Organization resources

Administer every resource in the organization.

These endpoints see and act on every map, workflow, connection and access token in the organization, whoever owns it. They exist for administration: auditing what exists, cleaning up after someone leaves, or handing a departing user's work to a colleague.

Endpoint	What it does
GET /v3/accounts/resources	List all resources in the organization
POST /v3/accounts/resources/delete-batch	Delete resources in batch
POST /v3/accounts/resources/transfer	Transfer resources to another user

These endpoints require the Superadmin role and an OAuth Access Token. An Admin token is not enough. See Authorization.

Batch operations report failures per item

delete-batch and transfer return 200 even when some items fail. Each entry in the response carries success, and a failureReason when it is false — always check per-item results rather than relying on the status code.

Transferring before offboarding

transfer moves ownership to another user, which is the safe alternative to deleting someone's work when they leave. Send receiverUserId with the list of resources.

Endpoints

List all resources in the organization

get

https://gcp-us-east1.api.carto.comhttps://gcp-europe-west1.api.carto.comhttps://gcp-asia-northeast1.api.carto.comhttps://gcp-australia-southeast1.api.carto.comhttps://your-carto-tenant-domain.com/api

/v3/accounts/resources

Lists every map, workflow, connection or access token in the organization, regardless of owner.

Requires the Superadmin role.

Authorizations

accessToken

AuthorizationstringRequired

An API Access Token or an OAuth Access Token, sent as Authorization: Bearer <token>.

Query parameters

resourceTypestring · enumRequiredPossible values:

qstring · min: 1Optional

Free-text search.

orderBystring · enumOptionalDefault: updatedAtPossible values:

orderDirectionstring · enumOptionalPossible values:

pageinteger · min: 1OptionalDefault: 1

pageSizeintegerOptionalDefault: 10

Responses

200

The resources. Access tokens are masked to their last 5 characters.

application/json

400

The request is malformed or a parameter failed validation.

application/json

401

The token is missing, malformed or expired.

application/json

403

The token doesn't grant access to this resource.

application/json

get/v3/accounts/resources

HTTPcURLJavaScriptPython

GET /v3/accounts/resources?resourceType=map HTTP/1.1
Host: gcp-us-east1.api.carto.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "meta": {
    "page": {
      "current": 1,
      "pageSize": 1,
      "total": null,
      "totalPages": null
    }
  },
  "links": {
    "prev": null,
    "next": null
  },
  "data": [
    {
      "ANY_ADDITIONAL_PROPERTY": "anything"
    }
  ]
}

Delete resources in batch

post

https://gcp-us-east1.api.carto.comhttps://gcp-europe-west1.api.carto.comhttps://gcp-asia-northeast1.api.carto.comhttps://gcp-australia-southeast1.api.carto.comhttps://your-carto-tenant-domain.com/api

/v3/accounts/resources/delete-batch

Deletes several resources at once.

Individual failures are reported per item — the request still returns 200. Check success on each entry.

Requires the Superadmin role.

Authorizations

accessToken

AuthorizationstringRequired

An API Access Token or an OAuth Access Token, sent as Authorization: Bearer <token>.

Bodyobject · ResourceRef[]

application/json

idstringRequired

resourceTypestring · enumRequiredPossible values:

Responses

200

The result for each resource.

application/json

idstringOptional

resourceTypestring · enumOptionalPossible values:

successbooleanOptional

failureReasonstringOptional

Only present when success is false.

400

The request is malformed or a parameter failed validation.

application/json

401

The token is missing, malformed or expired.

application/json

403

The token doesn't grant access to this resource.

application/json

post/v3/accounts/resources/delete-batch

HTTPcURLJavaScriptPython

POST /v3/accounts/resources/delete-batch HTTP/1.1
Host: gcp-us-east1.api.carto.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 68

[
  {
    "id": "5a32a0ea-555a-48dd-aeb1-8768aae8ef1c",
    "resourceType": "map"
  }
]

[
  {
    "id": "text",
    "resourceType": "map",
    "success": true,
    "failureReason": "text"
  }
]

Transfer resources to another user

post

https://gcp-us-east1.api.carto.comhttps://gcp-europe-west1.api.carto.comhttps://gcp-asia-northeast1.api.carto.comhttps://gcp-australia-southeast1.api.carto.comhttps://your-carto-tenant-domain.com/api

/v3/accounts/resources/transfer

Moves ownership of several resources to another user.

Individual failures are reported per item — the request still returns 200. Check success on each entry.

Requires the Superadmin role.

Authorizations

accessToken

AuthorizationstringRequired

An API Access Token or an OAuth Access Token, sent as Authorization: Bearer <token>.

Body

application/json

receiverUserIdstring · min: 1Required

The user who will own the resources.

Responses

200

The result for each resource.

application/json

idstringOptional

resourceTypestring · enumOptionalPossible values:

successbooleanOptional

failureReasonstringOptional

Only present when success is false.

400

The request is malformed or a parameter failed validation.

application/json

401

The token is missing, malformed or expired.

application/json

403

The token doesn't grant access to this resource.

application/json

post/v3/accounts/resources/transfer

HTTPcURLJavaScriptPython

POST /v3/accounts/resources/transfer HTTP/1.1
Host: gcp-us-east1.api.carto.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 131

{
  "receiverUserId": "auth0|61164b7xxx77c006a259f53",
  "resources": [
    {
      "id": "5a32a0ea-555a-48dd-aeb1-8768aae8ef1c",
      "resourceType": "map"
    }
  ]
}

[
  {
    "id": "text",
    "resourceType": "map",
    "success": true,
    "failureReason": "text"
  }
]