Skip to main content
Provisioning is a workspace-level operation: the API key’s workspace owns every Direct sub-account you create. You’ll need a key with the subaccounts:create scope.

Create a sub-account

POST /v3/subaccounts creates a native (GHL-free) sub-account plus its inbound webhook integration, and returns the webhook URL and secret.
webhookSecret is returned once, only in this create response. Store it now — it’s never shown again. Use it to authenticate the inbound webhook.

Manage users

A user belongs to a sub-account through a role (OWNER, ADMIN, MEMBER, or VIEWER). These endpoints need the subaccounts:update scope (and subaccounts:read to list).
1

Add a user

The password is stored as a bcrypt hash (cost 12) — never in plain text. If the email already belongs to a platform user, that user is linked to the sub-account and their existing password is left untouched.
2

List, update, remove

  • GET /v3/subaccounts/{id}/users — list active members.
  • PATCH /v3/subaccounts/{id}/users/{userId} — change a member’s role.
  • DELETE /v3/subaccounts/{id}/users/{userId} — remove a member (soft).
Removing a member only unlinks them from the sub-account — the underlying user account is never deleted. You can’t remove the last owner; that returns 409 last_owner.