Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.
Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.
Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
mem0_delete_api_v1_orgs_organizations_by_org_idWRITEDelete an organization, and with it every project and memory underneath it (Platform) via DELETE /api/v1/orgs/organizations/{org_id}
mem0_delete_api_v1_orgs_organizations_by_org_id_membersWRITERemove a member from the organization; the target email address rides in the request body rather than in the path (Platform) via DELETE /api/v1/orgs/organizations/{org_id}/members
mem0_delete_api_v1_orgs_organizations_by_org_id_projects_by_project_idWRITEDelete a project, and with it the memories stored under it (Platform) via DELETE /api/v1/orgs/organizations/{org_id}/projects/{project_id}
mem0_delete_api_v1_orgs_organizations_by_org_id_projects_by_project_id_membersWRITERemove a member from the project; the target email address is a REQUIRED query parameter (Platform) via DELETE /api/v1/orgs/organizations/{org_id}/projects/{project_id}/members
mem0_delete_api_v1_webhooks_by_webhook_idWRITEDelete one webhook by its id (Platform) via DELETE /api/v1/webhooks/{webhook_id}
mem0_delete_v1_batchWRITEDelete the memories named in the request body -- a DELETE whose targets are carried as a body rather than in the path (Memory v1) via DELETE /v1/batch
mem0_delete_v1_entities_by_entity_type_by_entity_idWRITEDelete one entity by type and id through the v1 route; the v2 route is the current one (Memory v1) via DELETE /v1/entities/{entity_type}/{entity_id}
mem0_delete_v1_memoriesWRITEDelete EVERY memory matching the given entity and metadata filters. Unbounded: a call that names no filter targets everything the key can reach (Memory v1) via DELETE /v1/memories
mem0_delete_v1_memories_by_memory_idWRITEDelete one memory by id, optionally deleting the memories linked to it (Memory v1) via DELETE /v1/memories/{memory_id}
mem0_delete_v2_entities_by_entity_type_by_entity_idWRITEDelete one entity, addressed by its type and id (v2) (Memory v2) via DELETE /v2/entities/{entity_type}/{entity_id}
mem0_get_api_v1_orgs_organizationsREADList the organizations this API key can see (Platform) via GET /api/v1/orgs/organizations
mem0_get_api_v1_orgs_organizations_by_org_idREADRead one organization by its id (Platform) via GET /api/v1/orgs/organizations/{org_id}
mem0_get_api_v1_orgs_organizations_by_org_id_membersREADList an organization's members and the role each holds (Platform) via GET /api/v1/orgs/organizations/{org_id}/members
mem0_get_api_v1_orgs_organizations_by_org_id_projectsREADList the projects in one organization (Platform) via GET /api/v1/orgs/organizations/{org_id}/projects
mem0_get_api_v1_orgs_organizations_by_org_id_projects_by_project_idREADRead one project by its id (Platform) via GET /api/v1/orgs/organizations/{org_id}/projects/{project_id}
mem0_get_api_v1_orgs_organizations_by_org_id_projects_by_project_id_dream_activityREADList a project's Dream reflection activity, cursor-paginated (Platform) via GET /api/v1/orgs/organizations/{org_id}/projects/{project_id}/dream/activity
mem0_get_api_v1_orgs_organizations_by_org_id_projects_by_project_id_dream_configREADRead a project's Dream reflection configuration (Platform) via GET /api/v1/orgs/organizations/{org_id}/projects/{project_id}/dream/config
mem0_get_api_v1_orgs_organizations_by_org_id_projects_by_project_id_dream_memory_by_memory_id_sourcesREADList the source memories a Dream-derived memory was built from (Platform) via GET /api/v1/orgs/organizations/{org_id}/projects/{project_id}/dream/memory/{memory_id}/sources
mem0_get_api_v1_orgs_organizations_by_org_id_projects_by_project_id_dream_runsREADList a project's Dream reflection runs, cursor-paginated (Platform) via GET /api/v1/orgs/organizations/{org_id}/projects/{project_id}/dream/runs
mem0_get_api_v1_orgs_organizations_by_org_id_projects_by_project_id_dream_runs_by_run_id_memoriesREADList the memories one Dream reflection run produced, cursor-paginated (Platform) via GET /api/v1/orgs/organizations/{org_id}/projects/{project_id}/dream/runs/{run_id}/memories
mem0_get_api_v1_orgs_organizations_by_org_id_projects_by_project_id_dream_statsREADRead Dream reflection statistics for a project (Platform) via GET /api/v1/orgs/organizations/{org_id}/projects/{project_id}/dream/stats
mem0_get_api_v1_orgs_organizations_by_org_id_projects_by_project_id_membersREADList a project's members and the role each holds (Platform) via GET /api/v1/orgs/organizations/{org_id}/projects/{project_id}/members
mem0_get_api_v1_webhooks_projects_by_project_idREADList the webhooks registered on one project (Platform) via GET /api/v1/webhooks/projects/{project_id}
mem0_get_v1_entitiesREADList the users, agents, apps and runs memories are attributed to, optionally narrowed to one organization or project (Memory v1) via GET /v1/entities
mem0_get_v1_entities_filtersREADList the filter values available when querying entities (Memory v1) via GET /v1/entities/filters
mem0_get_v1_event_by_event_idREADRead one event by its id (Memory v1) via GET /v1/event/{event_id}
mem0_get_v1_eventsREADList the events recorded in the project the key resolves to (Memory v1) via GET /v1/events
mem0_get_v1_memoriesREADList memories narrowed by entity, metadata, categories, keywords, fields and date range, as v1 query parameters (Memory v1) via GET /v1/memories
mem0_get_v1_memories_by_entity_type_by_entity_idREADList the memories attributed to one entity, addressed by type and id (Memory v1) via GET /v1/memories/{entity_type}/{entity_id}
mem0_get_v1_memories_by_memory_idREADRead one memory by its id (Memory v1) via GET /v1/memories/{memory_id}
mem0_get_v1_memories_by_memory_id_historyREADRead the revision history of one memory (Memory v1) via GET /v1/memories/{memory_id}/history
mem0_get_v1_memories_eventsREADList the change events recorded against memories, paginated (Memory v1) via GET /v1/memories/events
mem0_get_v1_pingREADCheck the API key and resolve the organization and project it belongs to -- the cheapest authenticated read Mem0 publishes (Memory v1) via GET /v1/ping
mem0_get_v1_statsREADRead usage statistics for the organization and project the key resolves to (Memory v1) via GET /v1/stats
mem0_get_v2_entities_by_entity_type_by_entity_idREADRead one entity, addressed by its type and id (v2) (Memory v2) via GET /v2/entities/{entity_type}/{entity_id}
mem0_patch_api_v1_orgs_organizations_by_org_id_projects_by_project_idWRITEChange a project's name, description, custom instructions, custom categories, memory depth, decay, graph and multilingual settings (Platform) via PATCH /api/v1/orgs/organizations/{org_id}/projects/{project_id}
mem0_patch_api_v1_orgs_organizations_by_org_id_projects_by_project_id_dream_configWRITETurn Dream reflection on or off for a project and set its mode (Platform) via PATCH /api/v1/orgs/organizations/{org_id}/projects/{project_id}/dream/config
mem0_post_api_v1_orgs_organizationsWRITECreate an organization with the given name (Platform) via POST /api/v1/orgs/organizations
mem0_post_api_v1_orgs_organizations_by_org_id_membersWRITEAdd a member to the organization by email address, with a role (Platform) via POST /api/v1/orgs/organizations/{org_id}/members
mem0_post_api_v1_orgs_organizations_by_org_id_projectsWRITECreate a project in the organization with the given name (Platform) via POST /api/v1/orgs/organizations/{org_id}/projects
mem0_post_api_v1_orgs_organizations_by_org_id_projects_by_project_id_dream_previewWRITEAsk for a preview of what Dream reflection would produce for a project (Platform) via POST /api/v1/orgs/organizations/{org_id}/projects/{project_id}/dream/preview
mem0_post_api_v1_orgs_organizations_by_org_id_projects_by_project_id_membersWRITEAdd a member to the project by email address, with a role (Platform) via POST /api/v1/orgs/organizations/{org_id}/projects/{project_id}/members
mem0_post_api_v1_webhooks_projects_by_project_idWRITERegister a webhook on a project for the named event types (Platform) via POST /api/v1/webhooks/projects/{project_id}
mem0_post_v1_agentsWRITERegister an agent entity so memories can be attributed to it; takes an agent_id, a name and optional metadata (Memory v1) via POST /v1/agents
mem0_post_v1_appsWRITERegister an app entity so memories can be attributed to it; takes an app_id, a name and optional metadata (Memory v1) via POST /v1/apps
mem0_post_v1_exportsWRITEStart an export of the memories matching `filters` into the structure the required `schema` describes (Memory v1) via POST /v1/exports
mem0_post_v1_exports_getWRITERetrieve a previously requested export by its id or by filters; a POST because the selector rides in the body (Memory v1) via POST /v1/exports/get
mem0_post_v1_feedbackWRITERecord feedback against one memory id, with an optional reason (Memory v1) via POST /v1/feedback
mem0_post_v1_memoriesWRITEAdd memories inferred from a message list, with categories, custom instructions, metadata and expiry options; the v1 add route, superseded by the v3 one (Memory v1) via POST /v1/memories
mem0_post_v1_memories_searchWRITESemantic search over memories with a query string and v1 entity filters, optional keyword search, reranking and top_k (Memory v1) via POST /v1/memories/search
mem0_post_v1_runsWRITERegister a run entity so memories can be attributed to it; takes a run_id, a name and optional metadata (Memory v1) via POST /v1/runs
mem0_post_v1_summaryWRITEProduce a summary of the memories matching a required `filters` object (Memory v1) via POST /v1/summary
mem0_post_v1_usersWRITERegister a user entity so memories can be attributed to it; takes a user_id and optional metadata (Memory v1) via POST /v1/users
mem0_post_v2_memoriesWRITEList memories with a REQUIRED v2 `filters` object in the request body -- a different request shape from the v1 query-parameter form, and a different filter semantics (Memory v2) via POST /v2/memories
mem0_post_v2_memories_searchWRITESemantic search with a REQUIRED v2 `filters` object beside the query, plus reranking, a score threshold and top_k (Memory v2) via POST /v2/memories/search
mem0_post_v3_memoriesWRITEList memories with a required v3 `filters` object plus categories, keywords, fields, date range and expired-memory handling (Memory v3) via POST /v3/memories
mem0_post_v3_memories_addWRITEAdd memories from a message list (v3), with graph extraction, temporal reasoning, structured-data schema, categories, custom instructions and expiry options (Memory v3) via POST /v3/memories/add
mem0_post_v3_memories_searchWRITESemantic search (v3) with a required `filters` object, categories, a reference date, reranking, a threshold and expired-memory handling (Memory v3) via POST /v3/memories/search
mem0_put_api_v1_orgs_organizations_by_org_id_membersWRITEChange one organization member's role; the member is named by email address in the request body (Platform) via PUT /api/v1/orgs/organizations/{org_id}/members
mem0_put_api_v1_orgs_organizations_by_org_id_projects_by_project_id_membersWRITEChange one project member's role; the member is named by email address in the request body (Platform) via PUT /api/v1/orgs/organizations/{org_id}/projects/{project_id}/members
mem0_put_api_v1_webhooks_by_webhook_idWRITEChange a webhook's URL, name or event types (Platform) via PUT /api/v1/webhooks/{webhook_id}
mem0_put_v1_batchWRITEUpdate several memories in one request; the memories ride in the request body (Memory v1) via PUT /v1/batch
mem0_put_v1_memories_by_memory_idWRITEReplace one memory's text, metadata or expiration date (Memory v1) via PUT /v1/memories/{memory_id}
Put Mem0 behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.