
en- Englishru- Русскийes- Español
Who sent the invite, for the team’s coaches: the inviting coach’s name, else their e-mail address; once their account is gone, the name it left, else “A coach” in ?lang (English by default).
When the invite link lapses — set only while the status is invited.
When the last invite or sign-in e-mail left; null when none ever did.
Whether the e-mail reached the person (false: the transport refused it — the grant stands, resend it). On an invite or resend answer: this call’s e-mail, null when the call sent nothing on purpose (a second resend within a minute). On every other answer: the latest attempt’s, null when none was ever made.
Whether inviting, resending, changing a level and sharing would pass the plan gate now: the team is not read-only AND its plan includes client access. False: those answer 402 — show the upgrade instead of the button.
Examples
A guardian on a minor's card
{ "auto_share": true, "upload_monthly_cap": 4, "minor": true, "people": [ { "id": "0b9e4d21-7a3c-4f6e-8d15-3c2a9b7e6f58", "email": "olga.lebedeva@example.com", "display_name": "Olga Lebedeva", "relation": "guardian", "level": "contribute", "status": "active", "language": "ru", "invited_by_name": "Kim Larsen", "invited_at": "2026-10-06T09:00:00Z", "expires_at": null, "accepted_at": "2026-10-07T18:20:00Z", "revoked_at": null, "last_sent_at": "2026-10-06T09:00:00Z", "email_sent": true } ], "can_invite": true}No date of birth on the card
minor: null — the athlete invite waits for a date of birth.
{ "auto_share": false, "upload_monthly_cap": 4, "minor": null, "people": [], "can_invite": true}A plan without client access
can_invite: false — inviting, resending and sharing answer 402; seeing and revoking stay open.
{ "auto_share": false, "upload_monthly_cap": 4, "minor": true, "people": [ { "id": "0b9e4d21-7a3c-4f6e-8d15-3c2a9b7e6f58", "email": "olga.lebedeva@example.com", "display_name": "Olga Lebedeva", "relation": "guardian", "level": "contribute", "status": "active", "language": "ru", "invited_by_name": "Kim Larsen", "invited_at": "2026-10-06T09:00:00Z", "expires_at": null, "accepted_at": "2026-10-07T18:20:00Z", "revoked_at": null, "last_sent_at": "2026-10-06T09:00:00Z", "email_sent": true } ], "can_invite": false}object
Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).
Example generated
{ "detail": "example"}object
Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).
Examples
403 — a client's own account
The coach side is for a coach of the team; a client uses the portal.
{ "detail": "client_account"}object
Human-readable message, or a stable machine code for the cases a client branches on. The standard envelope for 400 (validation — a field-keyed object may appear instead), 401 (missing / invalid credentials), 403 (authenticated but not permitted), and 404 (absent — cross-team records are collapsed to 404 so the API never leaks the existence of another team’s data).
Examples
404 — no such client in the team
{ "detail": "client_not_found"}