How to share ownership of a profile

Every profile has one owner and one access list. Each entry on the list gives one person, one team, or one app a role on this profile:

A reader reads the parts you pick, beyond what the public sees.
An editor edits the content and pushes updates, but cannot publish, delete, or change the list.
A co-owner can do everything the owner can, except hand the profile over.

People, teams, and apps can also ask you for a role. You approve or deny each request.

API keys you make are a separate thing: a key acts for you, set part by part on your Privacy page. See Letting one tool act for you.

For how these relate to identity and the one owner per profile, see Core concepts.

Prerequisites

You are signed in, and you own or co-own the profile. Editors can see the list but not change it.
You know the profile’s slug, and the person’s ORCID iD or email (or the team or app you want to add).

Add someone

The easy way is the Access tab of your profile (/manage/<slug>/access). Pick a person (by ORCID iD or email), a team, or an app, choose Reader, Editor, or Co-owner, and click Add. For a reader, also pick the parts it may read (the Basics, Extended, and Read all presets fill them in). The same tab lists everyone on the profile, lets you change a role, removes people, and shows pending invites and requests.

To do the same from the command line:

Post the entry. role is reader, editor, or co-owner. Name exactly one target: orcid, email, team_id, or app_id. A reader also takes parts ({"summary": "read", ...}) or a preset (basics, extended, or read_all, the default):
Terminal window
```
curl -b "rp_session=<your-cookie>" \
  -H "Content-Type: application/json" \
  -X POST https://prosopia.databio.org/api/v1/manage/profiles/jane-doe/access \
  -d '{"orcid": "0000-0002-7115-4020", "role": "editor"}'
```
Naming a person by ORCID creates or reuses their account, so they do not need to sign up first. It takes effect when they next sign in.

Naming a person by email is how you add someone who signs in with Google or GitHub. If an account already signs in with that verified email, it is added now. If not, the email is saved as a pending invite, and the first person to sign in (or link a login) with that verified email is added; the invite is then used up. If the email belongs to more than one account, such as a shared lab inbox, it is refused; add the person by ORCID instead. No email is sent; tell them yourself. Case and outer spaces in the email do not matter.

A team (team_id) gives everyone in the team the role. An app (app_id) must be a platform app; GET /api/v1/account/apps lists them.

Confirm. It returns 201 Created with the entry:

{
  "id": 7,
  "principal": {"id": 58, "kind": "user", "name": "Sam Lee", "user_id": 42,
                "orcid": "0000-0002-7115-4020", "email": null, "platform": false},
  "role": "editor",
  "parts": {},
  "preset": null,
  "asked_by": null,
  "granted_by": 1,
  "created_at": "2026-10-31T12:00:00+00:00",
  "updated_at": "2026-10-31T12:00:00+00:00"
}

Adding by email answers {"entries": [...], "invite": null} when it found an account, or {"entries": [], "invite": {"id": 3, "email": ...}} when it saved an invite.

Ownership is not transferable here. A profile has exactly one owner, and the owner never appears on the list.

Profiles made before the access list existed, and profiles nobody has claimed yet, list the Sponsus app as a reader of four clinical parts (clinical, site capabilities, regulatory experience, trials). You can remove it like any other entry.

List who has access

The owner, co-owners, and editors may read the list. It has the owner, the entries, your own role, and can_manage. The owner and co-owners also see emails, pending invites, and pending requests; editors do not:

curl -b "rp_session=<your-cookie>" \
  https://prosopia.databio.org/api/v1/manage/profiles/jane-doe/access

Change a role or remove someone

Use the entry id from the list (or the invite id under /invites/). A change takes a new role, and for a reader parts or a preset:

curl -b "rp_session=<your-cookie>" -H "Content-Type: application/json" \
  -X PATCH https://prosopia.databio.org/api/v1/manage/profiles/jane-doe/access/7 \
  -d '{"role": "co-owner"}'
curl -b "rp_session=<your-cookie>" \
  -X DELETE https://prosopia.databio.org/api/v1/manage/profiles/jane-doe/access/7
curl -b "rp_session=<your-cookie>" \
  -X DELETE https://prosopia.databio.org/api/v1/manage/profiles/jane-doe/access/invites/3

A removal takes effect on the next request.

Ask for access, and answer requests

Any signed-in person, or any platform app, that can see a profile may ask for a role on it: reader (with the parts wanted) or editor. Nobody can ask to be a co-owner; only an owner or co-owner can give that. There is at most one pending request per asker and profile.

Ask. With no target you ask for yourself. team_id asks for a team you belong to. app_id with asked_by_team_id asks for a platform app on behalf of your team. An app’s own key asks for itself (see Integrate your app):
Terminal window
```
curl -b "rp_session=<your-cookie>" \
  -H "Content-Type: application/json" \
  -X POST https://prosopia.databio.org/api/v1/manage/profiles/jane-doe/access-requests \
  -d '{"role": "reader", "preset": "extended", "message": "For our lab directory."}'
```
It returns 201 Created with the request, including its id. The asking side can take it back with POST /api/v1/account/access-requests/{id}/withdraw.

Answer. The owner and co-owners see pending requests on the profile’s Access tab. From the command line, list every request on profiles you manage, then approve or deny one:

curl -b "rp_session=<your-cookie>" \
  "https://prosopia.databio.org/api/v1/account/access-requests?status=pending"
curl -b "rp_session=<your-cookie>" -H "Content-Type: application/json" \
  -X POST https://prosopia.databio.org/api/v1/account/access-requests/12/approve \
  -d '{}'
curl -b "rp_session=<your-cookie>" \
  -X POST https://prosopia.databio.org/api/v1/account/access-requests/12/deny

Approving with an empty body grants what was asked. To grant something else, send role and, for a reader, parts or a preset.

What can go wrong

400: an invalid role, parts, or preset; naming the owner; giving more or fewer than one target; an email that is not an email address; or asking for an app without asked_by_team_id.
401: you are not logged in.
403: you are an editor or reader, not the owner or a co-owner, so you cannot change the list; you asked for a team you are not in; or you are calling with a personal API key (keys never manage or ask; sign in).
404: no such entry, invite, request, team, or app. Also the answer for a profile you are not allowed to see: it looks exactly like a profile that does not exist, never a 403.
409: the email matches more than one account; a request for this profile is already pending (pending_request_exists); or the request was already decided.

Letting one tool act for you

To let a specific tool read or edit on your behalf, make an API key on your Privacy page. The key acts for you: on each profile it gets your access, capped by what you choose, part by part, for the key. Its edits are recorded, and you can revoke it anytime. See Share with applications.