Merge branch 'main' into v1_0_0

CHANGELOG.md

@@ -14,6 +14,10 @@ FEATURE `zrok access private` supports a new `--auto` mode, which can automatica
 
 ## v0.4.45
 
+FEATURE: Minimal support for "organizations". Site admin API endpoints provided to create, list, and delete "organizations". Site admin API endpoints provided to add, list, and remove "organization members" (zrok accounts) with the ability to mark accounts as a "organization admin". API endpoints provided for organization admins to list the members of their organizations, and to also see the overview (environments, shares, and accesses) for any account in their organization. API endpoint for end users to see which organizations their account is a member of (https://github.com/openziti/zrok/issues/537) 
+
+CHANGE: briefly mention the backend modes that apply to public and private share concepts
+
 FIX: Update indirect dependency `github.com/golang-jwt/jwt/v4` to version `v4.5.1` (https://github.com/openziti/zrok/issues/794)
 
 FIX: Document unique names
@@ -24,7 +28,6 @@ FIX: Docker reserved private share startup error (https://github.com/openziti/zr
 
 FIX: Correct the download URL for the armv7 Linux release (https://github.com/openziti/zrok/issues/782)
 
-CHANGE: briefly mention the backend modes that apply to public and private share concepts
 
 ## v0.4.44
 

cmd/zrok/adminCreateOrgMember.go

@@ -0,0 +1,54 @@
+package main
+
+import (
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/rest_client_zrok/admin"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	adminCreateCmd.AddCommand(newAdminCreateOrgMemberCommand().cmd)
+}
+
+type adminCreateOrgMemberCommand struct {
+	cmd   *cobra.Command
+	admin bool
+}
+
+func newAdminCreateOrgMemberCommand() *adminCreateOrgMemberCommand {
+	cmd := &cobra.Command{
+		Use:     "org-member <organizationToken> <accountEmail>",
+		Aliases: []string{"member"},
+		Short:   "Add an account to an organization",
+		Args:    cobra.ExactArgs(2),
+	}
+	command := &adminCreateOrgMemberCommand{cmd: cmd}
+	cmd.Flags().BoolVar(&command.admin, "admin", false, "Make the new account an admin of the organization")
+	cmd.Run = command.run
+	return command
+}
+
+func (cmd *adminCreateOrgMemberCommand) run(_ *cobra.Command, args []string) {
+	env, err := environment.LoadRoot()
+	if err != nil {
+		panic(err)
+	}
+
+	zrok, err := env.Client()
+	if err != nil {
+		panic(err)
+	}
+
+	req := admin.NewAddOrganizationMemberParams()
+	req.Body.Token = args[0]
+	req.Body.Email = args[1]
+	req.Body.Admin = cmd.admin
+
+	_, err = zrok.Admin.AddOrganizationMember(req, mustGetAdminAuth())
+	if err != nil {
+		panic(err)
+	}
+
+	logrus.Infof("added '%v' to organization '%v", args[0], args[1])
+}

cmd/zrok/adminCreateOrganization.go

@@ -0,0 +1,52 @@
+package main
+
+import (
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/rest_client_zrok/admin"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	adminCreateCmd.AddCommand(newAdminCreateOrganizationCommand().cmd)
+}
+
+type adminCreateOrganizationCommand struct {
+	cmd         *cobra.Command
+	description string
+}
+
+func newAdminCreateOrganizationCommand() *adminCreateOrganizationCommand {
+	cmd := &cobra.Command{
+		Use:     "organization",
+		Aliases: []string{"org"},
+		Short:   "Create a new organization",
+		Args:    cobra.NoArgs,
+	}
+	command := &adminCreateOrganizationCommand{cmd: cmd}
+	cmd.Flags().StringVarP(&command.description, "description", "d", "", "Organization description")
+	cmd.Run = command.run
+	return command
+}
+
+func (cmd *adminCreateOrganizationCommand) run(_ *cobra.Command, _ []string) {
+	env, err := environment.LoadRoot()
+	if err != nil {
+		panic(err)
+	}
+
+	zrok, err := env.Client()
+	if err != nil {
+		panic(err)
+	}
+
+	req := admin.NewCreateOrganizationParams()
+	req.Body = admin.CreateOrganizationBody{Description: cmd.description}
+
+	resp, err := zrok.Admin.CreateOrganization(req, mustGetAdminAuth())
+	if err != nil {
+		panic(err)
+	}
+
+	logrus.Infof("created new organization with token '%v'", resp.Payload.Token)
+}

cmd/zrok/adminDeleteOrgMember.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/rest_client_zrok/admin"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	adminDeleteCmd.AddCommand(newAdminDeleteOrgMemberCommand().cmd)
+}
+
+type adminDeleteOrgMemberCommand struct {
+	cmd *cobra.Command
+}
+
+func newAdminDeleteOrgMemberCommand() *adminDeleteOrgMemberCommand {
+	cmd := &cobra.Command{
+		Use:     "org-member <organizationToken> <accountEmail>",
+		Aliases: []string{"member"},
+		Short:   "Remove an account from an organization",
+		Args:    cobra.ExactArgs(2),
+	}
+	command := &adminDeleteOrgMemberCommand{cmd: cmd}
+	cmd.Run = command.run
+	return command
+}
+
+func (cmd *adminDeleteOrgMemberCommand) run(_ *cobra.Command, args []string) {
+	env, err := environment.LoadRoot()
+	if err != nil {
+		panic(err)
+	}
+
+	zrok, err := env.Client()
+	if err != nil {
+		panic(err)
+	}
+
+	req := admin.NewRemoveOrganizationMemberParams()
+	req.Body.Token = args[0]
+	req.Body.Email = args[1]
+
+	_, err = zrok.Admin.RemoveOrganizationMember(req, mustGetAdminAuth())
+	if err != nil {
+		panic(err)
+	}
+
+	logrus.Infof("removed '%v' from organization '%v", args[0], args[1])
+}

cmd/zrok/adminDeleteOrganization.go

@@ -0,0 +1,50 @@
+package main
+
+import (
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/rest_client_zrok/admin"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+func init() {
+	adminDeleteCmd.AddCommand(newAdminDeleteOrganizationCommand().cmd)
+}
+
+type adminDeleteOrganizationCommand struct {
+	cmd *cobra.Command
+}
+
+func newAdminDeleteOrganizationCommand() *adminDeleteOrganizationCommand {
+	cmd := &cobra.Command{
+		Use:     "organization <organizationToken>",
+		Aliases: []string{"org"},
+		Short:   "Delete an organization",
+		Args:    cobra.ExactArgs(1),
+	}
+	command := &adminDeleteOrganizationCommand{cmd: cmd}
+	cmd.Run = command.run
+	return command
+}
+
+func (cmd *adminDeleteOrganizationCommand) run(_ *cobra.Command, args []string) {
+	env, err := environment.LoadRoot()
+	if err != nil {
+		panic(err)
+	}
+
+	zrok, err := env.Client()
+	if err != nil {
+		panic(err)
+	}
+
+	req := admin.NewDeleteOrganizationParams()
+	req.Body.Token = args[0]
+
+	_, err = zrok.Admin.DeleteOrganization(req, mustGetAdminAuth())
+	if err != nil {
+		panic(err)
+	}
+
+	logrus.Infof("deleted organization with token '%v'", args[0])
+}

cmd/zrok/adminListOrgMembers.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"fmt"
+	"github.com/jedib0t/go-pretty/v6/table"
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/rest_client_zrok/admin"
+	"github.com/spf13/cobra"
+	"os"
+)
+
+func init() {
+	adminListCmd.AddCommand(newAdminListOrgMembersCommand().cmd)
+}
+
+type adminListOrgMembersCommand struct {
+	cmd *cobra.Command
+}
+
+func newAdminListOrgMembersCommand() *adminListOrgMembersCommand {
+	cmd := &cobra.Command{
+		Use:     "org-members <organizationToken>",
+		Aliases: []string{"members"},
+		Short:   "List the members of the specified organization",
+		Args:    cobra.ExactArgs(1),
+	}
+	command := &adminListOrgMembersCommand{cmd: cmd}
+	cmd.Run = command.run
+	return command
+}
+
+func (cmd *adminListOrgMembersCommand) run(_ *cobra.Command, args []string) {
+	env, err := environment.LoadRoot()
+	if err != nil {
+		panic(err)
+	}
+
+	zrok, err := env.Client()
+	if err != nil {
+		panic(err)
+	}
+
+	req := admin.NewListOrganizationMembersParams()
+	req.Body.Token = args[0]
+
+	resp, err := zrok.Admin.ListOrganizationMembers(req, mustGetAdminAuth())
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println()
+	t := table.NewWriter()
+	t.SetOutputMirror(os.Stdout)
+	t.SetStyle(table.StyleColoredDark)
+	t.AppendHeader(table.Row{"Account Email", "Admin?"})
+	for _, member := range resp.Payload.Members {
+		t.AppendRow(table.Row{member.Email, member.Admin})
+	}
+	t.Render()
+	fmt.Println()
+}

cmd/zrok/adminListOrganizations.go

@@ -0,0 +1,59 @@
+package main
+
+import (
+	"fmt"
+	"github.com/jedib0t/go-pretty/v6/table"
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/rest_client_zrok/admin"
+	"github.com/spf13/cobra"
+	"os"
+)
+
+func init() {
+	adminListCmd.AddCommand(newAdminListOrganizationsCommand().cmd)
+}
+
+type adminListOrganizationsCommand struct {
+	cmd *cobra.Command
+}
+
+func newAdminListOrganizationsCommand() *adminListOrganizationsCommand {
+	cmd := &cobra.Command{
+		Use:     "organizations",
+		Aliases: []string{"orgs"},
+		Short:   "List all organizations",
+		Args:    cobra.NoArgs,
+	}
+	command := &adminListOrganizationsCommand{cmd}
+	cmd.Run = command.run
+	return command
+}
+
+func (c *adminListOrganizationsCommand) run(_ *cobra.Command, _ []string) {
+	env, err := environment.LoadRoot()
+	if err != nil {
+		panic(err)
+	}
+
+	zrok, err := env.Client()
+	if err != nil {
+		panic(err)
+	}
+
+	req := admin.NewListOrganizationsParams()
+	resp, err := zrok.Admin.ListOrganizations(req, mustGetAdminAuth())
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println()
+	t := table.NewWriter()
+	t.SetOutputMirror(os.Stdout)
+	t.SetStyle(table.StyleColoredDark)
+	t.AppendHeader(table.Row{"Organization Token", "Description"})
+	for _, org := range resp.Payload.Organizations {
+		t.AppendRow(table.Row{org.Token, org.Description})
+	}
+	t.Render()
+	fmt.Println()
+}

cmd/zrok/main.go

@@ -32,6 +32,8 @@ func init() {
 	rootCmd.AddCommand(adminCmd)
 	rootCmd.AddCommand(configCmd)
 	rootCmd.AddCommand(modifyCmd)
+	organizationCmd.AddCommand(organizationAdminCmd)
+	rootCmd.AddCommand(organizationCmd)
 	rootCmd.AddCommand(shareCmd)
 	rootCmd.AddCommand(testCmd)
 	rootCmd.AddCommand(gendoc.NewGendocCmd(rootCmd))
@@ -119,6 +121,17 @@ var modifyCmd = &cobra.Command{
 	Short:   "Modify resources",
 }
 
+var organizationAdminCmd = &cobra.Command{
+	Use:   "admin",
+	Short: "Organization admin commands",
+}
+
+var organizationCmd = &cobra.Command{
+	Use:     "organization",
+	Aliases: []string{"org"},
+	Short:   "Organization commands",
+}
+
 var shareCmd = &cobra.Command{
 	Use:   "share",
 	Short: "Create backend access for shares",

cmd/zrok/orgAdminList.go

@@ -0,0 +1,76 @@
+package main
+
+import (
+	"fmt"
+	httptransport "github.com/go-openapi/runtime/client"
+	"github.com/jedib0t/go-pretty/v6/table"
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/rest_client_zrok/metadata"
+	"github.com/openziti/zrok/tui"
+	"github.com/spf13/cobra"
+	"os"
+)
+
+func init() {
+	organizationAdminCmd.AddCommand(newOrgAdminListCommand().cmd)
+}
+
+type orgAdminListCommand struct {
+	cmd *cobra.Command
+}
+
+func newOrgAdminListCommand() *orgAdminListCommand {
+	cmd := &cobra.Command{
+		Use:   "list <organizationToken>",
+		Short: "List the members of an organization",
+		Args:  cobra.ExactArgs(1),
+	}
+	command := &orgAdminListCommand{cmd}
+	cmd.Run = command.run
+	return command
+}
+
+func (c *orgAdminListCommand) run(_ *cobra.Command, args []string) {
+	root, err := environment.LoadRoot()
+	if err != nil {
+		if !panicInstead {
+			tui.Error("error loading zrokdir", err)
+		}
+		panic(err)
+	}
+
+	if !root.IsEnabled() {
+		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
+	}
+
+	zrok, err := root.Client()
+	if err != nil {
+		if !panicInstead {
+			tui.Error("error loading zrokdir", err)
+		}
+		panic(err)
+	}
+	auth := httptransport.APIKeyAuth("X-TOKEN", "header", root.Environment().Token)
+
+	req := metadata.NewListOrgMembersParams()
+	req.OrganizationToken = args[0]
+
+	resp, err := zrok.Metadata.ListOrgMembers(req, auth)
+	if err != nil {
+		if !panicInstead {
+			tui.Error("error listing organization members", err)
+		}
+		panic(err)
+	}
+
+	fmt.Println()
+	t := table.NewWriter()
+	t.SetOutputMirror(os.Stdout)
+	t.SetStyle(table.StyleColoredDark)
+	t.AppendHeader(table.Row{"Email", "Admin?"})
+	for _, member := range resp.Payload.Members {
+		t.AppendRow(table.Row{member.Email, member.Admin})
+	}
+	t.Render()
+	fmt.Println()
+}

cmd/zrok/orgAdminOverview.go

@@ -0,0 +1,79 @@
+package main
+
+import (
+	"fmt"
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/tui"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+	"io"
+	"net/http"
+)
+
+func init() {
+	organizationAdminCmd.AddCommand(newOrgAdminOverviewCommand().cmd)
+}
+
+type orgAdminOverviewCommand struct {
+	cmd *cobra.Command
+}
+
+func newOrgAdminOverviewCommand() *orgAdminOverviewCommand {
+	cmd := &cobra.Command{
+		Use:   "overview <organizationToken> <accountEmail>",
+		Short: "Retrieve account overview for organization member account",
+		Args:  cobra.ExactArgs(2),
+	}
+	command := &orgAdminOverviewCommand{cmd: cmd}
+	cmd.Run = command.run
+	return command
+}
+
+func (cmd *orgAdminOverviewCommand) run(_ *cobra.Command, args []string) {
+	root, err := environment.LoadRoot()
+	if err != nil {
+		if !panicInstead {
+			tui.Error("error loading zrokdir", err)
+		}
+		panic(err)
+	}
+
+	if !root.IsEnabled() {
+		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
+	}
+
+	client := &http.Client{}
+	apiEndpoint, _ := root.ApiEndpoint()
+	req, err := http.NewRequest("GET", fmt.Sprintf("%v/api/v1/overview/%v/%v", apiEndpoint, args[0], args[1]), nil)
+	if err != nil {
+		if !panicInstead {
+			tui.Error("error creating request", err)
+		}
+		panic(err)
+	}
+	req.Header.Add("X-TOKEN", root.Environment().Token)
+	resp, err := client.Do(req)
+	if err != nil {
+		if !panicInstead {
+			tui.Error("error sending request", err)
+		}
+		panic(err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		if !panicInstead {
+			tui.Error("received error response", errors.New(resp.Status))
+		}
+		panic(errors.New(resp.Status))
+	}
+
+	json, err := io.ReadAll(resp.Body)
+	if err != nil {
+		if !panicInstead {
+			tui.Error("error reading json", err)
+		}
+		panic(err)
+	}
+	_ = resp.Body.Close()
+
+	fmt.Println(string(json))
+}

cmd/zrok/orgMemberships.go

@@ -0,0 +1,76 @@
+package main
+
+import (
+	"fmt"
+	httptransport "github.com/go-openapi/runtime/client"
+	"github.com/jedib0t/go-pretty/v6/table"
+	"github.com/openziti/zrok/environment"
+	"github.com/openziti/zrok/tui"
+	"github.com/spf13/cobra"
+	"os"
+)
+
+func init() {
+	organizationCmd.AddCommand(newOrgMembershipsCommand().cmd)
+}
+
+type orgMembershipsCommand struct {
+	cmd *cobra.Command
+}
+
+func newOrgMembershipsCommand() *orgMembershipsCommand {
+	cmd := &cobra.Command{
+		Use:   "memberships",
+		Short: "List the organization memberships for my account",
+		Args:  cobra.NoArgs,
+	}
+	command := &orgMembershipsCommand{cmd}
+	cmd.Run = command.run
+	return command
+}
+
+func (c *orgMembershipsCommand) run(_ *cobra.Command, _ []string) {
+	root, err := environment.LoadRoot()
+	if err != nil {
+		if !panicInstead {
+			tui.Error("error loading zrokdir", err)
+		}
+		panic(err)
+	}
+
+	if !root.IsEnabled() {
+		tui.Error("unable to load environment; did you 'zrok enable'?", nil)
+	}
+
+	zrok, err := root.Client()
+	if err != nil {
+		if !panicInstead {
+			tui.Error("error loading zrokdir", err)
+		}
+		panic(err)
+	}
+	auth := httptransport.APIKeyAuth("X-TOKEN", "header", root.Environment().Token)
+
+	in, err := zrok.Metadata.ListMemberships(nil, auth)
+	if err != nil {
+		if !panicInstead {
+			tui.Error("error listing memberships", err)
+		}
+		panic(err)
+	}
+
+	if len(in.Payload.Memberships) > 0 {
+		fmt.Println()
+		t := table.NewWriter()
+		t.SetOutputMirror(os.Stdout)
+		t.SetStyle(table.StyleColoredDark)
+		t.AppendHeader(table.Row{"Organization Token", "Description", "Admin?"})
+		for _, i := range in.Payload.Memberships {
+			t.AppendRow(table.Row{i.Token, i.Description, i.Admin})
+		}
+		t.Render()
+		fmt.Println()
+	} else {
+		fmt.Println("no organization memberships.")
+	}
+}

controller/addOrganizationMember.go

@@ -0,0 +1,52 @@
+package controller
+
+import (
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/rest_server_zrok/operations/admin"
+	"github.com/sirupsen/logrus"
+)
+
+type addOrganizationMemberHandler struct{}
+
+func newAddOrganizationMemberHandler() *addOrganizationMemberHandler {
+	return &addOrganizationMemberHandler{}
+}
+
+func (h *addOrganizationMemberHandler) Handle(params admin.AddOrganizationMemberParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	if !principal.Admin {
+		logrus.Error("invalid admin principal")
+		return admin.NewAddOrganizationMemberUnauthorized()
+	}
+
+	trx, err := str.Begin()
+	if err != nil {
+		logrus.Errorf("error starting transaction: %v", err)
+		return admin.NewAddOrganizationMemberInternalServerError()
+	}
+	defer func() { _ = trx.Rollback() }()
+
+	acct, err := str.FindAccountWithEmail(params.Body.Email, trx)
+	if err != nil {
+		logrus.Errorf("error finding account with email address '%v': %v", params.Body.Email, err)
+		return admin.NewAddOrganizationMemberNotFound()
+	}
+
+	org, err := str.FindOrganizationByToken(params.Body.Token, trx)
+	if err != nil {
+		logrus.Errorf("error finding organization '%v': %v", params.Body.Token, err)
+		return admin.NewAddOrganizationMemberNotFound()
+	}
+
+	if err := str.AddAccountToOrganization(acct.Id, org.Id, params.Body.Admin, trx); err != nil {
+		logrus.Errorf("error adding account '%v' to organization '%v': %v", acct.Email, org.Token, err)
+		return admin.NewAddOrganizationMemberInternalServerError()
+	}
+
+	if err := trx.Commit(); err != nil {
+		logrus.Errorf("error committing transaction: %v", err)
+		return admin.NewAddOrganizationMemberInternalServerError()
+	}
+
+	return admin.NewAddOrganizationMemberCreated()
+}

controller/controller.go

@@ -51,13 +51,19 @@ func Run(inCfg *config.Config) error {
 	api.AccountResetPasswordHandler = newResetPasswordHandler(cfg)
 	api.AccountResetPasswordRequestHandler = newResetPasswordRequestHandler()
 	api.AccountVerifyHandler = newVerifyHandler()
+	api.AdminAddOrganizationMemberHandler = newAddOrganizationMemberHandler()
 	api.AdminCreateAccountHandler = newCreateAccountHandler()
 	api.AdminCreateFrontendHandler = newCreateFrontendHandler()
 	api.AdminCreateIdentityHandler = newCreateIdentityHandler()
+	api.AdminCreateOrganizationHandler = newCreateOrganizationHandler()
 	api.AdminDeleteFrontendHandler = newDeleteFrontendHandler()
+	api.AdminDeleteOrganizationHandler = newDeleteOrganizationHandler()
 	api.AdminGrantsHandler = newGrantsHandler()
 	api.AdminInviteTokenGenerateHandler = newInviteTokenGenerateHandler()
 	api.AdminListFrontendsHandler = newListFrontendsHandler()
+	api.AdminListOrganizationMembersHandler = newListOrganizationMembersHandler()
+	api.AdminListOrganizationsHandler = newListOrganizationsHandler()
+	api.AdminRemoveOrganizationMemberHandler = newRemoveOrganizationMemberHandler()
 	api.AdminUpdateFrontendHandler = newUpdateFrontendHandler()
 	api.EnvironmentEnableHandler = newEnableHandler()
 	api.EnvironmentDisableHandler = newDisableHandler()
@@ -71,6 +77,9 @@ func Run(inCfg *config.Config) error {
 	api.MetadataGetEnvironmentDetailHandler = newEnvironmentDetailHandler()
 	api.MetadataGetFrontendDetailHandler = newGetFrontendDetailHandler()
 	api.MetadataGetShareDetailHandler = newShareDetailHandler()
+	api.MetadataListMembershipsHandler = newListMembershipsHandler()
+	api.MetadataListOrgMembersHandler = newListOrgMembersHandler()
+	api.MetadataOrgAccountOverviewHandler = newOrgAccountOverviewHandler()
 	api.MetadataOverviewHandler = newOverviewHandler()
 	api.MetadataVersionHandler = metadata.VersionHandlerFunc(versionHandler)
 	api.ShareAccessHandler = newAccessHandler()

controller/createOrganization.go

@@ -0,0 +1,53 @@
+package controller
+
+import (
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/openziti/zrok/controller/store"
+	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/rest_server_zrok/operations/admin"
+	"github.com/sirupsen/logrus"
+)
+
+type createOrganizationHandler struct{}
+
+func newCreateOrganizationHandler() *createOrganizationHandler {
+	return &createOrganizationHandler{}
+}
+
+func (h *createOrganizationHandler) Handle(params admin.CreateOrganizationParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	if !principal.Admin {
+		logrus.Errorf("invalid admin principal")
+		return admin.NewCreateOrganizationUnauthorized()
+	}
+
+	trx, err := str.Begin()
+	if err != nil {
+		logrus.Errorf("error starting transaction: %v", err)
+		return admin.NewCreateOrganizationInternalServerError()
+	}
+	defer func() { _ = trx.Rollback() }()
+
+	orgToken, err := CreateToken()
+	if err != nil {
+		logrus.Errorf("error creating organization token: %v", err)
+		return admin.NewCreateOrganizationInternalServerError()
+	}
+
+	org := &store.Organization{
+		Token:       orgToken,
+		Description: params.Body.Description,
+	}
+	if _, err := str.CreateOrganization(org, trx); err != nil {
+		logrus.Errorf("error creating organization: %v", err)
+		return admin.NewCreateOrganizationInternalServerError()
+	}
+
+	if err := trx.Commit(); err != nil {
+		logrus.Errorf("error committing organization: %v", err)
+		return admin.NewCreateOrganizationInternalServerError()
+	}
+
+	logrus.Infof("added organzation '%v' with description '%v'", org.Token, org.Description)
+
+	return admin.NewCreateOrganizationCreated().WithPayload(&admin.CreateOrganizationCreatedBody{Token: org.Token})
+}

controller/deleteOrganization.go

@@ -0,0 +1,47 @@
+package controller
+
+import (
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/rest_server_zrok/operations/admin"
+	"github.com/sirupsen/logrus"
+)
+
+type deleteOrganizationHandler struct{}
+
+func newDeleteOrganizationHandler() *deleteOrganizationHandler {
+	return &deleteOrganizationHandler{}
+}
+
+func (h *deleteOrganizationHandler) Handle(params admin.DeleteOrganizationParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	if !principal.Admin {
+		logrus.Errorf("invalid admin principal")
+		return admin.NewDeleteOrganizationUnauthorized()
+	}
+
+	trx, err := str.Begin()
+	if err != nil {
+		logrus.Errorf("error starting transaction: %v", err)
+		return admin.NewDeleteOrganizationInternalServerError()
+	}
+	defer func() { _ = trx.Rollback() }()
+
+	org, err := str.FindOrganizationByToken(params.Body.Token, trx)
+	if err != nil {
+		logrus.Errorf("error finding organization by token: %v", err)
+		return admin.NewDeleteOrganizationNotFound()
+	}
+
+	err = str.DeleteOrganization(org.Id, trx)
+	if err != nil {
+		logrus.Errorf("error deleting organization: %v", err)
+		return admin.NewDeleteOrganizationInternalServerError()
+	}
+
+	if err := trx.Commit(); err != nil {
+		logrus.Errorf("error committing transaction: %v", err)
+		return admin.NewDeleteOrganizationInternalServerError()
+	}
+
+	return admin.NewDeleteOrganizationOK()
+}

controller/listFrontends.go

@@ -15,7 +15,7 @@ func newListFrontendsHandler() *listFrontendsHandler {
 
 func (h *listFrontendsHandler) Handle(params admin.ListFrontendsParams, principal *rest_model_zrok.Principal) middleware.Responder {
 	if !principal.Admin {
-		logrus.Errorf("invalid admin principal")
+		logrus.Error("invalid admin principal")
 		return admin.NewListFrontendsUnauthorized()
 	}
 

controller/listMemberships.go

@@ -0,0 +1,35 @@
+package controller
+
+import (
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/rest_server_zrok/operations/metadata"
+	"github.com/sirupsen/logrus"
+)
+
+type listMembershipsHandler struct{}
+
+func newListMembershipsHandler() *listMembershipsHandler {
+	return &listMembershipsHandler{}
+}
+
+func (h *listMembershipsHandler) Handle(_ metadata.ListMembershipsParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	trx, err := str.Begin()
+	if err != nil {
+		logrus.Errorf("error startin transaction: %v", err)
+		return metadata.NewListMembershipsInternalServerError()
+	}
+	defer func() { _ = trx.Rollback() }()
+
+	oms, err := str.FindOrganizationsForAccount(int(principal.ID), trx)
+	if err != nil {
+		logrus.Errorf("error finding organizations for account '%v': %v", principal.Email, err)
+		return metadata.NewListMembershipsInternalServerError()
+	}
+
+	var out []*metadata.ListMembershipsOKBodyMembershipsItems0
+	for _, om := range oms {
+		out = append(out, &metadata.ListMembershipsOKBodyMembershipsItems0{Token: om.Token, Description: om.Description, Admin: om.Admin})
+	}
+	return metadata.NewListMembershipsOK().WithPayload(&metadata.ListMembershipsOKBody{Memberships: out})
+}

controller/listOrgMembers.go

@@ -0,0 +1,51 @@
+package controller
+
+import (
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/rest_server_zrok/operations/metadata"
+	"github.com/sirupsen/logrus"
+)
+
+type listOrgMembersHandler struct{}
+
+func newListOrgMembersHandler() *listOrgMembersHandler {
+	return &listOrgMembersHandler{}
+}
+
+func (h *listOrgMembersHandler) Handle(params metadata.ListOrgMembersParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	trx, err := str.Begin()
+	if err != nil {
+		logrus.Errorf("error starting transaction: %v", err)
+		return metadata.NewListOrgMembersInternalServerError()
+	}
+	defer func() { _ = trx.Rollback() }()
+
+	org, err := str.FindOrganizationByToken(params.OrganizationToken, trx)
+	if err != nil {
+		logrus.Errorf("error finding organization by token: %v", err)
+		return metadata.NewListOrgMembersNotFound()
+	}
+
+	admin, err := str.IsAccountAdminOfOrganization(int(principal.ID), org.Id, trx)
+	if err != nil {
+		logrus.Errorf("error checking account '%v' admin: %v", principal.Email, err)
+		return metadata.NewListOrgMembersNotFound()
+	}
+	if !admin {
+		logrus.Errorf("requesting account '%v' is not admin of organization '%v'", principal.Email, org.Token)
+		return metadata.NewOrgAccountOverviewNotFound()
+	}
+
+	members, err := str.FindAccountsForOrganization(org.Id, trx)
+	if err != nil {
+		logrus.Errorf("error finding accounts for organization '%v': %v", org.Token, err)
+		return metadata.NewListOrgMembersInternalServerError()
+	}
+
+	var out []*metadata.ListOrgMembersOKBodyMembersItems0
+	for _, member := range members {
+		out = append(out, &metadata.ListOrgMembersOKBodyMembersItems0{Email: member.Email, Admin: member.Admin})
+	}
+	return metadata.NewListOrgMembersOK().WithPayload(&metadata.ListOrgMembersOKBody{Members: out})
+}

controller/listOrganizationMembers.go

@@ -0,0 +1,50 @@
+package controller
+
+import (
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/rest_server_zrok/operations/admin"
+	"github.com/sirupsen/logrus"
+)
+
+type listOrganizationMembersHandler struct{}
+
+func newListOrganizationMembersHandler() *listOrganizationMembersHandler {
+	return &listOrganizationMembersHandler{}
+}
+
+func (h *listOrganizationMembersHandler) Handle(params admin.ListOrganizationMembersParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	if !principal.Admin {
+		logrus.Error("invalid admin principal")
+		return admin.NewListOrganizationMembersUnauthorized()
+	}
+
+	trx, err := str.Begin()
+	if err != nil {
+		logrus.Errorf("error starting transaction: %v", err)
+		return admin.NewListOrganizationMembersInternalServerError()
+	}
+	defer func() { _ = trx.Rollback() }()
+
+	org, err := str.FindOrganizationByToken(params.Body.Token, trx)
+	if err != nil {
+		logrus.Errorf("error finding organization by token: %v", err)
+		return admin.NewListOrganizationMembersNotFound()
+	}
+	if org == nil {
+		logrus.Errorf("organization '%v' not found", params.Body.Token)
+		return admin.NewListOrganizationMembersNotFound()
+	}
+
+	oms, err := str.FindAccountsForOrganization(org.Id, trx)
+	if err != nil {
+		logrus.Errorf("error finding accounts for organization: %v", err)
+		return admin.NewListOrganizationMembersInternalServerError()
+	}
+
+	var members []*admin.ListOrganizationMembersOKBodyMembersItems0
+	for _, om := range oms {
+		members = append(members, &admin.ListOrganizationMembersOKBodyMembersItems0{Email: om.Email, Admin: om.Admin})
+	}
+	return admin.NewListOrganizationMembersOK().WithPayload(&admin.ListOrganizationMembersOKBody{Members: members})
+}

controller/listOrganizations.go

@@ -0,0 +1,40 @@
+package controller
+
+import (
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/rest_server_zrok/operations/admin"
+	"github.com/sirupsen/logrus"
+)
+
+type listOrganizationsHandler struct{}
+
+func newListOrganizationsHandler() *listOrganizationsHandler {
+	return &listOrganizationsHandler{}
+}
+
+func (h *listOrganizationsHandler) Handle(_ admin.ListOrganizationsParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	if !principal.Admin {
+		logrus.Error("invalid admin principal")
+		return admin.NewListOrganizationsUnauthorized()
+	}
+
+	trx, err := str.Begin()
+	if err != nil {
+		logrus.Errorf("error starting transaction: %v", err)
+		return admin.NewListOrganizationsInternalServerError()
+	}
+	defer func() { _ = trx.Rollback() }()
+
+	orgs, err := str.FindOrganizations(trx)
+	if err != nil {
+		logrus.Errorf("error finding organizations: %v", err)
+		return admin.NewListOrganizationsInternalServerError()
+	}
+
+	var out []*admin.ListOrganizationsOKBodyOrganizationsItems0
+	for _, org := range orgs {
+		out = append(out, &admin.ListOrganizationsOKBodyOrganizationsItems0{Description: org.Description, Token: org.Token})
+	}
+	return admin.NewListOrganizationsOK().WithPayload(&admin.ListOrganizationsOKBody{Organizations: out})
+}

controller/orgAccountOverview.go

@@ -0,0 +1,159 @@
+package controller
+
+import (
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/jmoiron/sqlx"
+	"github.com/openziti/zrok/controller/store"
+	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/rest_server_zrok/operations/metadata"
+	"github.com/sirupsen/logrus"
+)
+
+type orgAccountOverviewHandler struct{}
+
+func newOrgAccountOverviewHandler() *orgAccountOverviewHandler {
+	return &orgAccountOverviewHandler{}
+}
+
+func (h *orgAccountOverviewHandler) Handle(params metadata.OrgAccountOverviewParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	trx, err := str.Begin()
+	if err != nil {
+		logrus.Errorf("error starting transaction: %v", err)
+		return metadata.NewOrgAccountOverviewInternalServerError()
+	}
+	defer func() { _ = trx.Rollback() }()
+
+	org, err := str.FindOrganizationByToken(params.OrganizationToken, trx)
+	if err != nil {
+		logrus.Errorf("error finding organization by token: %v", err)
+		return metadata.NewOrgAccountOverviewNotFound()
+	}
+
+	admin, err := str.IsAccountAdminOfOrganization(int(principal.ID), org.Id, trx)
+	if err != nil {
+		logrus.Errorf("error checking account '%v' admin: %v", principal.Email, err)
+		return metadata.NewOrgAccountOverviewNotFound()
+	}
+	if !admin {
+		logrus.Errorf("requesting account '%v' is not admin of organization '%v'", principal.Email, org.Token)
+		return metadata.NewOrgAccountOverviewNotFound()
+	}
+
+	acct, err := str.FindAccountWithEmail(params.AccountEmail, trx)
+	if err != nil {
+		logrus.Errorf("error finding account by email: %v", err)
+		return metadata.NewOrgAccountOverviewNotFound()
+	}
+
+	inOrg, err := str.IsAccountInOrganization(acct.Id, org.Id, trx)
+	if err != nil {
+		logrus.Errorf("error checking account '%v' organization membership: %v", acct.Email, err)
+		return metadata.NewOrgAccountOverviewNotFound()
+	}
+	if !inOrg {
+		logrus.Errorf("account '%v' is not a member of organization '%v'", acct.Email, org.Token)
+		return metadata.NewOrgAccountOverviewNotFound()
+	}
+
+	envs, err := str.FindEnvironmentsForAccount(acct.Id, trx)
+	if err != nil {
+		logrus.Errorf("error finding environments for '%v': %v", acct.Email, err)
+		return metadata.NewOrgAccountOverviewNotFound()
+	}
+
+	accountLimited, err := h.isAccountLimited(acct.Id, trx)
+	if err != nil {
+		logrus.Errorf("error checking account '%v' limited: %v", acct.Email, err)
+	}
+
+	ovr := &rest_model_zrok.Overview{AccountLimited: accountLimited}
+
+	for _, env := range envs {
+		ear := &rest_model_zrok.EnvironmentAndResources{
+			Environment: &rest_model_zrok.Environment{
+				Address:     env.Address,
+				Description: env.Description,
+				Host:        env.Host,
+				ZID:         env.ZId,
+				CreatedAt:   env.CreatedAt.UnixMilli(),
+				UpdatedAt:   env.UpdatedAt.UnixMilli(),
+			},
+		}
+
+		shrs, err := str.FindSharesForEnvironment(env.Id, trx)
+		if err != nil {
+			logrus.Errorf("error finding shares for environment '%v': %v", env.ZId, err)
+			return metadata.NewOverviewInternalServerError()
+		}
+		for _, shr := range shrs {
+			feEndpoint := ""
+			if shr.FrontendEndpoint != nil {
+				feEndpoint = *shr.FrontendEndpoint
+			}
+			feSelection := ""
+			if shr.FrontendSelection != nil {
+				feSelection = *shr.FrontendSelection
+			}
+			beProxyEndpoint := ""
+			if shr.BackendProxyEndpoint != nil {
+				beProxyEndpoint = *shr.BackendProxyEndpoint
+			}
+			envShr := &rest_model_zrok.Share{
+				Token:                shr.Token,
+				ZID:                  shr.ZId,
+				ShareMode:            shr.ShareMode,
+				BackendMode:          shr.BackendMode,
+				FrontendSelection:    feSelection,
+				FrontendEndpoint:     feEndpoint,
+				BackendProxyEndpoint: beProxyEndpoint,
+				Reserved:             shr.Reserved,
+				CreatedAt:            shr.CreatedAt.UnixMilli(),
+				UpdatedAt:            shr.UpdatedAt.UnixMilli(),
+			}
+			ear.Shares = append(ear.Shares, envShr)
+		}
+
+		fes, err := str.FindFrontendsForEnvironment(env.Id, trx)
+		if err != nil {
+			logrus.Errorf("error finding frontends for environment '%v': %v", env.ZId, err)
+			return metadata.NewOverviewInternalServerError()
+		}
+		for _, fe := range fes {
+			envFe := &rest_model_zrok.Frontend{
+				ID:        int64(fe.Id),
+				Token:     fe.Token,
+				ZID:       fe.ZId,
+				CreatedAt: fe.CreatedAt.UnixMilli(),
+				UpdatedAt: fe.UpdatedAt.UnixMilli(),
+			}
+			if fe.PrivateShareId != nil {
+				feShr, err := str.GetShare(*fe.PrivateShareId, trx)
+				if err != nil {
+					logrus.Errorf("error getting share for frontend '%v': %v", fe.ZId, err)
+					return metadata.NewOverviewInternalServerError()
+				}
+				envFe.ShrToken = feShr.Token
+			}
+			ear.Frontends = append(ear.Frontends, envFe)
+		}
+
+		ovr.Environments = append(ovr.Environments, ear)
+	}
+
+	return metadata.NewOrgAccountOverviewOK().WithPayload(ovr)
+}
+
+func (h *orgAccountOverviewHandler) isAccountLimited(acctId int, trx *sqlx.Tx) (bool, error) {
+	var je *store.BandwidthLimitJournalEntry
+	jEmpty, err := str.IsBandwidthLimitJournalEmpty(acctId, trx)
+	if err != nil {
+		return false, err
+	}
+	if !jEmpty {
+		je, err = str.FindLatestBandwidthLimitJournal(acctId, trx)
+		if err != nil {
+			return false, err
+		}
+	}
+	return je != nil && je.Action == store.LimitLimitAction, nil
+}

controller/overview.go

@@ -22,18 +22,21 @@ func (h *overviewHandler) Handle(_ metadata.OverviewParams, principal *rest_mode
 		return metadata.NewOverviewInternalServerError()
 	}
 	defer func() { _ = trx.Rollback() }()
+
 	envs, err := str.FindEnvironmentsForAccount(int(principal.ID), trx)
 	if err != nil {
 		logrus.Errorf("error finding environments for '%v': %v", principal.Email, err)
 		return metadata.NewOverviewInternalServerError()
 	}
+
 	accountLimited, err := h.isAccountLimited(principal, trx)
 	if err != nil {
 		logrus.Errorf("error checking account limited for '%v': %v", principal.Email, err)
 	}
+
 	ovr := &rest_model_zrok.Overview{AccountLimited: accountLimited}
 	for _, env := range envs {
-		envRes := &rest_model_zrok.EnvironmentAndResources{
+		ear := &rest_model_zrok.EnvironmentAndResources{
 			Environment: &rest_model_zrok.Environment{
 				Address:     env.Address,
 				Description: env.Description,
@@ -43,6 +46,7 @@ func (h *overviewHandler) Handle(_ metadata.OverviewParams, principal *rest_mode
 				UpdatedAt:   env.UpdatedAt.UnixMilli(),
 			},
 		}
+
 		shrs, err := str.FindSharesForEnvironment(env.Id, trx)
 		if err != nil {
 			logrus.Errorf("error finding shares for environment '%v': %v", env.ZId, err)
@@ -73,7 +77,7 @@ func (h *overviewHandler) Handle(_ metadata.OverviewParams, principal *rest_mode
 				CreatedAt:            shr.CreatedAt.UnixMilli(),
 				UpdatedAt:            shr.UpdatedAt.UnixMilli(),
 			}
-			envRes.Shares = append(envRes.Shares, envShr)
+			ear.Shares = append(ear.Shares, envShr)
 		}
 		fes, err := str.FindFrontendsForEnvironment(env.Id, trx)
 		if err != nil {
@@ -96,10 +100,12 @@ func (h *overviewHandler) Handle(_ metadata.OverviewParams, principal *rest_mode
 				}
 				envFe.ShrToken = feShr.Token
 			}
-			envRes.Frontends = append(envRes.Frontends, envFe)
+			ear.Frontends = append(ear.Frontends, envFe)
 		}
-		ovr.Environments = append(ovr.Environments, envRes)
+
+		ovr.Environments = append(ovr.Environments, ear)
 	}
+
 	return metadata.NewOverviewOK().WithPayload(ovr)
 }
 

controller/removeOrganizationMember.go

@@ -0,0 +1,54 @@
+package controller
+
+import (
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/openziti/zrok/rest_model_zrok"
+	"github.com/openziti/zrok/rest_server_zrok/operations/admin"
+	"github.com/sirupsen/logrus"
+)
+
+type removeOrganizationMemberHandler struct{}
+
+func newRemoveOrganizationMemberHandler() *removeOrganizationMemberHandler {
+	return &removeOrganizationMemberHandler{}
+}
+
+func (h *removeOrganizationMemberHandler) Handle(params admin.RemoveOrganizationMemberParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	if !principal.Admin {
+		logrus.Error("invalid admin principal")
+		return admin.NewRemoveOrganizationMemberUnauthorized()
+	}
+
+	trx, err := str.Begin()
+	if err != nil {
+		logrus.Errorf("error starting transaction: %v", err)
+		return admin.NewRemoveOrganizationMemberInternalServerError()
+	}
+	defer func() { _ = trx.Rollback() }()
+
+	acct, err := str.FindAccountWithEmail(params.Body.Email, trx)
+	if err != nil {
+		logrus.Errorf("error finding account with email address '%v': %v", params.Body.Email, err)
+		return admin.NewAddOrganizationMemberNotFound()
+	}
+
+	org, err := str.FindOrganizationByToken(params.Body.Token, trx)
+	if err != nil {
+		logrus.Errorf("error finding organization '%v': %v", params.Body.Token, err)
+		return admin.NewAddOrganizationMemberNotFound()
+	}
+
+	if err := str.RemoveAccountFromOrganization(acct.Id, org.Id, trx); err != nil {
+		logrus.Errorf("error removing account '%v' from organization '%v': %v", acct.Email, org.Token, err)
+		return admin.NewRemoveOrganizationMemberInternalServerError()
+	}
+
+	logrus.Infof("removed '%v' from organization '%v'", acct.Email, org.Token)
+
+	if err := trx.Commit(); err != nil {
+		logrus.Errorf("error committing transaction: %v", err)
+		return admin.NewRemoveOrganizationMemberInternalServerError()
+	}
+
+	return admin.NewRemoveOrganizationMemberOK()
+}

controller/store/frontend.go

@@ -135,7 +135,6 @@ func (str *Store) UpdateFrontend(fe *Frontend, tx *sqlx.Tx) error {
 }
 
 func (str *Store) DeleteFrontend(id int, tx *sqlx.Tx) error {
-
 	stmt, err := tx.Prepare("update frontends set updated_at = current_timestamp, deleted = true where id = $1")
 	if err != nil {
 		return errors.Wrap(err, "error preparing frontends delete statement")

controller/store/organization.go

@@ -0,0 +1,85 @@
+package store
+
+import (
+	"github.com/jmoiron/sqlx"
+	"github.com/pkg/errors"
+)
+
+type Organization struct {
+	Model
+	Token       string
+	Description string
+}
+
+func (str *Store) CreateOrganization(org *Organization, trx *sqlx.Tx) (int, error) {
+	stmt, err := trx.Prepare("insert into organizations (token, description) values ($1, $2) returning id")
+	if err != nil {
+		return 0, errors.Wrap(err, "error preparing organizations insert statement")
+	}
+	var id int
+	if err := stmt.QueryRow(org.Token, org.Description).Scan(&id); err != nil {
+		return 0, errors.Wrap(err, "error executing organizations insert statement")
+	}
+	return id, nil
+}
+
+func (str *Store) FindOrganizations(trx *sqlx.Tx) ([]*Organization, error) {
+	rows, err := trx.Queryx("select * from organizations where not deleted")
+	if err != nil {
+		return nil, errors.Wrap(err, "error finding organizations")
+	}
+	var orgs []*Organization
+	for rows.Next() {
+		org := &Organization{}
+		if err := rows.StructScan(&org); err != nil {
+			return nil, errors.Wrap(err, "error scanning organization")
+		}
+		orgs = append(orgs, org)
+	}
+	return orgs, nil
+}
+
+func (str *Store) FindOrganizationByToken(token string, trx *sqlx.Tx) (*Organization, error) {
+	org := &Organization{}
+	if err := trx.QueryRowx("select * from organizations where token = $1 and not deleted", token).StructScan(org); err != nil {
+		return nil, errors.Wrap(err, "error selecting frontend by token")
+	}
+	return org, nil
+}
+
+type OrganizationMembership struct {
+	Token       string
+	Description string
+	Admin       bool
+}
+
+func (str *Store) FindOrganizationsForAccount(acctId int, trx *sqlx.Tx) ([]*OrganizationMembership, error) {
+	sql := "select organizations.token, organizations.description, organization_members.admin from organizations, organization_members " +
+		"where organization_members.account_id = $1 and organization_members.organization_id = organizations.id and not organizations.deleted"
+	rows, err := trx.Queryx(sql, acctId)
+	if err != nil {
+		return nil, errors.Wrap(err, "error querying organization memberships")
+	}
+	var oms []*OrganizationMembership
+	for rows.Next() {
+		om := &OrganizationMembership{}
+		if err := rows.StructScan(&om); err != nil {
+			return nil, errors.Wrap(err, "error scanning organization membership")
+		}
+		oms = append(oms, om)
+	}
+	return oms, nil
+
+}
+
+func (str *Store) DeleteOrganization(id int, trx *sqlx.Tx) error {
+	stmt, err := trx.Prepare("update organizations set updated_at = current_timestamp, deleted = true where id = $1")
+	if err != nil {
+		return errors.Wrap(err, "error preparing organizations delete statement")
+	}
+	_, err = stmt.Exec(id)
+	if err != nil {
+		return errors.Wrap(err, "error executing organizations delete statement")
+	}
+	return nil
+}

controller/store/organizationMember.go

@@ -0,0 +1,75 @@
+package store
+
+import (
+	"github.com/jmoiron/sqlx"
+	"github.com/pkg/errors"
+)
+
+func (str *Store) AddAccountToOrganization(acctId, orgId int, admin bool, trx *sqlx.Tx) error {
+	stmt, err := trx.Prepare("insert into organization_members (account_id, organization_id, admin) values ($1, $2, $3)")
+	if err != nil {
+		return errors.Wrap(err, "error preparing organization_members insert statement")
+	}
+	_, err = stmt.Exec(acctId, orgId, admin)
+	if err != nil {
+		return errors.Wrap(err, "error executing organization_members insert statement")
+	}
+	return nil
+}
+
+type OrganizationMember struct {
+	Email string
+	Admin bool
+}
+
+func (str *Store) FindAccountsForOrganization(orgId int, trx *sqlx.Tx) ([]*OrganizationMember, error) {
+	rows, err := trx.Queryx("select organization_members.admin, accounts.email from organization_members, accounts where organization_members.organization_id = $1 and organization_members.account_id = accounts.id", orgId)
+	if err != nil {
+		return nil, errors.Wrap(err, "error querying organization members")
+	}
+	var members []*OrganizationMember
+	for rows.Next() {
+		om := &OrganizationMember{}
+		if err := rows.StructScan(&om); err != nil {
+			return nil, errors.Wrap(err, "error scanning account email")
+		}
+		members = append(members, om)
+	}
+	return members, nil
+}
+
+func (str *Store) IsAccountInOrganization(acctId, orgId int, trx *sqlx.Tx) (bool, error) {
+	stmt, err := trx.Prepare("select count(0) from organization_members where account_id = $1 and organization_id = $2")
+	if err != nil {
+		return false, errors.Wrap(err, "error preparing organization_members count statement")
+	}
+	var count int
+	if err := stmt.QueryRow(acctId, orgId).Scan(&count); err != nil {
+		return false, errors.Wrap(err, "error executing organization_members count statement")
+	}
+	return count > 0, nil
+}
+
+func (str *Store) IsAccountAdminOfOrganization(acctId, orgId int, trx *sqlx.Tx) (bool, error) {
+	stmt, err := trx.Prepare("select count(0) from organization_members where account_id = $1 and organization_id = $2 and admin")
+	if err != nil {
+		return false, errors.Wrap(err, "error preparing organization_members count statement")
+	}
+	var count int
+	if err := stmt.QueryRow(acctId, orgId).Scan(&count); err != nil {
+		return false, errors.Wrap(err, "error executing organization_members count statement")
+	}
+	return count > 0, nil
+}
+
+func (str *Store) RemoveAccountFromOrganization(acctId, orgId int, trx *sqlx.Tx) error {
+	stmt, err := trx.Prepare("delete from organization_members where account_id = $1 and organization_id = $2")
+	if err != nil {
+		return errors.Wrap(err, "error preparing organization_members delete statement")
+	}
+	_, err = stmt.Exec(acctId, orgId)
+	if err != nil {
+		return errors.Wrap(err, "error executing organization_members delete statement")
+	}
+	return nil
+}

controller/store/sql/postgresql/030_v0_4_45_organizations.sql

@@ -0,0 +1,27 @@
+-- +migrate Up
+
+create table organizations (
+    id                  serial                  primary key,
+
+    token               varchar(32)             not null,
+    description         varchar(128),
+
+    created_at          timestamptz             not null default(current_timestamp),
+    updated_at          timestamptz             not null default(current_timestamp),
+    deleted             boolean                 not null default(false)
+);
+
+create index organizations_token_idx on organizations(token);
+
+create table organization_members (
+    id                  serial                  primary key,
+
+    organization_id     integer                 references organizations(id) not null,
+    account_id          integer                 references accounts(id) not null,
+    admin               boolean                 not null default(false),
+
+    created_at          timestamptz             not null default(current_timestamp),
+    updated_at          timestamptz             not null default(current_timestamp)
+);
+
+create index organization_members_account_id_idx on organization_members(account_id);

controller/store/sql/sqlite3/030_v0_4_45_organizations.sql

@@ -0,0 +1,27 @@
+-- +migrate Up
+
+create table organizations (
+    id                  integer                 primary key,
+
+    token               varchar(32)             not null,
+    description         varchar(128),
+
+    created_at          datetime                not null default(strftime('%Y-%m-%d %H:%M:%f', 'now')),
+    updated_at          datetime                not null default(strftime('%Y-%m-%d %H:%M:%f', 'now')),
+    deleted             boolean                 not null default(false)
+);
+
+create index organization_token_idx on organizations(token);
+
+create table organization_members (
+    id                  integer                 primary key,
+
+    organization_id     integer                 references organizations(id) not null,
+    account_id          integer                 references accounts(id) not null,
+    admin               boolean                 not null default(false),
+
+    created_at          datetime                not null default(strftime('%Y-%m-%d %H:%M:%f', 'now')),
+    updated_at          datetime                not null default(strftime('%Y-%m-%d %H:%M:%f', 'now'))
+);
+
+create index organization_members_account_id_idx on organization_members(account_id);

docs/guides/self-hosting/organizations.md

@@ -0,0 +1,145 @@
+---
+sidebar_position: 21
+sidebar_label: Organizations
+---
+
+# Organizations
+
+zrok (starting with `v0.4.45`) includes support for "organizations". Organizations are groups of related accounts that are typically centrally managed in some capacity. A zrok account can be a member of multiple organizations. Organization membership can also include an "admin" permission. As of `v0.4.45` organization admins are able to retrieve an "overview" (`zrok overview`) from any other account in the organization, allowing the admin to see the details of the environments, shares, and accesses created within that account.
+
+Future zrok releases will include additional organization features, including `--closed` permission sharing functions.
+
+## Configuring an Organization
+
+The API endpoints used to manage organizations and their members require a site-level `ZROK_ADMIN_TOKEN` to access. See the [self-hosting guide](linux/index.mdx#configure-the-controller) for details on configuring admin tokens.
+
+### Create an Organization
+
+The `zrok admin create organization` command is used to create organizations:
+
+```
+$ zrok admin create organization --help
+Create a new organization
+
+Usage:
+  zrok admin create organization [flags]
+
+Aliases:
+  organization, org
+
+Flags:
+  -d, --description string   Organization description
+  -h, --help                 help for organization
+
+Global Flags:
+  -p, --panic     Panic instead of showing pretty errors
+  -v, --verbose   Enable verbose logging
+```
+
+Use the `-d` flag to add a description that shows up in end-user membership listings.
+
+We'll create an example organization:
+
+```
+$ zrok admin create organization -d "documentation"
+[   0.006]    INFO main.(*adminCreateOrganizationCommand).run: created new organization with token 'gK1XRvthq7ci'
+```
+
+### List Organizations
+
+We use the `zrok admin list organizations` command to list our organizations:
+
+```
+$ zrok admin list organizations
+
+ ORGANIZATION TOKEN  DESCRIPTION   
+ gK1XRvthq7ci        documentation 
+```
+
+### Add a Member to an Organization
+
+We use the `zrok admin create org-member` command to add members to organizations:
+
+```
+$ zrok admin create org-member 
+Error: accepts 2 arg(s), received 0
+Usage:
+  zrok admin create org-member <organizationToken> <accountEmail> [flags]
+
+Aliases:
+  org-member, member
+
+Flags:
+      --admin   Make the new account an admin of the organization
+  -h, --help    help for org-member
+
+Global Flags:
+  -p, --panic     Panic instead of showing pretty errors
+  -v, --verbose   Enable verbose logging
+```
+
+Like this:
+
+```
+$ zrok admin create org-member gK1XRvthq7ci michael.quigley@netfoundry.io
+[   0.006]    INFO main.(*adminCreateOrgMemberCommand).run: added 'michael.quigley@netfoundry.io' to organization 'gK1XRvthq7ci
+```
+
+The `--admin` flag can be added to the `zrok admin create org-member` command to mark the member as an administrator of the organization.
+
+### List Members of an Organization
+
+```
+$ zrok admin list org-members gK1XRvthq7ci
+
+ ACCOUNT EMAIL                  ADMIN? 
+ michael.quigley@netfoundry.io  false 
+```
+
+### Removing Organizations and Members
+
+The `zrok admin delete org-member` and `zrok admin delete organization` commands are available to clean up organizations and their membership lists.
+
+## End-user Organization Administrator Commands
+
+When a zrok account is added to an organization as an administrator it allows them to use the `zrok organization admin` commands, which include:
+
+```
+$ zrok organization admin
+Organization admin commands
+
+Usage:
+  zrok organization admin [command]
+
+Available Commands:
+  list        List the members of an organization
+  overview    Retrieve account overview for organization member account
+
+Flags:
+  -h, --help   help for admin
+
+Global Flags:
+  -p, --panic     Panic instead of showing pretty errors
+  -v, --verbose   Enable verbose logging
+
+Use "zrok organization admin [command] --help" for more information about a command.
+```
+
+The `zrok organization admin list` command is used to list the members of an organization.
+
+The `zrok organization admin overview` command is used to retrieve an overview of an organization member account. This is functionally equivalent to what the `zrok overview` command does, but it allows an organization admin to retrieve the overview for another zrok account.
+
+## End-user Organization Commands
+
+All zrok accounts can use the `zrok organization memberships` command to list the organizations they're a member of:
+
+```
+$ zrok organization memberships
+
+ ORGANIZATION TOKEN  DESCRIPTION    ADMIN? 
+ gK1XRvthq7ci        documentation  false  
+
+```
+
+
+

docs/guides/self-hosting/personalized-frontend.md

@@ -1,7 +1,7 @@
 ---
 title: Personalized Frontend
 sidebar_label: Personalized Frontend
-sidebar_position: 19
+sidebar_position: 22
 ---
 
 This guide describes an approach that enables a zrok user to use a hosted, shared instance (zrok.io) and configure their own personalized frontend, which enables custom DNS and TLS for their shares.

rest_client_zrok/admin/add_organization_member_parameters.go

@@ -0,0 +1,146 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewAddOrganizationMemberParams creates a new AddOrganizationMemberParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewAddOrganizationMemberParams() *AddOrganizationMemberParams {
+	return &AddOrganizationMemberParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewAddOrganizationMemberParamsWithTimeout creates a new AddOrganizationMemberParams object
+// with the ability to set a timeout on a request.
+func NewAddOrganizationMemberParamsWithTimeout(timeout time.Duration) *AddOrganizationMemberParams {
+	return &AddOrganizationMemberParams{
+		timeout: timeout,
+	}
+}
+
+// NewAddOrganizationMemberParamsWithContext creates a new AddOrganizationMemberParams object
+// with the ability to set a context for a request.
+func NewAddOrganizationMemberParamsWithContext(ctx context.Context) *AddOrganizationMemberParams {
+	return &AddOrganizationMemberParams{
+		Context: ctx,
+	}
+}
+
+// NewAddOrganizationMemberParamsWithHTTPClient creates a new AddOrganizationMemberParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewAddOrganizationMemberParamsWithHTTPClient(client *http.Client) *AddOrganizationMemberParams {
+	return &AddOrganizationMemberParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+AddOrganizationMemberParams contains all the parameters to send to the API endpoint
+
+	for the add organization member operation.
+
+	Typically these are written to a http.Request.
+*/
+type AddOrganizationMemberParams struct {
+
+	// Body.
+	Body AddOrganizationMemberBody
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the add organization member params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *AddOrganizationMemberParams) WithDefaults() *AddOrganizationMemberParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the add organization member params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *AddOrganizationMemberParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the add organization member params
+func (o *AddOrganizationMemberParams) WithTimeout(timeout time.Duration) *AddOrganizationMemberParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the add organization member params
+func (o *AddOrganizationMemberParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the add organization member params
+func (o *AddOrganizationMemberParams) WithContext(ctx context.Context) *AddOrganizationMemberParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the add organization member params
+func (o *AddOrganizationMemberParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the add organization member params
+func (o *AddOrganizationMemberParams) WithHTTPClient(client *http.Client) *AddOrganizationMemberParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the add organization member params
+func (o *AddOrganizationMemberParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithBody adds the body to the add organization member params
+func (o *AddOrganizationMemberParams) WithBody(body AddOrganizationMemberBody) *AddOrganizationMemberParams {
+	o.SetBody(body)
+	return o
+}
+
+// SetBody adds the body to the add organization member params
+func (o *AddOrganizationMemberParams) SetBody(body AddOrganizationMemberBody) {
+	o.Body = body
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *AddOrganizationMemberParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+	if err := r.SetBodyParam(o.Body); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/admin/add_organization_member_responses.go

@@ -0,0 +1,320 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// AddOrganizationMemberReader is a Reader for the AddOrganizationMember structure.
+type AddOrganizationMemberReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *AddOrganizationMemberReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 201:
+		result := NewAddOrganizationMemberCreated()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewAddOrganizationMemberUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 404:
+		result := NewAddOrganizationMemberNotFound()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewAddOrganizationMemberInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[POST /organization/add] addOrganizationMember", response, response.Code())
+	}
+}
+
+// NewAddOrganizationMemberCreated creates a AddOrganizationMemberCreated with default headers values
+func NewAddOrganizationMemberCreated() *AddOrganizationMemberCreated {
+	return &AddOrganizationMemberCreated{}
+}
+
+/*
+AddOrganizationMemberCreated describes a response with status code 201, with default header values.
+
+member added
+*/
+type AddOrganizationMemberCreated struct {
+}
+
+// IsSuccess returns true when this add organization member created response has a 2xx status code
+func (o *AddOrganizationMemberCreated) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this add organization member created response has a 3xx status code
+func (o *AddOrganizationMemberCreated) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this add organization member created response has a 4xx status code
+func (o *AddOrganizationMemberCreated) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this add organization member created response has a 5xx status code
+func (o *AddOrganizationMemberCreated) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this add organization member created response a status code equal to that given
+func (o *AddOrganizationMemberCreated) IsCode(code int) bool {
+	return code == 201
+}
+
+// Code gets the status code for the add organization member created response
+func (o *AddOrganizationMemberCreated) Code() int {
+	return 201
+}
+
+func (o *AddOrganizationMemberCreated) Error() string {
+	return fmt.Sprintf("[POST /organization/add][%d] addOrganizationMemberCreated ", 201)
+}
+
+func (o *AddOrganizationMemberCreated) String() string {
+	return fmt.Sprintf("[POST /organization/add][%d] addOrganizationMemberCreated ", 201)
+}
+
+func (o *AddOrganizationMemberCreated) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewAddOrganizationMemberUnauthorized creates a AddOrganizationMemberUnauthorized with default headers values
+func NewAddOrganizationMemberUnauthorized() *AddOrganizationMemberUnauthorized {
+	return &AddOrganizationMemberUnauthorized{}
+}
+
+/*
+AddOrganizationMemberUnauthorized describes a response with status code 401, with default header values.
+
+unauthorized
+*/
+type AddOrganizationMemberUnauthorized struct {
+}
+
+// IsSuccess returns true when this add organization member unauthorized response has a 2xx status code
+func (o *AddOrganizationMemberUnauthorized) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this add organization member unauthorized response has a 3xx status code
+func (o *AddOrganizationMemberUnauthorized) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this add organization member unauthorized response has a 4xx status code
+func (o *AddOrganizationMemberUnauthorized) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this add organization member unauthorized response has a 5xx status code
+func (o *AddOrganizationMemberUnauthorized) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this add organization member unauthorized response a status code equal to that given
+func (o *AddOrganizationMemberUnauthorized) IsCode(code int) bool {
+	return code == 401
+}
+
+// Code gets the status code for the add organization member unauthorized response
+func (o *AddOrganizationMemberUnauthorized) Code() int {
+	return 401
+}
+
+func (o *AddOrganizationMemberUnauthorized) Error() string {
+	return fmt.Sprintf("[POST /organization/add][%d] addOrganizationMemberUnauthorized ", 401)
+}
+
+func (o *AddOrganizationMemberUnauthorized) String() string {
+	return fmt.Sprintf("[POST /organization/add][%d] addOrganizationMemberUnauthorized ", 401)
+}
+
+func (o *AddOrganizationMemberUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewAddOrganizationMemberNotFound creates a AddOrganizationMemberNotFound with default headers values
+func NewAddOrganizationMemberNotFound() *AddOrganizationMemberNotFound {
+	return &AddOrganizationMemberNotFound{}
+}
+
+/*
+AddOrganizationMemberNotFound describes a response with status code 404, with default header values.
+
+not found
+*/
+type AddOrganizationMemberNotFound struct {
+}
+
+// IsSuccess returns true when this add organization member not found response has a 2xx status code
+func (o *AddOrganizationMemberNotFound) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this add organization member not found response has a 3xx status code
+func (o *AddOrganizationMemberNotFound) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this add organization member not found response has a 4xx status code
+func (o *AddOrganizationMemberNotFound) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this add organization member not found response has a 5xx status code
+func (o *AddOrganizationMemberNotFound) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this add organization member not found response a status code equal to that given
+func (o *AddOrganizationMemberNotFound) IsCode(code int) bool {
+	return code == 404
+}
+
+// Code gets the status code for the add organization member not found response
+func (o *AddOrganizationMemberNotFound) Code() int {
+	return 404
+}
+
+func (o *AddOrganizationMemberNotFound) Error() string {
+	return fmt.Sprintf("[POST /organization/add][%d] addOrganizationMemberNotFound ", 404)
+}
+
+func (o *AddOrganizationMemberNotFound) String() string {
+	return fmt.Sprintf("[POST /organization/add][%d] addOrganizationMemberNotFound ", 404)
+}
+
+func (o *AddOrganizationMemberNotFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewAddOrganizationMemberInternalServerError creates a AddOrganizationMemberInternalServerError with default headers values
+func NewAddOrganizationMemberInternalServerError() *AddOrganizationMemberInternalServerError {
+	return &AddOrganizationMemberInternalServerError{}
+}
+
+/*
+AddOrganizationMemberInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type AddOrganizationMemberInternalServerError struct {
+}
+
+// IsSuccess returns true when this add organization member internal server error response has a 2xx status code
+func (o *AddOrganizationMemberInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this add organization member internal server error response has a 3xx status code
+func (o *AddOrganizationMemberInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this add organization member internal server error response has a 4xx status code
+func (o *AddOrganizationMemberInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this add organization member internal server error response has a 5xx status code
+func (o *AddOrganizationMemberInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this add organization member internal server error response a status code equal to that given
+func (o *AddOrganizationMemberInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the add organization member internal server error response
+func (o *AddOrganizationMemberInternalServerError) Code() int {
+	return 500
+}
+
+func (o *AddOrganizationMemberInternalServerError) Error() string {
+	return fmt.Sprintf("[POST /organization/add][%d] addOrganizationMemberInternalServerError ", 500)
+}
+
+func (o *AddOrganizationMemberInternalServerError) String() string {
+	return fmt.Sprintf("[POST /organization/add][%d] addOrganizationMemberInternalServerError ", 500)
+}
+
+func (o *AddOrganizationMemberInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+/*
+AddOrganizationMemberBody add organization member body
+swagger:model AddOrganizationMemberBody
+*/
+type AddOrganizationMemberBody struct {
+
+	// admin
+	Admin bool `json:"admin,omitempty"`
+
+	// email
+	Email string `json:"email,omitempty"`
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this add organization member body
+func (o *AddOrganizationMemberBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this add organization member body based on context it is used
+func (o *AddOrganizationMemberBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *AddOrganizationMemberBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *AddOrganizationMemberBody) UnmarshalBinary(b []byte) error {
+	var res AddOrganizationMemberBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_client_zrok/admin/admin_client.go

@@ -30,25 +30,76 @@ type ClientOption func(*runtime.ClientOperation)
 
 // ClientService is the interface for Client methods
 type ClientService interface {
+	AddOrganizationMember(params *AddOrganizationMemberParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*AddOrganizationMemberCreated, error)
+
 	CreateAccount(params *CreateAccountParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*CreateAccountCreated, error)
 
 	CreateFrontend(params *CreateFrontendParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*CreateFrontendCreated, error)
 
 	CreateIdentity(params *CreateIdentityParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*CreateIdentityCreated, error)
 
+	CreateOrganization(params *CreateOrganizationParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*CreateOrganizationCreated, error)
+
 	DeleteFrontend(params *DeleteFrontendParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*DeleteFrontendOK, error)
 
+	DeleteOrganization(params *DeleteOrganizationParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*DeleteOrganizationOK, error)
+
 	Grants(params *GrantsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*GrantsOK, error)
 
 	InviteTokenGenerate(params *InviteTokenGenerateParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*InviteTokenGenerateCreated, error)
 
 	ListFrontends(params *ListFrontendsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ListFrontendsOK, error)
 
+	ListOrganizationMembers(params *ListOrganizationMembersParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ListOrganizationMembersOK, error)
+
+	ListOrganizations(params *ListOrganizationsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ListOrganizationsOK, error)
+
+	RemoveOrganizationMember(params *RemoveOrganizationMemberParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*RemoveOrganizationMemberOK, error)
+
 	UpdateFrontend(params *UpdateFrontendParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*UpdateFrontendOK, error)
 
 	SetTransport(transport runtime.ClientTransport)
 }
 
+/*
+AddOrganizationMember add organization member API
+*/
+func (a *Client) AddOrganizationMember(params *AddOrganizationMemberParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*AddOrganizationMemberCreated, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewAddOrganizationMemberParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "addOrganizationMember",
+		Method:             "POST",
+		PathPattern:        "/organization/add",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &AddOrganizationMemberReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*AddOrganizationMemberCreated)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for addOrganizationMember: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 /*
 CreateAccount create account API
 */
@@ -166,6 +217,45 @@ func (a *Client) CreateIdentity(params *CreateIdentityParams, authInfo runtime.C
 	panic(msg)
 }
 
+/*
+CreateOrganization create organization API
+*/
+func (a *Client) CreateOrganization(params *CreateOrganizationParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*CreateOrganizationCreated, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewCreateOrganizationParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "createOrganization",
+		Method:             "POST",
+		PathPattern:        "/organization",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &CreateOrganizationReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*CreateOrganizationCreated)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for createOrganization: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 /*
 DeleteFrontend delete frontend API
 */
@@ -205,6 +295,45 @@ func (a *Client) DeleteFrontend(params *DeleteFrontendParams, authInfo runtime.C
 	panic(msg)
 }
 
+/*
+DeleteOrganization delete organization API
+*/
+func (a *Client) DeleteOrganization(params *DeleteOrganizationParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*DeleteOrganizationOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewDeleteOrganizationParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "deleteOrganization",
+		Method:             "DELETE",
+		PathPattern:        "/organization",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &DeleteOrganizationReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*DeleteOrganizationOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for deleteOrganization: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 /*
 Grants grants API
 */
@@ -322,6 +451,123 @@ func (a *Client) ListFrontends(params *ListFrontendsParams, authInfo runtime.Cli
 	panic(msg)
 }
 
+/*
+ListOrganizationMembers list organization members API
+*/
+func (a *Client) ListOrganizationMembers(params *ListOrganizationMembersParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ListOrganizationMembersOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewListOrganizationMembersParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "listOrganizationMembers",
+		Method:             "POST",
+		PathPattern:        "/organization/list",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &ListOrganizationMembersReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*ListOrganizationMembersOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for listOrganizationMembers: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
+/*
+ListOrganizations list organizations API
+*/
+func (a *Client) ListOrganizations(params *ListOrganizationsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ListOrganizationsOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewListOrganizationsParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "listOrganizations",
+		Method:             "GET",
+		PathPattern:        "/organizations",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &ListOrganizationsReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*ListOrganizationsOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for listOrganizations: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
+/*
+RemoveOrganizationMember remove organization member API
+*/
+func (a *Client) RemoveOrganizationMember(params *RemoveOrganizationMemberParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*RemoveOrganizationMemberOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewRemoveOrganizationMemberParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "removeOrganizationMember",
+		Method:             "POST",
+		PathPattern:        "/organization/remove",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &RemoveOrganizationMemberReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*RemoveOrganizationMemberOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for removeOrganizationMember: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 /*
 UpdateFrontend update frontend API
 */

rest_client_zrok/admin/create_organization_parameters.go

@@ -0,0 +1,146 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewCreateOrganizationParams creates a new CreateOrganizationParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewCreateOrganizationParams() *CreateOrganizationParams {
+	return &CreateOrganizationParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewCreateOrganizationParamsWithTimeout creates a new CreateOrganizationParams object
+// with the ability to set a timeout on a request.
+func NewCreateOrganizationParamsWithTimeout(timeout time.Duration) *CreateOrganizationParams {
+	return &CreateOrganizationParams{
+		timeout: timeout,
+	}
+}
+
+// NewCreateOrganizationParamsWithContext creates a new CreateOrganizationParams object
+// with the ability to set a context for a request.
+func NewCreateOrganizationParamsWithContext(ctx context.Context) *CreateOrganizationParams {
+	return &CreateOrganizationParams{
+		Context: ctx,
+	}
+}
+
+// NewCreateOrganizationParamsWithHTTPClient creates a new CreateOrganizationParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewCreateOrganizationParamsWithHTTPClient(client *http.Client) *CreateOrganizationParams {
+	return &CreateOrganizationParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+CreateOrganizationParams contains all the parameters to send to the API endpoint
+
+	for the create organization operation.
+
+	Typically these are written to a http.Request.
+*/
+type CreateOrganizationParams struct {
+
+	// Body.
+	Body CreateOrganizationBody
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the create organization params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *CreateOrganizationParams) WithDefaults() *CreateOrganizationParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the create organization params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *CreateOrganizationParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the create organization params
+func (o *CreateOrganizationParams) WithTimeout(timeout time.Duration) *CreateOrganizationParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the create organization params
+func (o *CreateOrganizationParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the create organization params
+func (o *CreateOrganizationParams) WithContext(ctx context.Context) *CreateOrganizationParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the create organization params
+func (o *CreateOrganizationParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the create organization params
+func (o *CreateOrganizationParams) WithHTTPClient(client *http.Client) *CreateOrganizationParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the create organization params
+func (o *CreateOrganizationParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithBody adds the body to the create organization params
+func (o *CreateOrganizationParams) WithBody(body CreateOrganizationBody) *CreateOrganizationParams {
+	o.SetBody(body)
+	return o
+}
+
+// SetBody adds the body to the create organization params
+func (o *CreateOrganizationParams) SetBody(body CreateOrganizationBody) {
+	o.Body = body
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *CreateOrganizationParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+	if err := r.SetBodyParam(o.Body); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/admin/create_organization_responses.go

@@ -0,0 +1,303 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// CreateOrganizationReader is a Reader for the CreateOrganization structure.
+type CreateOrganizationReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *CreateOrganizationReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 201:
+		result := NewCreateOrganizationCreated()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewCreateOrganizationUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewCreateOrganizationInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[POST /organization] createOrganization", response, response.Code())
+	}
+}
+
+// NewCreateOrganizationCreated creates a CreateOrganizationCreated with default headers values
+func NewCreateOrganizationCreated() *CreateOrganizationCreated {
+	return &CreateOrganizationCreated{}
+}
+
+/*
+CreateOrganizationCreated describes a response with status code 201, with default header values.
+
+organization created
+*/
+type CreateOrganizationCreated struct {
+	Payload *CreateOrganizationCreatedBody
+}
+
+// IsSuccess returns true when this create organization created response has a 2xx status code
+func (o *CreateOrganizationCreated) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this create organization created response has a 3xx status code
+func (o *CreateOrganizationCreated) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this create organization created response has a 4xx status code
+func (o *CreateOrganizationCreated) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this create organization created response has a 5xx status code
+func (o *CreateOrganizationCreated) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this create organization created response a status code equal to that given
+func (o *CreateOrganizationCreated) IsCode(code int) bool {
+	return code == 201
+}
+
+// Code gets the status code for the create organization created response
+func (o *CreateOrganizationCreated) Code() int {
+	return 201
+}
+
+func (o *CreateOrganizationCreated) Error() string {
+	return fmt.Sprintf("[POST /organization][%d] createOrganizationCreated  %+v", 201, o.Payload)
+}
+
+func (o *CreateOrganizationCreated) String() string {
+	return fmt.Sprintf("[POST /organization][%d] createOrganizationCreated  %+v", 201, o.Payload)
+}
+
+func (o *CreateOrganizationCreated) GetPayload() *CreateOrganizationCreatedBody {
+	return o.Payload
+}
+
+func (o *CreateOrganizationCreated) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(CreateOrganizationCreatedBody)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewCreateOrganizationUnauthorized creates a CreateOrganizationUnauthorized with default headers values
+func NewCreateOrganizationUnauthorized() *CreateOrganizationUnauthorized {
+	return &CreateOrganizationUnauthorized{}
+}
+
+/*
+CreateOrganizationUnauthorized describes a response with status code 401, with default header values.
+
+unauthorized
+*/
+type CreateOrganizationUnauthorized struct {
+}
+
+// IsSuccess returns true when this create organization unauthorized response has a 2xx status code
+func (o *CreateOrganizationUnauthorized) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this create organization unauthorized response has a 3xx status code
+func (o *CreateOrganizationUnauthorized) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this create organization unauthorized response has a 4xx status code
+func (o *CreateOrganizationUnauthorized) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this create organization unauthorized response has a 5xx status code
+func (o *CreateOrganizationUnauthorized) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this create organization unauthorized response a status code equal to that given
+func (o *CreateOrganizationUnauthorized) IsCode(code int) bool {
+	return code == 401
+}
+
+// Code gets the status code for the create organization unauthorized response
+func (o *CreateOrganizationUnauthorized) Code() int {
+	return 401
+}
+
+func (o *CreateOrganizationUnauthorized) Error() string {
+	return fmt.Sprintf("[POST /organization][%d] createOrganizationUnauthorized ", 401)
+}
+
+func (o *CreateOrganizationUnauthorized) String() string {
+	return fmt.Sprintf("[POST /organization][%d] createOrganizationUnauthorized ", 401)
+}
+
+func (o *CreateOrganizationUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewCreateOrganizationInternalServerError creates a CreateOrganizationInternalServerError with default headers values
+func NewCreateOrganizationInternalServerError() *CreateOrganizationInternalServerError {
+	return &CreateOrganizationInternalServerError{}
+}
+
+/*
+CreateOrganizationInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type CreateOrganizationInternalServerError struct {
+}
+
+// IsSuccess returns true when this create organization internal server error response has a 2xx status code
+func (o *CreateOrganizationInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this create organization internal server error response has a 3xx status code
+func (o *CreateOrganizationInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this create organization internal server error response has a 4xx status code
+func (o *CreateOrganizationInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this create organization internal server error response has a 5xx status code
+func (o *CreateOrganizationInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this create organization internal server error response a status code equal to that given
+func (o *CreateOrganizationInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the create organization internal server error response
+func (o *CreateOrganizationInternalServerError) Code() int {
+	return 500
+}
+
+func (o *CreateOrganizationInternalServerError) Error() string {
+	return fmt.Sprintf("[POST /organization][%d] createOrganizationInternalServerError ", 500)
+}
+
+func (o *CreateOrganizationInternalServerError) String() string {
+	return fmt.Sprintf("[POST /organization][%d] createOrganizationInternalServerError ", 500)
+}
+
+func (o *CreateOrganizationInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+/*
+CreateOrganizationBody create organization body
+swagger:model CreateOrganizationBody
+*/
+type CreateOrganizationBody struct {
+
+	// description
+	Description string `json:"description,omitempty"`
+}
+
+// Validate validates this create organization body
+func (o *CreateOrganizationBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this create organization body based on context it is used
+func (o *CreateOrganizationBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *CreateOrganizationBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *CreateOrganizationBody) UnmarshalBinary(b []byte) error {
+	var res CreateOrganizationBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+/*
+CreateOrganizationCreatedBody create organization created body
+swagger:model CreateOrganizationCreatedBody
+*/
+type CreateOrganizationCreatedBody struct {
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this create organization created body
+func (o *CreateOrganizationCreatedBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this create organization created body based on context it is used
+func (o *CreateOrganizationCreatedBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *CreateOrganizationCreatedBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *CreateOrganizationCreatedBody) UnmarshalBinary(b []byte) error {
+	var res CreateOrganizationCreatedBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_client_zrok/admin/delete_organization_parameters.go

@@ -0,0 +1,146 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewDeleteOrganizationParams creates a new DeleteOrganizationParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewDeleteOrganizationParams() *DeleteOrganizationParams {
+	return &DeleteOrganizationParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewDeleteOrganizationParamsWithTimeout creates a new DeleteOrganizationParams object
+// with the ability to set a timeout on a request.
+func NewDeleteOrganizationParamsWithTimeout(timeout time.Duration) *DeleteOrganizationParams {
+	return &DeleteOrganizationParams{
+		timeout: timeout,
+	}
+}
+
+// NewDeleteOrganizationParamsWithContext creates a new DeleteOrganizationParams object
+// with the ability to set a context for a request.
+func NewDeleteOrganizationParamsWithContext(ctx context.Context) *DeleteOrganizationParams {
+	return &DeleteOrganizationParams{
+		Context: ctx,
+	}
+}
+
+// NewDeleteOrganizationParamsWithHTTPClient creates a new DeleteOrganizationParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewDeleteOrganizationParamsWithHTTPClient(client *http.Client) *DeleteOrganizationParams {
+	return &DeleteOrganizationParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+DeleteOrganizationParams contains all the parameters to send to the API endpoint
+
+	for the delete organization operation.
+
+	Typically these are written to a http.Request.
+*/
+type DeleteOrganizationParams struct {
+
+	// Body.
+	Body DeleteOrganizationBody
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the delete organization params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *DeleteOrganizationParams) WithDefaults() *DeleteOrganizationParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the delete organization params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *DeleteOrganizationParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the delete organization params
+func (o *DeleteOrganizationParams) WithTimeout(timeout time.Duration) *DeleteOrganizationParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the delete organization params
+func (o *DeleteOrganizationParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the delete organization params
+func (o *DeleteOrganizationParams) WithContext(ctx context.Context) *DeleteOrganizationParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the delete organization params
+func (o *DeleteOrganizationParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the delete organization params
+func (o *DeleteOrganizationParams) WithHTTPClient(client *http.Client) *DeleteOrganizationParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the delete organization params
+func (o *DeleteOrganizationParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithBody adds the body to the delete organization params
+func (o *DeleteOrganizationParams) WithBody(body DeleteOrganizationBody) *DeleteOrganizationParams {
+	o.SetBody(body)
+	return o
+}
+
+// SetBody adds the body to the delete organization params
+func (o *DeleteOrganizationParams) SetBody(body DeleteOrganizationBody) {
+	o.Body = body
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *DeleteOrganizationParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+	if err := r.SetBodyParam(o.Body); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/admin/delete_organization_responses.go

@@ -0,0 +1,314 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// DeleteOrganizationReader is a Reader for the DeleteOrganization structure.
+type DeleteOrganizationReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *DeleteOrganizationReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewDeleteOrganizationOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewDeleteOrganizationUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 404:
+		result := NewDeleteOrganizationNotFound()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewDeleteOrganizationInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[DELETE /organization] deleteOrganization", response, response.Code())
+	}
+}
+
+// NewDeleteOrganizationOK creates a DeleteOrganizationOK with default headers values
+func NewDeleteOrganizationOK() *DeleteOrganizationOK {
+	return &DeleteOrganizationOK{}
+}
+
+/*
+DeleteOrganizationOK describes a response with status code 200, with default header values.
+
+organization deleted
+*/
+type DeleteOrganizationOK struct {
+}
+
+// IsSuccess returns true when this delete organization o k response has a 2xx status code
+func (o *DeleteOrganizationOK) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this delete organization o k response has a 3xx status code
+func (o *DeleteOrganizationOK) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this delete organization o k response has a 4xx status code
+func (o *DeleteOrganizationOK) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this delete organization o k response has a 5xx status code
+func (o *DeleteOrganizationOK) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this delete organization o k response a status code equal to that given
+func (o *DeleteOrganizationOK) IsCode(code int) bool {
+	return code == 200
+}
+
+// Code gets the status code for the delete organization o k response
+func (o *DeleteOrganizationOK) Code() int {
+	return 200
+}
+
+func (o *DeleteOrganizationOK) Error() string {
+	return fmt.Sprintf("[DELETE /organization][%d] deleteOrganizationOK ", 200)
+}
+
+func (o *DeleteOrganizationOK) String() string {
+	return fmt.Sprintf("[DELETE /organization][%d] deleteOrganizationOK ", 200)
+}
+
+func (o *DeleteOrganizationOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewDeleteOrganizationUnauthorized creates a DeleteOrganizationUnauthorized with default headers values
+func NewDeleteOrganizationUnauthorized() *DeleteOrganizationUnauthorized {
+	return &DeleteOrganizationUnauthorized{}
+}
+
+/*
+DeleteOrganizationUnauthorized describes a response with status code 401, with default header values.
+
+unauthorized
+*/
+type DeleteOrganizationUnauthorized struct {
+}
+
+// IsSuccess returns true when this delete organization unauthorized response has a 2xx status code
+func (o *DeleteOrganizationUnauthorized) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this delete organization unauthorized response has a 3xx status code
+func (o *DeleteOrganizationUnauthorized) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this delete organization unauthorized response has a 4xx status code
+func (o *DeleteOrganizationUnauthorized) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this delete organization unauthorized response has a 5xx status code
+func (o *DeleteOrganizationUnauthorized) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this delete organization unauthorized response a status code equal to that given
+func (o *DeleteOrganizationUnauthorized) IsCode(code int) bool {
+	return code == 401
+}
+
+// Code gets the status code for the delete organization unauthorized response
+func (o *DeleteOrganizationUnauthorized) Code() int {
+	return 401
+}
+
+func (o *DeleteOrganizationUnauthorized) Error() string {
+	return fmt.Sprintf("[DELETE /organization][%d] deleteOrganizationUnauthorized ", 401)
+}
+
+func (o *DeleteOrganizationUnauthorized) String() string {
+	return fmt.Sprintf("[DELETE /organization][%d] deleteOrganizationUnauthorized ", 401)
+}
+
+func (o *DeleteOrganizationUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewDeleteOrganizationNotFound creates a DeleteOrganizationNotFound with default headers values
+func NewDeleteOrganizationNotFound() *DeleteOrganizationNotFound {
+	return &DeleteOrganizationNotFound{}
+}
+
+/*
+DeleteOrganizationNotFound describes a response with status code 404, with default header values.
+
+organization not found
+*/
+type DeleteOrganizationNotFound struct {
+}
+
+// IsSuccess returns true when this delete organization not found response has a 2xx status code
+func (o *DeleteOrganizationNotFound) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this delete organization not found response has a 3xx status code
+func (o *DeleteOrganizationNotFound) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this delete organization not found response has a 4xx status code
+func (o *DeleteOrganizationNotFound) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this delete organization not found response has a 5xx status code
+func (o *DeleteOrganizationNotFound) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this delete organization not found response a status code equal to that given
+func (o *DeleteOrganizationNotFound) IsCode(code int) bool {
+	return code == 404
+}
+
+// Code gets the status code for the delete organization not found response
+func (o *DeleteOrganizationNotFound) Code() int {
+	return 404
+}
+
+func (o *DeleteOrganizationNotFound) Error() string {
+	return fmt.Sprintf("[DELETE /organization][%d] deleteOrganizationNotFound ", 404)
+}
+
+func (o *DeleteOrganizationNotFound) String() string {
+	return fmt.Sprintf("[DELETE /organization][%d] deleteOrganizationNotFound ", 404)
+}
+
+func (o *DeleteOrganizationNotFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewDeleteOrganizationInternalServerError creates a DeleteOrganizationInternalServerError with default headers values
+func NewDeleteOrganizationInternalServerError() *DeleteOrganizationInternalServerError {
+	return &DeleteOrganizationInternalServerError{}
+}
+
+/*
+DeleteOrganizationInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type DeleteOrganizationInternalServerError struct {
+}
+
+// IsSuccess returns true when this delete organization internal server error response has a 2xx status code
+func (o *DeleteOrganizationInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this delete organization internal server error response has a 3xx status code
+func (o *DeleteOrganizationInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this delete organization internal server error response has a 4xx status code
+func (o *DeleteOrganizationInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this delete organization internal server error response has a 5xx status code
+func (o *DeleteOrganizationInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this delete organization internal server error response a status code equal to that given
+func (o *DeleteOrganizationInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the delete organization internal server error response
+func (o *DeleteOrganizationInternalServerError) Code() int {
+	return 500
+}
+
+func (o *DeleteOrganizationInternalServerError) Error() string {
+	return fmt.Sprintf("[DELETE /organization][%d] deleteOrganizationInternalServerError ", 500)
+}
+
+func (o *DeleteOrganizationInternalServerError) String() string {
+	return fmt.Sprintf("[DELETE /organization][%d] deleteOrganizationInternalServerError ", 500)
+}
+
+func (o *DeleteOrganizationInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+/*
+DeleteOrganizationBody delete organization body
+swagger:model DeleteOrganizationBody
+*/
+type DeleteOrganizationBody struct {
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this delete organization body
+func (o *DeleteOrganizationBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this delete organization body based on context it is used
+func (o *DeleteOrganizationBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *DeleteOrganizationBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *DeleteOrganizationBody) UnmarshalBinary(b []byte) error {
+	var res DeleteOrganizationBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_client_zrok/admin/list_organization_members_parameters.go

@@ -0,0 +1,146 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewListOrganizationMembersParams creates a new ListOrganizationMembersParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewListOrganizationMembersParams() *ListOrganizationMembersParams {
+	return &ListOrganizationMembersParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewListOrganizationMembersParamsWithTimeout creates a new ListOrganizationMembersParams object
+// with the ability to set a timeout on a request.
+func NewListOrganizationMembersParamsWithTimeout(timeout time.Duration) *ListOrganizationMembersParams {
+	return &ListOrganizationMembersParams{
+		timeout: timeout,
+	}
+}
+
+// NewListOrganizationMembersParamsWithContext creates a new ListOrganizationMembersParams object
+// with the ability to set a context for a request.
+func NewListOrganizationMembersParamsWithContext(ctx context.Context) *ListOrganizationMembersParams {
+	return &ListOrganizationMembersParams{
+		Context: ctx,
+	}
+}
+
+// NewListOrganizationMembersParamsWithHTTPClient creates a new ListOrganizationMembersParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewListOrganizationMembersParamsWithHTTPClient(client *http.Client) *ListOrganizationMembersParams {
+	return &ListOrganizationMembersParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+ListOrganizationMembersParams contains all the parameters to send to the API endpoint
+
+	for the list organization members operation.
+
+	Typically these are written to a http.Request.
+*/
+type ListOrganizationMembersParams struct {
+
+	// Body.
+	Body ListOrganizationMembersBody
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the list organization members params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ListOrganizationMembersParams) WithDefaults() *ListOrganizationMembersParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the list organization members params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ListOrganizationMembersParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the list organization members params
+func (o *ListOrganizationMembersParams) WithTimeout(timeout time.Duration) *ListOrganizationMembersParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the list organization members params
+func (o *ListOrganizationMembersParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the list organization members params
+func (o *ListOrganizationMembersParams) WithContext(ctx context.Context) *ListOrganizationMembersParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the list organization members params
+func (o *ListOrganizationMembersParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the list organization members params
+func (o *ListOrganizationMembersParams) WithHTTPClient(client *http.Client) *ListOrganizationMembersParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the list organization members params
+func (o *ListOrganizationMembersParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithBody adds the body to the list organization members params
+func (o *ListOrganizationMembersParams) WithBody(body ListOrganizationMembersBody) *ListOrganizationMembersParams {
+	o.SetBody(body)
+	return o
+}
+
+// SetBody adds the body to the list organization members params
+func (o *ListOrganizationMembersParams) SetBody(body ListOrganizationMembersBody) {
+	o.Body = body
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *ListOrganizationMembersParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+	if err := r.SetBodyParam(o.Body); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/admin/list_organization_members_responses.go

@@ -0,0 +1,477 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// ListOrganizationMembersReader is a Reader for the ListOrganizationMembers structure.
+type ListOrganizationMembersReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *ListOrganizationMembersReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewListOrganizationMembersOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewListOrganizationMembersUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 404:
+		result := NewListOrganizationMembersNotFound()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewListOrganizationMembersInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[POST /organization/list] listOrganizationMembers", response, response.Code())
+	}
+}
+
+// NewListOrganizationMembersOK creates a ListOrganizationMembersOK with default headers values
+func NewListOrganizationMembersOK() *ListOrganizationMembersOK {
+	return &ListOrganizationMembersOK{}
+}
+
+/*
+ListOrganizationMembersOK describes a response with status code 200, with default header values.
+
+list organization members
+*/
+type ListOrganizationMembersOK struct {
+	Payload *ListOrganizationMembersOKBody
+}
+
+// IsSuccess returns true when this list organization members o k response has a 2xx status code
+func (o *ListOrganizationMembersOK) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this list organization members o k response has a 3xx status code
+func (o *ListOrganizationMembersOK) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list organization members o k response has a 4xx status code
+func (o *ListOrganizationMembersOK) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this list organization members o k response has a 5xx status code
+func (o *ListOrganizationMembersOK) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this list organization members o k response a status code equal to that given
+func (o *ListOrganizationMembersOK) IsCode(code int) bool {
+	return code == 200
+}
+
+// Code gets the status code for the list organization members o k response
+func (o *ListOrganizationMembersOK) Code() int {
+	return 200
+}
+
+func (o *ListOrganizationMembersOK) Error() string {
+	return fmt.Sprintf("[POST /organization/list][%d] listOrganizationMembersOK  %+v", 200, o.Payload)
+}
+
+func (o *ListOrganizationMembersOK) String() string {
+	return fmt.Sprintf("[POST /organization/list][%d] listOrganizationMembersOK  %+v", 200, o.Payload)
+}
+
+func (o *ListOrganizationMembersOK) GetPayload() *ListOrganizationMembersOKBody {
+	return o.Payload
+}
+
+func (o *ListOrganizationMembersOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(ListOrganizationMembersOKBody)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewListOrganizationMembersUnauthorized creates a ListOrganizationMembersUnauthorized with default headers values
+func NewListOrganizationMembersUnauthorized() *ListOrganizationMembersUnauthorized {
+	return &ListOrganizationMembersUnauthorized{}
+}
+
+/*
+ListOrganizationMembersUnauthorized describes a response with status code 401, with default header values.
+
+unauthorized
+*/
+type ListOrganizationMembersUnauthorized struct {
+}
+
+// IsSuccess returns true when this list organization members unauthorized response has a 2xx status code
+func (o *ListOrganizationMembersUnauthorized) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this list organization members unauthorized response has a 3xx status code
+func (o *ListOrganizationMembersUnauthorized) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list organization members unauthorized response has a 4xx status code
+func (o *ListOrganizationMembersUnauthorized) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this list organization members unauthorized response has a 5xx status code
+func (o *ListOrganizationMembersUnauthorized) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this list organization members unauthorized response a status code equal to that given
+func (o *ListOrganizationMembersUnauthorized) IsCode(code int) bool {
+	return code == 401
+}
+
+// Code gets the status code for the list organization members unauthorized response
+func (o *ListOrganizationMembersUnauthorized) Code() int {
+	return 401
+}
+
+func (o *ListOrganizationMembersUnauthorized) Error() string {
+	return fmt.Sprintf("[POST /organization/list][%d] listOrganizationMembersUnauthorized ", 401)
+}
+
+func (o *ListOrganizationMembersUnauthorized) String() string {
+	return fmt.Sprintf("[POST /organization/list][%d] listOrganizationMembersUnauthorized ", 401)
+}
+
+func (o *ListOrganizationMembersUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewListOrganizationMembersNotFound creates a ListOrganizationMembersNotFound with default headers values
+func NewListOrganizationMembersNotFound() *ListOrganizationMembersNotFound {
+	return &ListOrganizationMembersNotFound{}
+}
+
+/*
+ListOrganizationMembersNotFound describes a response with status code 404, with default header values.
+
+not found
+*/
+type ListOrganizationMembersNotFound struct {
+}
+
+// IsSuccess returns true when this list organization members not found response has a 2xx status code
+func (o *ListOrganizationMembersNotFound) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this list organization members not found response has a 3xx status code
+func (o *ListOrganizationMembersNotFound) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list organization members not found response has a 4xx status code
+func (o *ListOrganizationMembersNotFound) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this list organization members not found response has a 5xx status code
+func (o *ListOrganizationMembersNotFound) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this list organization members not found response a status code equal to that given
+func (o *ListOrganizationMembersNotFound) IsCode(code int) bool {
+	return code == 404
+}
+
+// Code gets the status code for the list organization members not found response
+func (o *ListOrganizationMembersNotFound) Code() int {
+	return 404
+}
+
+func (o *ListOrganizationMembersNotFound) Error() string {
+	return fmt.Sprintf("[POST /organization/list][%d] listOrganizationMembersNotFound ", 404)
+}
+
+func (o *ListOrganizationMembersNotFound) String() string {
+	return fmt.Sprintf("[POST /organization/list][%d] listOrganizationMembersNotFound ", 404)
+}
+
+func (o *ListOrganizationMembersNotFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewListOrganizationMembersInternalServerError creates a ListOrganizationMembersInternalServerError with default headers values
+func NewListOrganizationMembersInternalServerError() *ListOrganizationMembersInternalServerError {
+	return &ListOrganizationMembersInternalServerError{}
+}
+
+/*
+ListOrganizationMembersInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type ListOrganizationMembersInternalServerError struct {
+}
+
+// IsSuccess returns true when this list organization members internal server error response has a 2xx status code
+func (o *ListOrganizationMembersInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this list organization members internal server error response has a 3xx status code
+func (o *ListOrganizationMembersInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list organization members internal server error response has a 4xx status code
+func (o *ListOrganizationMembersInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this list organization members internal server error response has a 5xx status code
+func (o *ListOrganizationMembersInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this list organization members internal server error response a status code equal to that given
+func (o *ListOrganizationMembersInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the list organization members internal server error response
+func (o *ListOrganizationMembersInternalServerError) Code() int {
+	return 500
+}
+
+func (o *ListOrganizationMembersInternalServerError) Error() string {
+	return fmt.Sprintf("[POST /organization/list][%d] listOrganizationMembersInternalServerError ", 500)
+}
+
+func (o *ListOrganizationMembersInternalServerError) String() string {
+	return fmt.Sprintf("[POST /organization/list][%d] listOrganizationMembersInternalServerError ", 500)
+}
+
+func (o *ListOrganizationMembersInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+/*
+ListOrganizationMembersBody list organization members body
+swagger:model ListOrganizationMembersBody
+*/
+type ListOrganizationMembersBody struct {
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this list organization members body
+func (o *ListOrganizationMembersBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list organization members body based on context it is used
+func (o *ListOrganizationMembersBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrganizationMembersBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrganizationMembersBody) UnmarshalBinary(b []byte) error {
+	var res ListOrganizationMembersBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+/*
+ListOrganizationMembersOKBody list organization members o k body
+swagger:model ListOrganizationMembersOKBody
+*/
+type ListOrganizationMembersOKBody struct {
+
+	// members
+	Members []*ListOrganizationMembersOKBodyMembersItems0 `json:"members"`
+}
+
+// Validate validates this list organization members o k body
+func (o *ListOrganizationMembersOKBody) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.validateMembers(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrganizationMembersOKBody) validateMembers(formats strfmt.Registry) error {
+	if swag.IsZero(o.Members) { // not required
+		return nil
+	}
+
+	for i := 0; i < len(o.Members); i++ {
+		if swag.IsZero(o.Members[i]) { // not required
+			continue
+		}
+
+		if o.Members[i] != nil {
+			if err := o.Members[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrganizationMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrganizationMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// ContextValidate validate this list organization members o k body based on the context it is used
+func (o *ListOrganizationMembersOKBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.contextValidateMembers(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrganizationMembersOKBody) contextValidateMembers(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(o.Members); i++ {
+
+		if o.Members[i] != nil {
+
+			if swag.IsZero(o.Members[i]) { // not required
+				return nil
+			}
+
+			if err := o.Members[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrganizationMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrganizationMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrganizationMembersOKBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrganizationMembersOKBody) UnmarshalBinary(b []byte) error {
+	var res ListOrganizationMembersOKBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+/*
+ListOrganizationMembersOKBodyMembersItems0 list organization members o k body members items0
+swagger:model ListOrganizationMembersOKBodyMembersItems0
+*/
+type ListOrganizationMembersOKBodyMembersItems0 struct {
+
+	// admin
+	Admin bool `json:"admin,omitempty"`
+
+	// email
+	Email string `json:"email,omitempty"`
+}
+
+// Validate validates this list organization members o k body members items0
+func (o *ListOrganizationMembersOKBodyMembersItems0) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list organization members o k body members items0 based on context it is used
+func (o *ListOrganizationMembersOKBodyMembersItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrganizationMembersOKBodyMembersItems0) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrganizationMembersOKBodyMembersItems0) UnmarshalBinary(b []byte) error {
+	var res ListOrganizationMembersOKBodyMembersItems0
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_client_zrok/admin/list_organizations_parameters.go

@@ -0,0 +1,128 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewListOrganizationsParams creates a new ListOrganizationsParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewListOrganizationsParams() *ListOrganizationsParams {
+	return &ListOrganizationsParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewListOrganizationsParamsWithTimeout creates a new ListOrganizationsParams object
+// with the ability to set a timeout on a request.
+func NewListOrganizationsParamsWithTimeout(timeout time.Duration) *ListOrganizationsParams {
+	return &ListOrganizationsParams{
+		timeout: timeout,
+	}
+}
+
+// NewListOrganizationsParamsWithContext creates a new ListOrganizationsParams object
+// with the ability to set a context for a request.
+func NewListOrganizationsParamsWithContext(ctx context.Context) *ListOrganizationsParams {
+	return &ListOrganizationsParams{
+		Context: ctx,
+	}
+}
+
+// NewListOrganizationsParamsWithHTTPClient creates a new ListOrganizationsParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewListOrganizationsParamsWithHTTPClient(client *http.Client) *ListOrganizationsParams {
+	return &ListOrganizationsParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+ListOrganizationsParams contains all the parameters to send to the API endpoint
+
+	for the list organizations operation.
+
+	Typically these are written to a http.Request.
+*/
+type ListOrganizationsParams struct {
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the list organizations params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ListOrganizationsParams) WithDefaults() *ListOrganizationsParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the list organizations params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ListOrganizationsParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the list organizations params
+func (o *ListOrganizationsParams) WithTimeout(timeout time.Duration) *ListOrganizationsParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the list organizations params
+func (o *ListOrganizationsParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the list organizations params
+func (o *ListOrganizationsParams) WithContext(ctx context.Context) *ListOrganizationsParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the list organizations params
+func (o *ListOrganizationsParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the list organizations params
+func (o *ListOrganizationsParams) WithHTTPClient(client *http.Client) *ListOrganizationsParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the list organizations params
+func (o *ListOrganizationsParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *ListOrganizationsParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/admin/list_organizations_responses.go

@@ -0,0 +1,377 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// ListOrganizationsReader is a Reader for the ListOrganizations structure.
+type ListOrganizationsReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *ListOrganizationsReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewListOrganizationsOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewListOrganizationsUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewListOrganizationsInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[GET /organizations] listOrganizations", response, response.Code())
+	}
+}
+
+// NewListOrganizationsOK creates a ListOrganizationsOK with default headers values
+func NewListOrganizationsOK() *ListOrganizationsOK {
+	return &ListOrganizationsOK{}
+}
+
+/*
+ListOrganizationsOK describes a response with status code 200, with default header values.
+
+ok
+*/
+type ListOrganizationsOK struct {
+	Payload *ListOrganizationsOKBody
+}
+
+// IsSuccess returns true when this list organizations o k response has a 2xx status code
+func (o *ListOrganizationsOK) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this list organizations o k response has a 3xx status code
+func (o *ListOrganizationsOK) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list organizations o k response has a 4xx status code
+func (o *ListOrganizationsOK) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this list organizations o k response has a 5xx status code
+func (o *ListOrganizationsOK) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this list organizations o k response a status code equal to that given
+func (o *ListOrganizationsOK) IsCode(code int) bool {
+	return code == 200
+}
+
+// Code gets the status code for the list organizations o k response
+func (o *ListOrganizationsOK) Code() int {
+	return 200
+}
+
+func (o *ListOrganizationsOK) Error() string {
+	return fmt.Sprintf("[GET /organizations][%d] listOrganizationsOK  %+v", 200, o.Payload)
+}
+
+func (o *ListOrganizationsOK) String() string {
+	return fmt.Sprintf("[GET /organizations][%d] listOrganizationsOK  %+v", 200, o.Payload)
+}
+
+func (o *ListOrganizationsOK) GetPayload() *ListOrganizationsOKBody {
+	return o.Payload
+}
+
+func (o *ListOrganizationsOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(ListOrganizationsOKBody)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewListOrganizationsUnauthorized creates a ListOrganizationsUnauthorized with default headers values
+func NewListOrganizationsUnauthorized() *ListOrganizationsUnauthorized {
+	return &ListOrganizationsUnauthorized{}
+}
+
+/*
+ListOrganizationsUnauthorized describes a response with status code 401, with default header values.
+
+unauthorized
+*/
+type ListOrganizationsUnauthorized struct {
+}
+
+// IsSuccess returns true when this list organizations unauthorized response has a 2xx status code
+func (o *ListOrganizationsUnauthorized) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this list organizations unauthorized response has a 3xx status code
+func (o *ListOrganizationsUnauthorized) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list organizations unauthorized response has a 4xx status code
+func (o *ListOrganizationsUnauthorized) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this list organizations unauthorized response has a 5xx status code
+func (o *ListOrganizationsUnauthorized) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this list organizations unauthorized response a status code equal to that given
+func (o *ListOrganizationsUnauthorized) IsCode(code int) bool {
+	return code == 401
+}
+
+// Code gets the status code for the list organizations unauthorized response
+func (o *ListOrganizationsUnauthorized) Code() int {
+	return 401
+}
+
+func (o *ListOrganizationsUnauthorized) Error() string {
+	return fmt.Sprintf("[GET /organizations][%d] listOrganizationsUnauthorized ", 401)
+}
+
+func (o *ListOrganizationsUnauthorized) String() string {
+	return fmt.Sprintf("[GET /organizations][%d] listOrganizationsUnauthorized ", 401)
+}
+
+func (o *ListOrganizationsUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewListOrganizationsInternalServerError creates a ListOrganizationsInternalServerError with default headers values
+func NewListOrganizationsInternalServerError() *ListOrganizationsInternalServerError {
+	return &ListOrganizationsInternalServerError{}
+}
+
+/*
+ListOrganizationsInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type ListOrganizationsInternalServerError struct {
+}
+
+// IsSuccess returns true when this list organizations internal server error response has a 2xx status code
+func (o *ListOrganizationsInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this list organizations internal server error response has a 3xx status code
+func (o *ListOrganizationsInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list organizations internal server error response has a 4xx status code
+func (o *ListOrganizationsInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this list organizations internal server error response has a 5xx status code
+func (o *ListOrganizationsInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this list organizations internal server error response a status code equal to that given
+func (o *ListOrganizationsInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the list organizations internal server error response
+func (o *ListOrganizationsInternalServerError) Code() int {
+	return 500
+}
+
+func (o *ListOrganizationsInternalServerError) Error() string {
+	return fmt.Sprintf("[GET /organizations][%d] listOrganizationsInternalServerError ", 500)
+}
+
+func (o *ListOrganizationsInternalServerError) String() string {
+	return fmt.Sprintf("[GET /organizations][%d] listOrganizationsInternalServerError ", 500)
+}
+
+func (o *ListOrganizationsInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+/*
+ListOrganizationsOKBody list organizations o k body
+swagger:model ListOrganizationsOKBody
+*/
+type ListOrganizationsOKBody struct {
+
+	// organizations
+	Organizations []*ListOrganizationsOKBodyOrganizationsItems0 `json:"organizations"`
+}
+
+// Validate validates this list organizations o k body
+func (o *ListOrganizationsOKBody) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.validateOrganizations(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrganizationsOKBody) validateOrganizations(formats strfmt.Registry) error {
+	if swag.IsZero(o.Organizations) { // not required
+		return nil
+	}
+
+	for i := 0; i < len(o.Organizations); i++ {
+		if swag.IsZero(o.Organizations[i]) { // not required
+			continue
+		}
+
+		if o.Organizations[i] != nil {
+			if err := o.Organizations[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrganizationsOK" + "." + "organizations" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrganizationsOK" + "." + "organizations" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// ContextValidate validate this list organizations o k body based on the context it is used
+func (o *ListOrganizationsOKBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.contextValidateOrganizations(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrganizationsOKBody) contextValidateOrganizations(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(o.Organizations); i++ {
+
+		if o.Organizations[i] != nil {
+
+			if swag.IsZero(o.Organizations[i]) { // not required
+				return nil
+			}
+
+			if err := o.Organizations[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrganizationsOK" + "." + "organizations" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrganizationsOK" + "." + "organizations" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrganizationsOKBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrganizationsOKBody) UnmarshalBinary(b []byte) error {
+	var res ListOrganizationsOKBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+/*
+ListOrganizationsOKBodyOrganizationsItems0 list organizations o k body organizations items0
+swagger:model ListOrganizationsOKBodyOrganizationsItems0
+*/
+type ListOrganizationsOKBodyOrganizationsItems0 struct {
+
+	// description
+	Description string `json:"description,omitempty"`
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this list organizations o k body organizations items0
+func (o *ListOrganizationsOKBodyOrganizationsItems0) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list organizations o k body organizations items0 based on context it is used
+func (o *ListOrganizationsOKBodyOrganizationsItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrganizationsOKBodyOrganizationsItems0) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrganizationsOKBodyOrganizationsItems0) UnmarshalBinary(b []byte) error {
+	var res ListOrganizationsOKBodyOrganizationsItems0
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_client_zrok/admin/remove_organization_member_parameters.go

@@ -0,0 +1,146 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewRemoveOrganizationMemberParams creates a new RemoveOrganizationMemberParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewRemoveOrganizationMemberParams() *RemoveOrganizationMemberParams {
+	return &RemoveOrganizationMemberParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewRemoveOrganizationMemberParamsWithTimeout creates a new RemoveOrganizationMemberParams object
+// with the ability to set a timeout on a request.
+func NewRemoveOrganizationMemberParamsWithTimeout(timeout time.Duration) *RemoveOrganizationMemberParams {
+	return &RemoveOrganizationMemberParams{
+		timeout: timeout,
+	}
+}
+
+// NewRemoveOrganizationMemberParamsWithContext creates a new RemoveOrganizationMemberParams object
+// with the ability to set a context for a request.
+func NewRemoveOrganizationMemberParamsWithContext(ctx context.Context) *RemoveOrganizationMemberParams {
+	return &RemoveOrganizationMemberParams{
+		Context: ctx,
+	}
+}
+
+// NewRemoveOrganizationMemberParamsWithHTTPClient creates a new RemoveOrganizationMemberParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewRemoveOrganizationMemberParamsWithHTTPClient(client *http.Client) *RemoveOrganizationMemberParams {
+	return &RemoveOrganizationMemberParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+RemoveOrganizationMemberParams contains all the parameters to send to the API endpoint
+
+	for the remove organization member operation.
+
+	Typically these are written to a http.Request.
+*/
+type RemoveOrganizationMemberParams struct {
+
+	// Body.
+	Body RemoveOrganizationMemberBody
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the remove organization member params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *RemoveOrganizationMemberParams) WithDefaults() *RemoveOrganizationMemberParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the remove organization member params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *RemoveOrganizationMemberParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the remove organization member params
+func (o *RemoveOrganizationMemberParams) WithTimeout(timeout time.Duration) *RemoveOrganizationMemberParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the remove organization member params
+func (o *RemoveOrganizationMemberParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the remove organization member params
+func (o *RemoveOrganizationMemberParams) WithContext(ctx context.Context) *RemoveOrganizationMemberParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the remove organization member params
+func (o *RemoveOrganizationMemberParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the remove organization member params
+func (o *RemoveOrganizationMemberParams) WithHTTPClient(client *http.Client) *RemoveOrganizationMemberParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the remove organization member params
+func (o *RemoveOrganizationMemberParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithBody adds the body to the remove organization member params
+func (o *RemoveOrganizationMemberParams) WithBody(body RemoveOrganizationMemberBody) *RemoveOrganizationMemberParams {
+	o.SetBody(body)
+	return o
+}
+
+// SetBody adds the body to the remove organization member params
+func (o *RemoveOrganizationMemberParams) SetBody(body RemoveOrganizationMemberBody) {
+	o.Body = body
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *RemoveOrganizationMemberParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+	if err := r.SetBodyParam(o.Body); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/admin/remove_organization_member_responses.go

@@ -0,0 +1,317 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// RemoveOrganizationMemberReader is a Reader for the RemoveOrganizationMember structure.
+type RemoveOrganizationMemberReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *RemoveOrganizationMemberReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewRemoveOrganizationMemberOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewRemoveOrganizationMemberUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 404:
+		result := NewRemoveOrganizationMemberNotFound()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewRemoveOrganizationMemberInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[POST /organization/remove] removeOrganizationMember", response, response.Code())
+	}
+}
+
+// NewRemoveOrganizationMemberOK creates a RemoveOrganizationMemberOK with default headers values
+func NewRemoveOrganizationMemberOK() *RemoveOrganizationMemberOK {
+	return &RemoveOrganizationMemberOK{}
+}
+
+/*
+RemoveOrganizationMemberOK describes a response with status code 200, with default header values.
+
+member removed
+*/
+type RemoveOrganizationMemberOK struct {
+}
+
+// IsSuccess returns true when this remove organization member o k response has a 2xx status code
+func (o *RemoveOrganizationMemberOK) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this remove organization member o k response has a 3xx status code
+func (o *RemoveOrganizationMemberOK) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this remove organization member o k response has a 4xx status code
+func (o *RemoveOrganizationMemberOK) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this remove organization member o k response has a 5xx status code
+func (o *RemoveOrganizationMemberOK) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this remove organization member o k response a status code equal to that given
+func (o *RemoveOrganizationMemberOK) IsCode(code int) bool {
+	return code == 200
+}
+
+// Code gets the status code for the remove organization member o k response
+func (o *RemoveOrganizationMemberOK) Code() int {
+	return 200
+}
+
+func (o *RemoveOrganizationMemberOK) Error() string {
+	return fmt.Sprintf("[POST /organization/remove][%d] removeOrganizationMemberOK ", 200)
+}
+
+func (o *RemoveOrganizationMemberOK) String() string {
+	return fmt.Sprintf("[POST /organization/remove][%d] removeOrganizationMemberOK ", 200)
+}
+
+func (o *RemoveOrganizationMemberOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewRemoveOrganizationMemberUnauthorized creates a RemoveOrganizationMemberUnauthorized with default headers values
+func NewRemoveOrganizationMemberUnauthorized() *RemoveOrganizationMemberUnauthorized {
+	return &RemoveOrganizationMemberUnauthorized{}
+}
+
+/*
+RemoveOrganizationMemberUnauthorized describes a response with status code 401, with default header values.
+
+unauthorized
+*/
+type RemoveOrganizationMemberUnauthorized struct {
+}
+
+// IsSuccess returns true when this remove organization member unauthorized response has a 2xx status code
+func (o *RemoveOrganizationMemberUnauthorized) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this remove organization member unauthorized response has a 3xx status code
+func (o *RemoveOrganizationMemberUnauthorized) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this remove organization member unauthorized response has a 4xx status code
+func (o *RemoveOrganizationMemberUnauthorized) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this remove organization member unauthorized response has a 5xx status code
+func (o *RemoveOrganizationMemberUnauthorized) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this remove organization member unauthorized response a status code equal to that given
+func (o *RemoveOrganizationMemberUnauthorized) IsCode(code int) bool {
+	return code == 401
+}
+
+// Code gets the status code for the remove organization member unauthorized response
+func (o *RemoveOrganizationMemberUnauthorized) Code() int {
+	return 401
+}
+
+func (o *RemoveOrganizationMemberUnauthorized) Error() string {
+	return fmt.Sprintf("[POST /organization/remove][%d] removeOrganizationMemberUnauthorized ", 401)
+}
+
+func (o *RemoveOrganizationMemberUnauthorized) String() string {
+	return fmt.Sprintf("[POST /organization/remove][%d] removeOrganizationMemberUnauthorized ", 401)
+}
+
+func (o *RemoveOrganizationMemberUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewRemoveOrganizationMemberNotFound creates a RemoveOrganizationMemberNotFound with default headers values
+func NewRemoveOrganizationMemberNotFound() *RemoveOrganizationMemberNotFound {
+	return &RemoveOrganizationMemberNotFound{}
+}
+
+/*
+RemoveOrganizationMemberNotFound describes a response with status code 404, with default header values.
+
+not found
+*/
+type RemoveOrganizationMemberNotFound struct {
+}
+
+// IsSuccess returns true when this remove organization member not found response has a 2xx status code
+func (o *RemoveOrganizationMemberNotFound) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this remove organization member not found response has a 3xx status code
+func (o *RemoveOrganizationMemberNotFound) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this remove organization member not found response has a 4xx status code
+func (o *RemoveOrganizationMemberNotFound) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this remove organization member not found response has a 5xx status code
+func (o *RemoveOrganizationMemberNotFound) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this remove organization member not found response a status code equal to that given
+func (o *RemoveOrganizationMemberNotFound) IsCode(code int) bool {
+	return code == 404
+}
+
+// Code gets the status code for the remove organization member not found response
+func (o *RemoveOrganizationMemberNotFound) Code() int {
+	return 404
+}
+
+func (o *RemoveOrganizationMemberNotFound) Error() string {
+	return fmt.Sprintf("[POST /organization/remove][%d] removeOrganizationMemberNotFound ", 404)
+}
+
+func (o *RemoveOrganizationMemberNotFound) String() string {
+	return fmt.Sprintf("[POST /organization/remove][%d] removeOrganizationMemberNotFound ", 404)
+}
+
+func (o *RemoveOrganizationMemberNotFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewRemoveOrganizationMemberInternalServerError creates a RemoveOrganizationMemberInternalServerError with default headers values
+func NewRemoveOrganizationMemberInternalServerError() *RemoveOrganizationMemberInternalServerError {
+	return &RemoveOrganizationMemberInternalServerError{}
+}
+
+/*
+RemoveOrganizationMemberInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type RemoveOrganizationMemberInternalServerError struct {
+}
+
+// IsSuccess returns true when this remove organization member internal server error response has a 2xx status code
+func (o *RemoveOrganizationMemberInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this remove organization member internal server error response has a 3xx status code
+func (o *RemoveOrganizationMemberInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this remove organization member internal server error response has a 4xx status code
+func (o *RemoveOrganizationMemberInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this remove organization member internal server error response has a 5xx status code
+func (o *RemoveOrganizationMemberInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this remove organization member internal server error response a status code equal to that given
+func (o *RemoveOrganizationMemberInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the remove organization member internal server error response
+func (o *RemoveOrganizationMemberInternalServerError) Code() int {
+	return 500
+}
+
+func (o *RemoveOrganizationMemberInternalServerError) Error() string {
+	return fmt.Sprintf("[POST /organization/remove][%d] removeOrganizationMemberInternalServerError ", 500)
+}
+
+func (o *RemoveOrganizationMemberInternalServerError) String() string {
+	return fmt.Sprintf("[POST /organization/remove][%d] removeOrganizationMemberInternalServerError ", 500)
+}
+
+func (o *RemoveOrganizationMemberInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+/*
+RemoveOrganizationMemberBody remove organization member body
+swagger:model RemoveOrganizationMemberBody
+*/
+type RemoveOrganizationMemberBody struct {
+
+	// email
+	Email string `json:"email,omitempty"`
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this remove organization member body
+func (o *RemoveOrganizationMemberBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this remove organization member body based on context it is used
+func (o *RemoveOrganizationMemberBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *RemoveOrganizationMemberBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *RemoveOrganizationMemberBody) UnmarshalBinary(b []byte) error {
+	var res RemoveOrganizationMemberBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_client_zrok/metadata/list_members_parameters.go

@@ -0,0 +1,148 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewListMembersParams creates a new ListMembersParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewListMembersParams() *ListMembersParams {
+	return &ListMembersParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewListMembersParamsWithTimeout creates a new ListMembersParams object
+// with the ability to set a timeout on a request.
+func NewListMembersParamsWithTimeout(timeout time.Duration) *ListMembersParams {
+	return &ListMembersParams{
+		timeout: timeout,
+	}
+}
+
+// NewListMembersParamsWithContext creates a new ListMembersParams object
+// with the ability to set a context for a request.
+func NewListMembersParamsWithContext(ctx context.Context) *ListMembersParams {
+	return &ListMembersParams{
+		Context: ctx,
+	}
+}
+
+// NewListMembersParamsWithHTTPClient creates a new ListMembersParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewListMembersParamsWithHTTPClient(client *http.Client) *ListMembersParams {
+	return &ListMembersParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+ListMembersParams contains all the parameters to send to the API endpoint
+
+	for the list members operation.
+
+	Typically these are written to a http.Request.
+*/
+type ListMembersParams struct {
+
+	// OrganizationToken.
+	OrganizationToken string
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the list members params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ListMembersParams) WithDefaults() *ListMembersParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the list members params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ListMembersParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the list members params
+func (o *ListMembersParams) WithTimeout(timeout time.Duration) *ListMembersParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the list members params
+func (o *ListMembersParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the list members params
+func (o *ListMembersParams) WithContext(ctx context.Context) *ListMembersParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the list members params
+func (o *ListMembersParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the list members params
+func (o *ListMembersParams) WithHTTPClient(client *http.Client) *ListMembersParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the list members params
+func (o *ListMembersParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithOrganizationToken adds the organizationToken to the list members params
+func (o *ListMembersParams) WithOrganizationToken(organizationToken string) *ListMembersParams {
+	o.SetOrganizationToken(organizationToken)
+	return o
+}
+
+// SetOrganizationToken adds the organizationToken to the list members params
+func (o *ListMembersParams) SetOrganizationToken(organizationToken string) {
+	o.OrganizationToken = organizationToken
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *ListMembersParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	// path param organizationToken
+	if err := r.SetPathParam("organizationToken", o.OrganizationToken); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/metadata/list_members_responses.go

@@ -0,0 +1,377 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// ListMembersReader is a Reader for the ListMembers structure.
+type ListMembersReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *ListMembersReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewListMembersOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 404:
+		result := NewListMembersNotFound()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewListMembersInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[GET /members/{organizationToken}] listMembers", response, response.Code())
+	}
+}
+
+// NewListMembersOK creates a ListMembersOK with default headers values
+func NewListMembersOK() *ListMembersOK {
+	return &ListMembersOK{}
+}
+
+/*
+ListMembersOK describes a response with status code 200, with default header values.
+
+ok
+*/
+type ListMembersOK struct {
+	Payload *ListMembersOKBody
+}
+
+// IsSuccess returns true when this list members o k response has a 2xx status code
+func (o *ListMembersOK) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this list members o k response has a 3xx status code
+func (o *ListMembersOK) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list members o k response has a 4xx status code
+func (o *ListMembersOK) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this list members o k response has a 5xx status code
+func (o *ListMembersOK) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this list members o k response a status code equal to that given
+func (o *ListMembersOK) IsCode(code int) bool {
+	return code == 200
+}
+
+// Code gets the status code for the list members o k response
+func (o *ListMembersOK) Code() int {
+	return 200
+}
+
+func (o *ListMembersOK) Error() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listMembersOK  %+v", 200, o.Payload)
+}
+
+func (o *ListMembersOK) String() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listMembersOK  %+v", 200, o.Payload)
+}
+
+func (o *ListMembersOK) GetPayload() *ListMembersOKBody {
+	return o.Payload
+}
+
+func (o *ListMembersOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(ListMembersOKBody)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewListMembersNotFound creates a ListMembersNotFound with default headers values
+func NewListMembersNotFound() *ListMembersNotFound {
+	return &ListMembersNotFound{}
+}
+
+/*
+ListMembersNotFound describes a response with status code 404, with default header values.
+
+not found
+*/
+type ListMembersNotFound struct {
+}
+
+// IsSuccess returns true when this list members not found response has a 2xx status code
+func (o *ListMembersNotFound) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this list members not found response has a 3xx status code
+func (o *ListMembersNotFound) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list members not found response has a 4xx status code
+func (o *ListMembersNotFound) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this list members not found response has a 5xx status code
+func (o *ListMembersNotFound) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this list members not found response a status code equal to that given
+func (o *ListMembersNotFound) IsCode(code int) bool {
+	return code == 404
+}
+
+// Code gets the status code for the list members not found response
+func (o *ListMembersNotFound) Code() int {
+	return 404
+}
+
+func (o *ListMembersNotFound) Error() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listMembersNotFound ", 404)
+}
+
+func (o *ListMembersNotFound) String() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listMembersNotFound ", 404)
+}
+
+func (o *ListMembersNotFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewListMembersInternalServerError creates a ListMembersInternalServerError with default headers values
+func NewListMembersInternalServerError() *ListMembersInternalServerError {
+	return &ListMembersInternalServerError{}
+}
+
+/*
+ListMembersInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type ListMembersInternalServerError struct {
+}
+
+// IsSuccess returns true when this list members internal server error response has a 2xx status code
+func (o *ListMembersInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this list members internal server error response has a 3xx status code
+func (o *ListMembersInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list members internal server error response has a 4xx status code
+func (o *ListMembersInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this list members internal server error response has a 5xx status code
+func (o *ListMembersInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this list members internal server error response a status code equal to that given
+func (o *ListMembersInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the list members internal server error response
+func (o *ListMembersInternalServerError) Code() int {
+	return 500
+}
+
+func (o *ListMembersInternalServerError) Error() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listMembersInternalServerError ", 500)
+}
+
+func (o *ListMembersInternalServerError) String() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listMembersInternalServerError ", 500)
+}
+
+func (o *ListMembersInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+/*
+ListMembersOKBody list members o k body
+swagger:model ListMembersOKBody
+*/
+type ListMembersOKBody struct {
+
+	// members
+	Members []*ListMembersOKBodyMembersItems0 `json:"members"`
+}
+
+// Validate validates this list members o k body
+func (o *ListMembersOKBody) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.validateMembers(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListMembersOKBody) validateMembers(formats strfmt.Registry) error {
+	if swag.IsZero(o.Members) { // not required
+		return nil
+	}
+
+	for i := 0; i < len(o.Members); i++ {
+		if swag.IsZero(o.Members[i]) { // not required
+			continue
+		}
+
+		if o.Members[i] != nil {
+			if err := o.Members[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// ContextValidate validate this list members o k body based on the context it is used
+func (o *ListMembersOKBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.contextValidateMembers(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListMembersOKBody) contextValidateMembers(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(o.Members); i++ {
+
+		if o.Members[i] != nil {
+
+			if swag.IsZero(o.Members[i]) { // not required
+				return nil
+			}
+
+			if err := o.Members[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListMembersOKBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListMembersOKBody) UnmarshalBinary(b []byte) error {
+	var res ListMembersOKBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+/*
+ListMembersOKBodyMembersItems0 list members o k body members items0
+swagger:model ListMembersOKBodyMembersItems0
+*/
+type ListMembersOKBodyMembersItems0 struct {
+
+	// admin
+	Admin bool `json:"admin,omitempty"`
+
+	// email
+	Email string `json:"email,omitempty"`
+}
+
+// Validate validates this list members o k body members items0
+func (o *ListMembersOKBodyMembersItems0) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list members o k body members items0 based on context it is used
+func (o *ListMembersOKBodyMembersItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListMembersOKBodyMembersItems0) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListMembersOKBodyMembersItems0) UnmarshalBinary(b []byte) error {
+	var res ListMembersOKBodyMembersItems0
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_client_zrok/metadata/list_memberships_parameters.go

@@ -0,0 +1,128 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewListMembershipsParams creates a new ListMembershipsParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewListMembershipsParams() *ListMembershipsParams {
+	return &ListMembershipsParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewListMembershipsParamsWithTimeout creates a new ListMembershipsParams object
+// with the ability to set a timeout on a request.
+func NewListMembershipsParamsWithTimeout(timeout time.Duration) *ListMembershipsParams {
+	return &ListMembershipsParams{
+		timeout: timeout,
+	}
+}
+
+// NewListMembershipsParamsWithContext creates a new ListMembershipsParams object
+// with the ability to set a context for a request.
+func NewListMembershipsParamsWithContext(ctx context.Context) *ListMembershipsParams {
+	return &ListMembershipsParams{
+		Context: ctx,
+	}
+}
+
+// NewListMembershipsParamsWithHTTPClient creates a new ListMembershipsParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewListMembershipsParamsWithHTTPClient(client *http.Client) *ListMembershipsParams {
+	return &ListMembershipsParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+ListMembershipsParams contains all the parameters to send to the API endpoint
+
+	for the list memberships operation.
+
+	Typically these are written to a http.Request.
+*/
+type ListMembershipsParams struct {
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the list memberships params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ListMembershipsParams) WithDefaults() *ListMembershipsParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the list memberships params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ListMembershipsParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the list memberships params
+func (o *ListMembershipsParams) WithTimeout(timeout time.Duration) *ListMembershipsParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the list memberships params
+func (o *ListMembershipsParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the list memberships params
+func (o *ListMembershipsParams) WithContext(ctx context.Context) *ListMembershipsParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the list memberships params
+func (o *ListMembershipsParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the list memberships params
+func (o *ListMembershipsParams) WithHTTPClient(client *http.Client) *ListMembershipsParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the list memberships params
+func (o *ListMembershipsParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *ListMembershipsParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/metadata/list_memberships_responses.go

@@ -0,0 +1,318 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// ListMembershipsReader is a Reader for the ListMemberships structure.
+type ListMembershipsReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *ListMembershipsReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewListMembershipsOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 500:
+		result := NewListMembershipsInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[GET /memberships] listMemberships", response, response.Code())
+	}
+}
+
+// NewListMembershipsOK creates a ListMembershipsOK with default headers values
+func NewListMembershipsOK() *ListMembershipsOK {
+	return &ListMembershipsOK{}
+}
+
+/*
+ListMembershipsOK describes a response with status code 200, with default header values.
+
+ok
+*/
+type ListMembershipsOK struct {
+	Payload *ListMembershipsOKBody
+}
+
+// IsSuccess returns true when this list memberships o k response has a 2xx status code
+func (o *ListMembershipsOK) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this list memberships o k response has a 3xx status code
+func (o *ListMembershipsOK) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list memberships o k response has a 4xx status code
+func (o *ListMembershipsOK) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this list memberships o k response has a 5xx status code
+func (o *ListMembershipsOK) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this list memberships o k response a status code equal to that given
+func (o *ListMembershipsOK) IsCode(code int) bool {
+	return code == 200
+}
+
+// Code gets the status code for the list memberships o k response
+func (o *ListMembershipsOK) Code() int {
+	return 200
+}
+
+func (o *ListMembershipsOK) Error() string {
+	return fmt.Sprintf("[GET /memberships][%d] listMembershipsOK  %+v", 200, o.Payload)
+}
+
+func (o *ListMembershipsOK) String() string {
+	return fmt.Sprintf("[GET /memberships][%d] listMembershipsOK  %+v", 200, o.Payload)
+}
+
+func (o *ListMembershipsOK) GetPayload() *ListMembershipsOKBody {
+	return o.Payload
+}
+
+func (o *ListMembershipsOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(ListMembershipsOKBody)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewListMembershipsInternalServerError creates a ListMembershipsInternalServerError with default headers values
+func NewListMembershipsInternalServerError() *ListMembershipsInternalServerError {
+	return &ListMembershipsInternalServerError{}
+}
+
+/*
+ListMembershipsInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type ListMembershipsInternalServerError struct {
+}
+
+// IsSuccess returns true when this list memberships internal server error response has a 2xx status code
+func (o *ListMembershipsInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this list memberships internal server error response has a 3xx status code
+func (o *ListMembershipsInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list memberships internal server error response has a 4xx status code
+func (o *ListMembershipsInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this list memberships internal server error response has a 5xx status code
+func (o *ListMembershipsInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this list memberships internal server error response a status code equal to that given
+func (o *ListMembershipsInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the list memberships internal server error response
+func (o *ListMembershipsInternalServerError) Code() int {
+	return 500
+}
+
+func (o *ListMembershipsInternalServerError) Error() string {
+	return fmt.Sprintf("[GET /memberships][%d] listMembershipsInternalServerError ", 500)
+}
+
+func (o *ListMembershipsInternalServerError) String() string {
+	return fmt.Sprintf("[GET /memberships][%d] listMembershipsInternalServerError ", 500)
+}
+
+func (o *ListMembershipsInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+/*
+ListMembershipsOKBody list memberships o k body
+swagger:model ListMembershipsOKBody
+*/
+type ListMembershipsOKBody struct {
+
+	// memberships
+	Memberships []*ListMembershipsOKBodyMembershipsItems0 `json:"memberships"`
+}
+
+// Validate validates this list memberships o k body
+func (o *ListMembershipsOKBody) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.validateMemberships(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListMembershipsOKBody) validateMemberships(formats strfmt.Registry) error {
+	if swag.IsZero(o.Memberships) { // not required
+		return nil
+	}
+
+	for i := 0; i < len(o.Memberships); i++ {
+		if swag.IsZero(o.Memberships[i]) { // not required
+			continue
+		}
+
+		if o.Memberships[i] != nil {
+			if err := o.Memberships[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listMembershipsOK" + "." + "memberships" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listMembershipsOK" + "." + "memberships" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// ContextValidate validate this list memberships o k body based on the context it is used
+func (o *ListMembershipsOKBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.contextValidateMemberships(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListMembershipsOKBody) contextValidateMemberships(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(o.Memberships); i++ {
+
+		if o.Memberships[i] != nil {
+
+			if swag.IsZero(o.Memberships[i]) { // not required
+				return nil
+			}
+
+			if err := o.Memberships[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listMembershipsOK" + "." + "memberships" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listMembershipsOK" + "." + "memberships" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListMembershipsOKBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListMembershipsOKBody) UnmarshalBinary(b []byte) error {
+	var res ListMembershipsOKBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+/*
+ListMembershipsOKBodyMembershipsItems0 list memberships o k body memberships items0
+swagger:model ListMembershipsOKBodyMembershipsItems0
+*/
+type ListMembershipsOKBodyMembershipsItems0 struct {
+
+	// admin
+	Admin bool `json:"admin,omitempty"`
+
+	// description
+	Description string `json:"description,omitempty"`
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this list memberships o k body memberships items0
+func (o *ListMembershipsOKBodyMembershipsItems0) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list memberships o k body memberships items0 based on context it is used
+func (o *ListMembershipsOKBodyMembershipsItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListMembershipsOKBodyMembershipsItems0) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListMembershipsOKBodyMembershipsItems0) UnmarshalBinary(b []byte) error {
+	var res ListMembershipsOKBodyMembershipsItems0
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_client_zrok/metadata/list_org_members_parameters.go

@@ -0,0 +1,148 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewListOrgMembersParams creates a new ListOrgMembersParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewListOrgMembersParams() *ListOrgMembersParams {
+	return &ListOrgMembersParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewListOrgMembersParamsWithTimeout creates a new ListOrgMembersParams object
+// with the ability to set a timeout on a request.
+func NewListOrgMembersParamsWithTimeout(timeout time.Duration) *ListOrgMembersParams {
+	return &ListOrgMembersParams{
+		timeout: timeout,
+	}
+}
+
+// NewListOrgMembersParamsWithContext creates a new ListOrgMembersParams object
+// with the ability to set a context for a request.
+func NewListOrgMembersParamsWithContext(ctx context.Context) *ListOrgMembersParams {
+	return &ListOrgMembersParams{
+		Context: ctx,
+	}
+}
+
+// NewListOrgMembersParamsWithHTTPClient creates a new ListOrgMembersParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewListOrgMembersParamsWithHTTPClient(client *http.Client) *ListOrgMembersParams {
+	return &ListOrgMembersParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+ListOrgMembersParams contains all the parameters to send to the API endpoint
+
+	for the list org members operation.
+
+	Typically these are written to a http.Request.
+*/
+type ListOrgMembersParams struct {
+
+	// OrganizationToken.
+	OrganizationToken string
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the list org members params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ListOrgMembersParams) WithDefaults() *ListOrgMembersParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the list org members params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *ListOrgMembersParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the list org members params
+func (o *ListOrgMembersParams) WithTimeout(timeout time.Duration) *ListOrgMembersParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the list org members params
+func (o *ListOrgMembersParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the list org members params
+func (o *ListOrgMembersParams) WithContext(ctx context.Context) *ListOrgMembersParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the list org members params
+func (o *ListOrgMembersParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the list org members params
+func (o *ListOrgMembersParams) WithHTTPClient(client *http.Client) *ListOrgMembersParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the list org members params
+func (o *ListOrgMembersParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithOrganizationToken adds the organizationToken to the list org members params
+func (o *ListOrgMembersParams) WithOrganizationToken(organizationToken string) *ListOrgMembersParams {
+	o.SetOrganizationToken(organizationToken)
+	return o
+}
+
+// SetOrganizationToken adds the organizationToken to the list org members params
+func (o *ListOrgMembersParams) SetOrganizationToken(organizationToken string) {
+	o.OrganizationToken = organizationToken
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *ListOrgMembersParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	// path param organizationToken
+	if err := r.SetPathParam("organizationToken", o.OrganizationToken); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/metadata/list_org_members_responses.go

@@ -0,0 +1,377 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// ListOrgMembersReader is a Reader for the ListOrgMembers structure.
+type ListOrgMembersReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *ListOrgMembersReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewListOrgMembersOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 404:
+		result := NewListOrgMembersNotFound()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewListOrgMembersInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[GET /members/{organizationToken}] listOrgMembers", response, response.Code())
+	}
+}
+
+// NewListOrgMembersOK creates a ListOrgMembersOK with default headers values
+func NewListOrgMembersOK() *ListOrgMembersOK {
+	return &ListOrgMembersOK{}
+}
+
+/*
+ListOrgMembersOK describes a response with status code 200, with default header values.
+
+ok
+*/
+type ListOrgMembersOK struct {
+	Payload *ListOrgMembersOKBody
+}
+
+// IsSuccess returns true when this list org members o k response has a 2xx status code
+func (o *ListOrgMembersOK) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this list org members o k response has a 3xx status code
+func (o *ListOrgMembersOK) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list org members o k response has a 4xx status code
+func (o *ListOrgMembersOK) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this list org members o k response has a 5xx status code
+func (o *ListOrgMembersOK) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this list org members o k response a status code equal to that given
+func (o *ListOrgMembersOK) IsCode(code int) bool {
+	return code == 200
+}
+
+// Code gets the status code for the list org members o k response
+func (o *ListOrgMembersOK) Code() int {
+	return 200
+}
+
+func (o *ListOrgMembersOK) Error() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listOrgMembersOK  %+v", 200, o.Payload)
+}
+
+func (o *ListOrgMembersOK) String() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listOrgMembersOK  %+v", 200, o.Payload)
+}
+
+func (o *ListOrgMembersOK) GetPayload() *ListOrgMembersOKBody {
+	return o.Payload
+}
+
+func (o *ListOrgMembersOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(ListOrgMembersOKBody)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewListOrgMembersNotFound creates a ListOrgMembersNotFound with default headers values
+func NewListOrgMembersNotFound() *ListOrgMembersNotFound {
+	return &ListOrgMembersNotFound{}
+}
+
+/*
+ListOrgMembersNotFound describes a response with status code 404, with default header values.
+
+not found
+*/
+type ListOrgMembersNotFound struct {
+}
+
+// IsSuccess returns true when this list org members not found response has a 2xx status code
+func (o *ListOrgMembersNotFound) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this list org members not found response has a 3xx status code
+func (o *ListOrgMembersNotFound) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list org members not found response has a 4xx status code
+func (o *ListOrgMembersNotFound) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this list org members not found response has a 5xx status code
+func (o *ListOrgMembersNotFound) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this list org members not found response a status code equal to that given
+func (o *ListOrgMembersNotFound) IsCode(code int) bool {
+	return code == 404
+}
+
+// Code gets the status code for the list org members not found response
+func (o *ListOrgMembersNotFound) Code() int {
+	return 404
+}
+
+func (o *ListOrgMembersNotFound) Error() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listOrgMembersNotFound ", 404)
+}
+
+func (o *ListOrgMembersNotFound) String() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listOrgMembersNotFound ", 404)
+}
+
+func (o *ListOrgMembersNotFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewListOrgMembersInternalServerError creates a ListOrgMembersInternalServerError with default headers values
+func NewListOrgMembersInternalServerError() *ListOrgMembersInternalServerError {
+	return &ListOrgMembersInternalServerError{}
+}
+
+/*
+ListOrgMembersInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type ListOrgMembersInternalServerError struct {
+}
+
+// IsSuccess returns true when this list org members internal server error response has a 2xx status code
+func (o *ListOrgMembersInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this list org members internal server error response has a 3xx status code
+func (o *ListOrgMembersInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this list org members internal server error response has a 4xx status code
+func (o *ListOrgMembersInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this list org members internal server error response has a 5xx status code
+func (o *ListOrgMembersInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this list org members internal server error response a status code equal to that given
+func (o *ListOrgMembersInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the list org members internal server error response
+func (o *ListOrgMembersInternalServerError) Code() int {
+	return 500
+}
+
+func (o *ListOrgMembersInternalServerError) Error() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listOrgMembersInternalServerError ", 500)
+}
+
+func (o *ListOrgMembersInternalServerError) String() string {
+	return fmt.Sprintf("[GET /members/{organizationToken}][%d] listOrgMembersInternalServerError ", 500)
+}
+
+func (o *ListOrgMembersInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+/*
+ListOrgMembersOKBody list org members o k body
+swagger:model ListOrgMembersOKBody
+*/
+type ListOrgMembersOKBody struct {
+
+	// members
+	Members []*ListOrgMembersOKBodyMembersItems0 `json:"members"`
+}
+
+// Validate validates this list org members o k body
+func (o *ListOrgMembersOKBody) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.validateMembers(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrgMembersOKBody) validateMembers(formats strfmt.Registry) error {
+	if swag.IsZero(o.Members) { // not required
+		return nil
+	}
+
+	for i := 0; i < len(o.Members); i++ {
+		if swag.IsZero(o.Members[i]) { // not required
+			continue
+		}
+
+		if o.Members[i] != nil {
+			if err := o.Members[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrgMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrgMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// ContextValidate validate this list org members o k body based on the context it is used
+func (o *ListOrgMembersOKBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.contextValidateMembers(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrgMembersOKBody) contextValidateMembers(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(o.Members); i++ {
+
+		if o.Members[i] != nil {
+
+			if swag.IsZero(o.Members[i]) { // not required
+				return nil
+			}
+
+			if err := o.Members[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrgMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrgMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrgMembersOKBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrgMembersOKBody) UnmarshalBinary(b []byte) error {
+	var res ListOrgMembersOKBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+/*
+ListOrgMembersOKBodyMembersItems0 list org members o k body members items0
+swagger:model ListOrgMembersOKBodyMembersItems0
+*/
+type ListOrgMembersOKBodyMembersItems0 struct {
+
+	// admin
+	Admin bool `json:"admin,omitempty"`
+
+	// email
+	Email string `json:"email,omitempty"`
+}
+
+// Validate validates this list org members o k body members items0
+func (o *ListOrgMembersOKBodyMembersItems0) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list org members o k body members items0 based on context it is used
+func (o *ListOrgMembersOKBodyMembersItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrgMembersOKBodyMembersItems0) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrgMembersOKBodyMembersItems0) UnmarshalBinary(b []byte) error {
+	var res ListOrgMembersOKBodyMembersItems0
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_client_zrok/metadata/metadata_client.go

@@ -46,6 +46,12 @@ type ClientService interface {
 
 	GetShareMetrics(params *GetShareMetricsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*GetShareMetricsOK, error)
 
+	ListMemberships(params *ListMembershipsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ListMembershipsOK, error)
+
+	ListOrgMembers(params *ListOrgMembersParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ListOrgMembersOK, error)
+
+	OrgAccountOverview(params *OrgAccountOverviewParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*OrgAccountOverviewOK, error)
+
 	Overview(params *OverviewParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*OverviewOK, error)
 
 	Version(params *VersionParams, opts ...ClientOption) (*VersionOK, error)
@@ -364,6 +370,123 @@ func (a *Client) GetShareMetrics(params *GetShareMetricsParams, authInfo runtime
 	panic(msg)
 }
 
+/*
+ListMemberships list memberships API
+*/
+func (a *Client) ListMemberships(params *ListMembershipsParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ListMembershipsOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewListMembershipsParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "listMemberships",
+		Method:             "GET",
+		PathPattern:        "/memberships",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &ListMembershipsReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*ListMembershipsOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for listMemberships: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
+/*
+ListOrgMembers list org members API
+*/
+func (a *Client) ListOrgMembers(params *ListOrgMembersParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*ListOrgMembersOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewListOrgMembersParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "listOrgMembers",
+		Method:             "GET",
+		PathPattern:        "/members/{organizationToken}",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &ListOrgMembersReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*ListOrgMembersOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for listOrgMembers: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
+/*
+OrgAccountOverview org account overview API
+*/
+func (a *Client) OrgAccountOverview(params *OrgAccountOverviewParams, authInfo runtime.ClientAuthInfoWriter, opts ...ClientOption) (*OrgAccountOverviewOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewOrgAccountOverviewParams()
+	}
+	op := &runtime.ClientOperation{
+		ID:                 "orgAccountOverview",
+		Method:             "GET",
+		PathPattern:        "/overview/{organizationToken}/{accountEmail}",
+		ProducesMediaTypes: []string{"application/zrok.v1+json"},
+		ConsumesMediaTypes: []string{"application/zrok.v1+json"},
+		Schemes:            []string{"http"},
+		Params:             params,
+		Reader:             &OrgAccountOverviewReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	}
+	for _, opt := range opts {
+		opt(op)
+	}
+
+	result, err := a.transport.Submit(op)
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*OrgAccountOverviewOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for orgAccountOverview: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 /*
 Overview overview API
 */

rest_client_zrok/metadata/org_account_overview_parameters.go

@@ -0,0 +1,167 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewOrgAccountOverviewParams creates a new OrgAccountOverviewParams object,
+// with the default timeout for this client.
+//
+// Default values are not hydrated, since defaults are normally applied by the API server side.
+//
+// To enforce default values in parameter, use SetDefaults or WithDefaults.
+func NewOrgAccountOverviewParams() *OrgAccountOverviewParams {
+	return &OrgAccountOverviewParams{
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewOrgAccountOverviewParamsWithTimeout creates a new OrgAccountOverviewParams object
+// with the ability to set a timeout on a request.
+func NewOrgAccountOverviewParamsWithTimeout(timeout time.Duration) *OrgAccountOverviewParams {
+	return &OrgAccountOverviewParams{
+		timeout: timeout,
+	}
+}
+
+// NewOrgAccountOverviewParamsWithContext creates a new OrgAccountOverviewParams object
+// with the ability to set a context for a request.
+func NewOrgAccountOverviewParamsWithContext(ctx context.Context) *OrgAccountOverviewParams {
+	return &OrgAccountOverviewParams{
+		Context: ctx,
+	}
+}
+
+// NewOrgAccountOverviewParamsWithHTTPClient creates a new OrgAccountOverviewParams object
+// with the ability to set a custom HTTPClient for a request.
+func NewOrgAccountOverviewParamsWithHTTPClient(client *http.Client) *OrgAccountOverviewParams {
+	return &OrgAccountOverviewParams{
+		HTTPClient: client,
+	}
+}
+
+/*
+OrgAccountOverviewParams contains all the parameters to send to the API endpoint
+
+	for the org account overview operation.
+
+	Typically these are written to a http.Request.
+*/
+type OrgAccountOverviewParams struct {
+
+	// AccountEmail.
+	AccountEmail string
+
+	// OrganizationToken.
+	OrganizationToken string
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithDefaults hydrates default values in the org account overview params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *OrgAccountOverviewParams) WithDefaults() *OrgAccountOverviewParams {
+	o.SetDefaults()
+	return o
+}
+
+// SetDefaults hydrates default values in the org account overview params (not the query body).
+//
+// All values with no default are reset to their zero value.
+func (o *OrgAccountOverviewParams) SetDefaults() {
+	// no default values defined for this parameter
+}
+
+// WithTimeout adds the timeout to the org account overview params
+func (o *OrgAccountOverviewParams) WithTimeout(timeout time.Duration) *OrgAccountOverviewParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the org account overview params
+func (o *OrgAccountOverviewParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the org account overview params
+func (o *OrgAccountOverviewParams) WithContext(ctx context.Context) *OrgAccountOverviewParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the org account overview params
+func (o *OrgAccountOverviewParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the org account overview params
+func (o *OrgAccountOverviewParams) WithHTTPClient(client *http.Client) *OrgAccountOverviewParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the org account overview params
+func (o *OrgAccountOverviewParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithAccountEmail adds the accountEmail to the org account overview params
+func (o *OrgAccountOverviewParams) WithAccountEmail(accountEmail string) *OrgAccountOverviewParams {
+	o.SetAccountEmail(accountEmail)
+	return o
+}
+
+// SetAccountEmail adds the accountEmail to the org account overview params
+func (o *OrgAccountOverviewParams) SetAccountEmail(accountEmail string) {
+	o.AccountEmail = accountEmail
+}
+
+// WithOrganizationToken adds the organizationToken to the org account overview params
+func (o *OrgAccountOverviewParams) WithOrganizationToken(organizationToken string) *OrgAccountOverviewParams {
+	o.SetOrganizationToken(organizationToken)
+	return o
+}
+
+// SetOrganizationToken adds the organizationToken to the org account overview params
+func (o *OrgAccountOverviewParams) SetOrganizationToken(organizationToken string) {
+	o.OrganizationToken = organizationToken
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *OrgAccountOverviewParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	// path param accountEmail
+	if err := r.SetPathParam("accountEmail", o.AccountEmail); err != nil {
+		return err
+	}
+
+	// path param organizationToken
+	if err := r.SetPathParam("organizationToken", o.OrganizationToken); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client_zrok/metadata/org_account_overview_responses.go

@@ -0,0 +1,227 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// OrgAccountOverviewReader is a Reader for the OrgAccountOverview structure.
+type OrgAccountOverviewReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *OrgAccountOverviewReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewOrgAccountOverviewOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 404:
+		result := NewOrgAccountOverviewNotFound()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 500:
+		result := NewOrgAccountOverviewInternalServerError()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	default:
+		return nil, runtime.NewAPIError("[GET /overview/{organizationToken}/{accountEmail}] orgAccountOverview", response, response.Code())
+	}
+}
+
+// NewOrgAccountOverviewOK creates a OrgAccountOverviewOK with default headers values
+func NewOrgAccountOverviewOK() *OrgAccountOverviewOK {
+	return &OrgAccountOverviewOK{}
+}
+
+/*
+OrgAccountOverviewOK describes a response with status code 200, with default header values.
+
+ok
+*/
+type OrgAccountOverviewOK struct {
+	Payload *rest_model_zrok.Overview
+}
+
+// IsSuccess returns true when this org account overview o k response has a 2xx status code
+func (o *OrgAccountOverviewOK) IsSuccess() bool {
+	return true
+}
+
+// IsRedirect returns true when this org account overview o k response has a 3xx status code
+func (o *OrgAccountOverviewOK) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this org account overview o k response has a 4xx status code
+func (o *OrgAccountOverviewOK) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this org account overview o k response has a 5xx status code
+func (o *OrgAccountOverviewOK) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this org account overview o k response a status code equal to that given
+func (o *OrgAccountOverviewOK) IsCode(code int) bool {
+	return code == 200
+}
+
+// Code gets the status code for the org account overview o k response
+func (o *OrgAccountOverviewOK) Code() int {
+	return 200
+}
+
+func (o *OrgAccountOverviewOK) Error() string {
+	return fmt.Sprintf("[GET /overview/{organizationToken}/{accountEmail}][%d] orgAccountOverviewOK  %+v", 200, o.Payload)
+}
+
+func (o *OrgAccountOverviewOK) String() string {
+	return fmt.Sprintf("[GET /overview/{organizationToken}/{accountEmail}][%d] orgAccountOverviewOK  %+v", 200, o.Payload)
+}
+
+func (o *OrgAccountOverviewOK) GetPayload() *rest_model_zrok.Overview {
+	return o.Payload
+}
+
+func (o *OrgAccountOverviewOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model_zrok.Overview)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewOrgAccountOverviewNotFound creates a OrgAccountOverviewNotFound with default headers values
+func NewOrgAccountOverviewNotFound() *OrgAccountOverviewNotFound {
+	return &OrgAccountOverviewNotFound{}
+}
+
+/*
+OrgAccountOverviewNotFound describes a response with status code 404, with default header values.
+
+not found
+*/
+type OrgAccountOverviewNotFound struct {
+}
+
+// IsSuccess returns true when this org account overview not found response has a 2xx status code
+func (o *OrgAccountOverviewNotFound) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this org account overview not found response has a 3xx status code
+func (o *OrgAccountOverviewNotFound) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this org account overview not found response has a 4xx status code
+func (o *OrgAccountOverviewNotFound) IsClientError() bool {
+	return true
+}
+
+// IsServerError returns true when this org account overview not found response has a 5xx status code
+func (o *OrgAccountOverviewNotFound) IsServerError() bool {
+	return false
+}
+
+// IsCode returns true when this org account overview not found response a status code equal to that given
+func (o *OrgAccountOverviewNotFound) IsCode(code int) bool {
+	return code == 404
+}
+
+// Code gets the status code for the org account overview not found response
+func (o *OrgAccountOverviewNotFound) Code() int {
+	return 404
+}
+
+func (o *OrgAccountOverviewNotFound) Error() string {
+	return fmt.Sprintf("[GET /overview/{organizationToken}/{accountEmail}][%d] orgAccountOverviewNotFound ", 404)
+}
+
+func (o *OrgAccountOverviewNotFound) String() string {
+	return fmt.Sprintf("[GET /overview/{organizationToken}/{accountEmail}][%d] orgAccountOverviewNotFound ", 404)
+}
+
+func (o *OrgAccountOverviewNotFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}
+
+// NewOrgAccountOverviewInternalServerError creates a OrgAccountOverviewInternalServerError with default headers values
+func NewOrgAccountOverviewInternalServerError() *OrgAccountOverviewInternalServerError {
+	return &OrgAccountOverviewInternalServerError{}
+}
+
+/*
+OrgAccountOverviewInternalServerError describes a response with status code 500, with default header values.
+
+internal server error
+*/
+type OrgAccountOverviewInternalServerError struct {
+}
+
+// IsSuccess returns true when this org account overview internal server error response has a 2xx status code
+func (o *OrgAccountOverviewInternalServerError) IsSuccess() bool {
+	return false
+}
+
+// IsRedirect returns true when this org account overview internal server error response has a 3xx status code
+func (o *OrgAccountOverviewInternalServerError) IsRedirect() bool {
+	return false
+}
+
+// IsClientError returns true when this org account overview internal server error response has a 4xx status code
+func (o *OrgAccountOverviewInternalServerError) IsClientError() bool {
+	return false
+}
+
+// IsServerError returns true when this org account overview internal server error response has a 5xx status code
+func (o *OrgAccountOverviewInternalServerError) IsServerError() bool {
+	return true
+}
+
+// IsCode returns true when this org account overview internal server error response a status code equal to that given
+func (o *OrgAccountOverviewInternalServerError) IsCode(code int) bool {
+	return code == 500
+}
+
+// Code gets the status code for the org account overview internal server error response
+func (o *OrgAccountOverviewInternalServerError) Code() int {
+	return 500
+}
+
+func (o *OrgAccountOverviewInternalServerError) Error() string {
+	return fmt.Sprintf("[GET /overview/{organizationToken}/{accountEmail}][%d] orgAccountOverviewInternalServerError ", 500)
+}
+
+func (o *OrgAccountOverviewInternalServerError) String() string {
+	return fmt.Sprintf("[GET /overview/{organizationToken}/{accountEmail}][%d] orgAccountOverviewInternalServerError ", 500)
+}
+
+func (o *OrgAccountOverviewInternalServerError) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	return nil
+}

rest_server_zrok/embedded_spec.go

@@ -711,6 +711,96 @@ func init() {
         }
       }
     },
+    "/members/{organizationToken}": {
+      "get": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "metadata"
+        ],
+        "operationId": "listOrgMembers",
+        "parameters": [
+          {
+            "type": "string",
+            "name": "organizationToken",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ok",
+            "schema": {
+              "properties": {
+                "members": {
+                  "type": "array",
+                  "items": {
+                    "properties": {
+                      "admin": {
+                        "type": "boolean"
+                      },
+                      "email": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
+    "/memberships": {
+      "get": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "metadata"
+        ],
+        "operationId": "listMemberships",
+        "responses": {
+          "200": {
+            "description": "ok",
+            "schema": {
+              "properties": {
+                "memberships": {
+                  "type": "array",
+                  "items": {
+                    "properties": {
+                      "admin": {
+                        "type": "boolean"
+                      },
+                      "description": {
+                        "type": "string"
+                      },
+                      "token": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
     "/metrics/account": {
       "get": {
         "security": [
@@ -831,6 +921,275 @@ func init() {
         }
       }
     },
+    "/organization": {
+      "post": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "createOrganization",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "description": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "organization created",
+            "schema": {
+              "properties": {
+                "token": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      },
+      "delete": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "deleteOrganization",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "token": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "organization deleted"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "404": {
+            "description": "organization not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
+    "/organization/add": {
+      "post": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "addOrganizationMember",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "admin": {
+                  "type": "boolean"
+                },
+                "email": {
+                  "type": "string"
+                },
+                "token": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "member added"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "404": {
+            "description": "not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
+    "/organization/list": {
+      "post": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "listOrganizationMembers",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "token": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "list organization members",
+            "schema": {
+              "properties": {
+                "members": {
+                  "type": "array",
+                  "items": {
+                    "properties": {
+                      "admin": {
+                        "type": "boolean"
+                      },
+                      "email": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "404": {
+            "description": "not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
+    "/organization/remove": {
+      "post": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "removeOrganizationMember",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "email": {
+                  "type": "string"
+                },
+                "token": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "member removed"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "404": {
+            "description": "not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
+    "/organizations": {
+      "get": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "listOrganizations",
+        "responses": {
+          "200": {
+            "description": "ok",
+            "schema": {
+              "properties": {
+                "organizations": {
+                  "type": "array",
+                  "items": {
+                    "properties": {
+                      "description": {
+                        "type": "string"
+                      },
+                      "token": {
+                        "type": "string"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
     "/overview": {
       "get": {
         "security": [
@@ -858,6 +1217,47 @@ func init() {
         }
       }
     },
+    "/overview/{organizationToken}/{accountEmail}": {
+      "get": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "metadata"
+        ],
+        "operationId": "orgAccountOverview",
+        "parameters": [
+          {
+            "type": "string",
+            "name": "organizationToken",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "name": "accountEmail",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ok",
+            "schema": {
+              "$ref": "#/definitions/overview"
+            }
+          },
+          "404": {
+            "description": "not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
     "/regenerateToken": {
       "post": {
         "security": [
@@ -2561,6 +2961,79 @@ func init() {
         }
       }
     },
+    "/members/{organizationToken}": {
+      "get": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "metadata"
+        ],
+        "operationId": "listOrgMembers",
+        "parameters": [
+          {
+            "type": "string",
+            "name": "organizationToken",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ok",
+            "schema": {
+              "properties": {
+                "members": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/MembersItems0"
+                  }
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
+    "/memberships": {
+      "get": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "metadata"
+        ],
+        "operationId": "listMemberships",
+        "responses": {
+          "200": {
+            "description": "ok",
+            "schema": {
+              "properties": {
+                "memberships": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/MembershipsItems0"
+                  }
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
     "/metrics/account": {
       "get": {
         "security": [
@@ -2681,6 +3154,261 @@ func init() {
         }
       }
     },
+    "/organization": {
+      "post": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "createOrganization",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "description": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "organization created",
+            "schema": {
+              "properties": {
+                "token": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      },
+      "delete": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "deleteOrganization",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "token": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "organization deleted"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "404": {
+            "description": "organization not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
+    "/organization/add": {
+      "post": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "addOrganizationMember",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "admin": {
+                  "type": "boolean"
+                },
+                "email": {
+                  "type": "string"
+                },
+                "token": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "member added"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "404": {
+            "description": "not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
+    "/organization/list": {
+      "post": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "listOrganizationMembers",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "token": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "list organization members",
+            "schema": {
+              "properties": {
+                "members": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/MembersItems0"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "404": {
+            "description": "not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
+    "/organization/remove": {
+      "post": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "removeOrganizationMember",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "properties": {
+                "email": {
+                  "type": "string"
+                },
+                "token": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "member removed"
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "404": {
+            "description": "not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
+    "/organizations": {
+      "get": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "admin"
+        ],
+        "operationId": "listOrganizations",
+        "responses": {
+          "200": {
+            "description": "ok",
+            "schema": {
+              "properties": {
+                "organizations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/OrganizationsItems0"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "unauthorized"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
     "/overview": {
       "get": {
         "security": [
@@ -2708,6 +3436,47 @@ func init() {
         }
       }
     },
+    "/overview/{organizationToken}/{accountEmail}": {
+      "get": {
+        "security": [
+          {
+            "key": []
+          }
+        ],
+        "tags": [
+          "metadata"
+        ],
+        "operationId": "orgAccountOverview",
+        "parameters": [
+          {
+            "type": "string",
+            "name": "organizationToken",
+            "in": "path",
+            "required": true
+          },
+          {
+            "type": "string",
+            "name": "accountEmail",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ok",
+            "schema": {
+              "$ref": "#/definitions/overview"
+            }
+          },
+          "404": {
+            "description": "not found"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
     "/regenerateToken": {
       "post": {
         "security": [
@@ -3064,6 +3833,39 @@ func init() {
     }
   },
   "definitions": {
+    "MembersItems0": {
+      "properties": {
+        "admin": {
+          "type": "boolean"
+        },
+        "email": {
+          "type": "string"
+        }
+      }
+    },
+    "MembershipsItems0": {
+      "properties": {
+        "admin": {
+          "type": "boolean"
+        },
+        "description": {
+          "type": "string"
+        },
+        "token": {
+          "type": "string"
+        }
+      }
+    },
+    "OrganizationsItems0": {
+      "properties": {
+        "description": {
+          "type": "string"
+        },
+        "token": {
+          "type": "string"
+        }
+      }
+    },
     "accessRequest": {
       "type": "object",
       "properties": {

rest_server_zrok/operations/admin/add_organization_member.go

@@ -0,0 +1,117 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// AddOrganizationMemberHandlerFunc turns a function with the right signature into a add organization member handler
+type AddOrganizationMemberHandlerFunc func(AddOrganizationMemberParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn AddOrganizationMemberHandlerFunc) Handle(params AddOrganizationMemberParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// AddOrganizationMemberHandler interface for that can handle valid add organization member params
+type AddOrganizationMemberHandler interface {
+	Handle(AddOrganizationMemberParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewAddOrganizationMember creates a new http.Handler for the add organization member operation
+func NewAddOrganizationMember(ctx *middleware.Context, handler AddOrganizationMemberHandler) *AddOrganizationMember {
+	return &AddOrganizationMember{Context: ctx, Handler: handler}
+}
+
+/*
+	AddOrganizationMember swagger:route POST /organization/add admin addOrganizationMember
+
+AddOrganizationMember add organization member API
+*/
+type AddOrganizationMember struct {
+	Context *middleware.Context
+	Handler AddOrganizationMemberHandler
+}
+
+func (o *AddOrganizationMember) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewAddOrganizationMemberParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
+
+// AddOrganizationMemberBody add organization member body
+//
+// swagger:model AddOrganizationMemberBody
+type AddOrganizationMemberBody struct {
+
+	// admin
+	Admin bool `json:"admin,omitempty"`
+
+	// email
+	Email string `json:"email,omitempty"`
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this add organization member body
+func (o *AddOrganizationMemberBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this add organization member body based on context it is used
+func (o *AddOrganizationMemberBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *AddOrganizationMemberBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *AddOrganizationMemberBody) UnmarshalBinary(b []byte) error {
+	var res AddOrganizationMemberBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/operations/admin/add_organization_member_parameters.go

@@ -0,0 +1,74 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/validate"
+)
+
+// NewAddOrganizationMemberParams creates a new AddOrganizationMemberParams object
+//
+// There are no default values defined in the spec.
+func NewAddOrganizationMemberParams() AddOrganizationMemberParams {
+
+	return AddOrganizationMemberParams{}
+}
+
+// AddOrganizationMemberParams contains all the bound params for the add organization member operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters addOrganizationMember
+type AddOrganizationMemberParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  In: body
+	*/
+	Body AddOrganizationMemberBody
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewAddOrganizationMemberParams() beforehand.
+func (o *AddOrganizationMemberParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if runtime.HasBody(r) {
+		defer r.Body.Close()
+		var body AddOrganizationMemberBody
+		if err := route.Consumer.Consume(r.Body, &body); err != nil {
+			res = append(res, errors.NewParseError("body", "body", "", err))
+		} else {
+			// validate body object
+			if err := body.Validate(route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			ctx := validate.WithOperationRequest(r.Context())
+			if err := body.ContextValidate(ctx, route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			if len(res) == 0 {
+				o.Body = body
+			}
+		}
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_server_zrok/operations/admin/add_organization_member_responses.go

@@ -0,0 +1,112 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+)
+
+// AddOrganizationMemberCreatedCode is the HTTP code returned for type AddOrganizationMemberCreated
+const AddOrganizationMemberCreatedCode int = 201
+
+/*
+AddOrganizationMemberCreated member added
+
+swagger:response addOrganizationMemberCreated
+*/
+type AddOrganizationMemberCreated struct {
+}
+
+// NewAddOrganizationMemberCreated creates AddOrganizationMemberCreated with default headers values
+func NewAddOrganizationMemberCreated() *AddOrganizationMemberCreated {
+
+	return &AddOrganizationMemberCreated{}
+}
+
+// WriteResponse to the client
+func (o *AddOrganizationMemberCreated) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(201)
+}
+
+// AddOrganizationMemberUnauthorizedCode is the HTTP code returned for type AddOrganizationMemberUnauthorized
+const AddOrganizationMemberUnauthorizedCode int = 401
+
+/*
+AddOrganizationMemberUnauthorized unauthorized
+
+swagger:response addOrganizationMemberUnauthorized
+*/
+type AddOrganizationMemberUnauthorized struct {
+}
+
+// NewAddOrganizationMemberUnauthorized creates AddOrganizationMemberUnauthorized with default headers values
+func NewAddOrganizationMemberUnauthorized() *AddOrganizationMemberUnauthorized {
+
+	return &AddOrganizationMemberUnauthorized{}
+}
+
+// WriteResponse to the client
+func (o *AddOrganizationMemberUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(401)
+}
+
+// AddOrganizationMemberNotFoundCode is the HTTP code returned for type AddOrganizationMemberNotFound
+const AddOrganizationMemberNotFoundCode int = 404
+
+/*
+AddOrganizationMemberNotFound not found
+
+swagger:response addOrganizationMemberNotFound
+*/
+type AddOrganizationMemberNotFound struct {
+}
+
+// NewAddOrganizationMemberNotFound creates AddOrganizationMemberNotFound with default headers values
+func NewAddOrganizationMemberNotFound() *AddOrganizationMemberNotFound {
+
+	return &AddOrganizationMemberNotFound{}
+}
+
+// WriteResponse to the client
+func (o *AddOrganizationMemberNotFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(404)
+}
+
+// AddOrganizationMemberInternalServerErrorCode is the HTTP code returned for type AddOrganizationMemberInternalServerError
+const AddOrganizationMemberInternalServerErrorCode int = 500
+
+/*
+AddOrganizationMemberInternalServerError internal server error
+
+swagger:response addOrganizationMemberInternalServerError
+*/
+type AddOrganizationMemberInternalServerError struct {
+}
+
+// NewAddOrganizationMemberInternalServerError creates AddOrganizationMemberInternalServerError with default headers values
+func NewAddOrganizationMemberInternalServerError() *AddOrganizationMemberInternalServerError {
+
+	return &AddOrganizationMemberInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *AddOrganizationMemberInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/admin/add_organization_member_urlbuilder.go

@@ -0,0 +1,87 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// AddOrganizationMemberURL generates an URL for the add organization member operation
+type AddOrganizationMemberURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *AddOrganizationMemberURL) WithBasePath(bp string) *AddOrganizationMemberURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *AddOrganizationMemberURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *AddOrganizationMemberURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/organization/add"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *AddOrganizationMemberURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *AddOrganizationMemberURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *AddOrganizationMemberURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on AddOrganizationMemberURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on AddOrganizationMemberURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *AddOrganizationMemberURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/admin/create_organization.go

@@ -0,0 +1,148 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// CreateOrganizationHandlerFunc turns a function with the right signature into a create organization handler
+type CreateOrganizationHandlerFunc func(CreateOrganizationParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn CreateOrganizationHandlerFunc) Handle(params CreateOrganizationParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// CreateOrganizationHandler interface for that can handle valid create organization params
+type CreateOrganizationHandler interface {
+	Handle(CreateOrganizationParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewCreateOrganization creates a new http.Handler for the create organization operation
+func NewCreateOrganization(ctx *middleware.Context, handler CreateOrganizationHandler) *CreateOrganization {
+	return &CreateOrganization{Context: ctx, Handler: handler}
+}
+
+/*
+	CreateOrganization swagger:route POST /organization admin createOrganization
+
+CreateOrganization create organization API
+*/
+type CreateOrganization struct {
+	Context *middleware.Context
+	Handler CreateOrganizationHandler
+}
+
+func (o *CreateOrganization) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewCreateOrganizationParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
+
+// CreateOrganizationBody create organization body
+//
+// swagger:model CreateOrganizationBody
+type CreateOrganizationBody struct {
+
+	// description
+	Description string `json:"description,omitempty"`
+}
+
+// Validate validates this create organization body
+func (o *CreateOrganizationBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this create organization body based on context it is used
+func (o *CreateOrganizationBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *CreateOrganizationBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *CreateOrganizationBody) UnmarshalBinary(b []byte) error {
+	var res CreateOrganizationBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+// CreateOrganizationCreatedBody create organization created body
+//
+// swagger:model CreateOrganizationCreatedBody
+type CreateOrganizationCreatedBody struct {
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this create organization created body
+func (o *CreateOrganizationCreatedBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this create organization created body based on context it is used
+func (o *CreateOrganizationCreatedBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *CreateOrganizationCreatedBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *CreateOrganizationCreatedBody) UnmarshalBinary(b []byte) error {
+	var res CreateOrganizationCreatedBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/operations/admin/create_organization_parameters.go

@@ -0,0 +1,74 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/validate"
+)
+
+// NewCreateOrganizationParams creates a new CreateOrganizationParams object
+//
+// There are no default values defined in the spec.
+func NewCreateOrganizationParams() CreateOrganizationParams {
+
+	return CreateOrganizationParams{}
+}
+
+// CreateOrganizationParams contains all the bound params for the create organization operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters createOrganization
+type CreateOrganizationParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  In: body
+	*/
+	Body CreateOrganizationBody
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewCreateOrganizationParams() beforehand.
+func (o *CreateOrganizationParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if runtime.HasBody(r) {
+		defer r.Body.Close()
+		var body CreateOrganizationBody
+		if err := route.Consumer.Consume(r.Body, &body); err != nil {
+			res = append(res, errors.NewParseError("body", "body", "", err))
+		} else {
+			// validate body object
+			if err := body.Validate(route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			ctx := validate.WithOperationRequest(r.Context())
+			if err := body.ContextValidate(ctx, route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			if len(res) == 0 {
+				o.Body = body
+			}
+		}
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_server_zrok/operations/admin/create_organization_responses.go

@@ -0,0 +1,107 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+)
+
+// CreateOrganizationCreatedCode is the HTTP code returned for type CreateOrganizationCreated
+const CreateOrganizationCreatedCode int = 201
+
+/*
+CreateOrganizationCreated organization created
+
+swagger:response createOrganizationCreated
+*/
+type CreateOrganizationCreated struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *CreateOrganizationCreatedBody `json:"body,omitempty"`
+}
+
+// NewCreateOrganizationCreated creates CreateOrganizationCreated with default headers values
+func NewCreateOrganizationCreated() *CreateOrganizationCreated {
+
+	return &CreateOrganizationCreated{}
+}
+
+// WithPayload adds the payload to the create organization created response
+func (o *CreateOrganizationCreated) WithPayload(payload *CreateOrganizationCreatedBody) *CreateOrganizationCreated {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the create organization created response
+func (o *CreateOrganizationCreated) SetPayload(payload *CreateOrganizationCreatedBody) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *CreateOrganizationCreated) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(201)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// CreateOrganizationUnauthorizedCode is the HTTP code returned for type CreateOrganizationUnauthorized
+const CreateOrganizationUnauthorizedCode int = 401
+
+/*
+CreateOrganizationUnauthorized unauthorized
+
+swagger:response createOrganizationUnauthorized
+*/
+type CreateOrganizationUnauthorized struct {
+}
+
+// NewCreateOrganizationUnauthorized creates CreateOrganizationUnauthorized with default headers values
+func NewCreateOrganizationUnauthorized() *CreateOrganizationUnauthorized {
+
+	return &CreateOrganizationUnauthorized{}
+}
+
+// WriteResponse to the client
+func (o *CreateOrganizationUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(401)
+}
+
+// CreateOrganizationInternalServerErrorCode is the HTTP code returned for type CreateOrganizationInternalServerError
+const CreateOrganizationInternalServerErrorCode int = 500
+
+/*
+CreateOrganizationInternalServerError internal server error
+
+swagger:response createOrganizationInternalServerError
+*/
+type CreateOrganizationInternalServerError struct {
+}
+
+// NewCreateOrganizationInternalServerError creates CreateOrganizationInternalServerError with default headers values
+func NewCreateOrganizationInternalServerError() *CreateOrganizationInternalServerError {
+
+	return &CreateOrganizationInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *CreateOrganizationInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/admin/create_organization_urlbuilder.go

@@ -0,0 +1,87 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// CreateOrganizationURL generates an URL for the create organization operation
+type CreateOrganizationURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *CreateOrganizationURL) WithBasePath(bp string) *CreateOrganizationURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *CreateOrganizationURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *CreateOrganizationURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/organization"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *CreateOrganizationURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *CreateOrganizationURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *CreateOrganizationURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on CreateOrganizationURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on CreateOrganizationURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *CreateOrganizationURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/admin/delete_organization.go

@@ -0,0 +1,111 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// DeleteOrganizationHandlerFunc turns a function with the right signature into a delete organization handler
+type DeleteOrganizationHandlerFunc func(DeleteOrganizationParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn DeleteOrganizationHandlerFunc) Handle(params DeleteOrganizationParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// DeleteOrganizationHandler interface for that can handle valid delete organization params
+type DeleteOrganizationHandler interface {
+	Handle(DeleteOrganizationParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewDeleteOrganization creates a new http.Handler for the delete organization operation
+func NewDeleteOrganization(ctx *middleware.Context, handler DeleteOrganizationHandler) *DeleteOrganization {
+	return &DeleteOrganization{Context: ctx, Handler: handler}
+}
+
+/*
+	DeleteOrganization swagger:route DELETE /organization admin deleteOrganization
+
+DeleteOrganization delete organization API
+*/
+type DeleteOrganization struct {
+	Context *middleware.Context
+	Handler DeleteOrganizationHandler
+}
+
+func (o *DeleteOrganization) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewDeleteOrganizationParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
+
+// DeleteOrganizationBody delete organization body
+//
+// swagger:model DeleteOrganizationBody
+type DeleteOrganizationBody struct {
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this delete organization body
+func (o *DeleteOrganizationBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this delete organization body based on context it is used
+func (o *DeleteOrganizationBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *DeleteOrganizationBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *DeleteOrganizationBody) UnmarshalBinary(b []byte) error {
+	var res DeleteOrganizationBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/operations/admin/delete_organization_parameters.go

@@ -0,0 +1,74 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/validate"
+)
+
+// NewDeleteOrganizationParams creates a new DeleteOrganizationParams object
+//
+// There are no default values defined in the spec.
+func NewDeleteOrganizationParams() DeleteOrganizationParams {
+
+	return DeleteOrganizationParams{}
+}
+
+// DeleteOrganizationParams contains all the bound params for the delete organization operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters deleteOrganization
+type DeleteOrganizationParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  In: body
+	*/
+	Body DeleteOrganizationBody
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewDeleteOrganizationParams() beforehand.
+func (o *DeleteOrganizationParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if runtime.HasBody(r) {
+		defer r.Body.Close()
+		var body DeleteOrganizationBody
+		if err := route.Consumer.Consume(r.Body, &body); err != nil {
+			res = append(res, errors.NewParseError("body", "body", "", err))
+		} else {
+			// validate body object
+			if err := body.Validate(route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			ctx := validate.WithOperationRequest(r.Context())
+			if err := body.ContextValidate(ctx, route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			if len(res) == 0 {
+				o.Body = body
+			}
+		}
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_server_zrok/operations/admin/delete_organization_responses.go

@@ -0,0 +1,112 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+)
+
+// DeleteOrganizationOKCode is the HTTP code returned for type DeleteOrganizationOK
+const DeleteOrganizationOKCode int = 200
+
+/*
+DeleteOrganizationOK organization deleted
+
+swagger:response deleteOrganizationOK
+*/
+type DeleteOrganizationOK struct {
+}
+
+// NewDeleteOrganizationOK creates DeleteOrganizationOK with default headers values
+func NewDeleteOrganizationOK() *DeleteOrganizationOK {
+
+	return &DeleteOrganizationOK{}
+}
+
+// WriteResponse to the client
+func (o *DeleteOrganizationOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(200)
+}
+
+// DeleteOrganizationUnauthorizedCode is the HTTP code returned for type DeleteOrganizationUnauthorized
+const DeleteOrganizationUnauthorizedCode int = 401
+
+/*
+DeleteOrganizationUnauthorized unauthorized
+
+swagger:response deleteOrganizationUnauthorized
+*/
+type DeleteOrganizationUnauthorized struct {
+}
+
+// NewDeleteOrganizationUnauthorized creates DeleteOrganizationUnauthorized with default headers values
+func NewDeleteOrganizationUnauthorized() *DeleteOrganizationUnauthorized {
+
+	return &DeleteOrganizationUnauthorized{}
+}
+
+// WriteResponse to the client
+func (o *DeleteOrganizationUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(401)
+}
+
+// DeleteOrganizationNotFoundCode is the HTTP code returned for type DeleteOrganizationNotFound
+const DeleteOrganizationNotFoundCode int = 404
+
+/*
+DeleteOrganizationNotFound organization not found
+
+swagger:response deleteOrganizationNotFound
+*/
+type DeleteOrganizationNotFound struct {
+}
+
+// NewDeleteOrganizationNotFound creates DeleteOrganizationNotFound with default headers values
+func NewDeleteOrganizationNotFound() *DeleteOrganizationNotFound {
+
+	return &DeleteOrganizationNotFound{}
+}
+
+// WriteResponse to the client
+func (o *DeleteOrganizationNotFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(404)
+}
+
+// DeleteOrganizationInternalServerErrorCode is the HTTP code returned for type DeleteOrganizationInternalServerError
+const DeleteOrganizationInternalServerErrorCode int = 500
+
+/*
+DeleteOrganizationInternalServerError internal server error
+
+swagger:response deleteOrganizationInternalServerError
+*/
+type DeleteOrganizationInternalServerError struct {
+}
+
+// NewDeleteOrganizationInternalServerError creates DeleteOrganizationInternalServerError with default headers values
+func NewDeleteOrganizationInternalServerError() *DeleteOrganizationInternalServerError {
+
+	return &DeleteOrganizationInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *DeleteOrganizationInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/admin/delete_organization_urlbuilder.go

@@ -0,0 +1,87 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// DeleteOrganizationURL generates an URL for the delete organization operation
+type DeleteOrganizationURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *DeleteOrganizationURL) WithBasePath(bp string) *DeleteOrganizationURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *DeleteOrganizationURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *DeleteOrganizationURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/organization"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *DeleteOrganizationURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *DeleteOrganizationURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *DeleteOrganizationURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on DeleteOrganizationURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on DeleteOrganizationURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *DeleteOrganizationURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/admin/list_organization_members.go

@@ -0,0 +1,259 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// ListOrganizationMembersHandlerFunc turns a function with the right signature into a list organization members handler
+type ListOrganizationMembersHandlerFunc func(ListOrganizationMembersParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn ListOrganizationMembersHandlerFunc) Handle(params ListOrganizationMembersParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// ListOrganizationMembersHandler interface for that can handle valid list organization members params
+type ListOrganizationMembersHandler interface {
+	Handle(ListOrganizationMembersParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewListOrganizationMembers creates a new http.Handler for the list organization members operation
+func NewListOrganizationMembers(ctx *middleware.Context, handler ListOrganizationMembersHandler) *ListOrganizationMembers {
+	return &ListOrganizationMembers{Context: ctx, Handler: handler}
+}
+
+/*
+	ListOrganizationMembers swagger:route POST /organization/list admin listOrganizationMembers
+
+ListOrganizationMembers list organization members API
+*/
+type ListOrganizationMembers struct {
+	Context *middleware.Context
+	Handler ListOrganizationMembersHandler
+}
+
+func (o *ListOrganizationMembers) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewListOrganizationMembersParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
+
+// ListOrganizationMembersBody list organization members body
+//
+// swagger:model ListOrganizationMembersBody
+type ListOrganizationMembersBody struct {
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this list organization members body
+func (o *ListOrganizationMembersBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list organization members body based on context it is used
+func (o *ListOrganizationMembersBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrganizationMembersBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrganizationMembersBody) UnmarshalBinary(b []byte) error {
+	var res ListOrganizationMembersBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+// ListOrganizationMembersOKBody list organization members o k body
+//
+// swagger:model ListOrganizationMembersOKBody
+type ListOrganizationMembersOKBody struct {
+
+	// members
+	Members []*ListOrganizationMembersOKBodyMembersItems0 `json:"members"`
+}
+
+// Validate validates this list organization members o k body
+func (o *ListOrganizationMembersOKBody) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.validateMembers(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrganizationMembersOKBody) validateMembers(formats strfmt.Registry) error {
+	if swag.IsZero(o.Members) { // not required
+		return nil
+	}
+
+	for i := 0; i < len(o.Members); i++ {
+		if swag.IsZero(o.Members[i]) { // not required
+			continue
+		}
+
+		if o.Members[i] != nil {
+			if err := o.Members[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrganizationMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrganizationMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// ContextValidate validate this list organization members o k body based on the context it is used
+func (o *ListOrganizationMembersOKBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.contextValidateMembers(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrganizationMembersOKBody) contextValidateMembers(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(o.Members); i++ {
+
+		if o.Members[i] != nil {
+
+			if swag.IsZero(o.Members[i]) { // not required
+				return nil
+			}
+
+			if err := o.Members[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrganizationMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrganizationMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrganizationMembersOKBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrganizationMembersOKBody) UnmarshalBinary(b []byte) error {
+	var res ListOrganizationMembersOKBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+// ListOrganizationMembersOKBodyMembersItems0 list organization members o k body members items0
+//
+// swagger:model ListOrganizationMembersOKBodyMembersItems0
+type ListOrganizationMembersOKBodyMembersItems0 struct {
+
+	// admin
+	Admin bool `json:"admin,omitempty"`
+
+	// email
+	Email string `json:"email,omitempty"`
+}
+
+// Validate validates this list organization members o k body members items0
+func (o *ListOrganizationMembersOKBodyMembersItems0) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list organization members o k body members items0 based on context it is used
+func (o *ListOrganizationMembersOKBodyMembersItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrganizationMembersOKBodyMembersItems0) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrganizationMembersOKBodyMembersItems0) UnmarshalBinary(b []byte) error {
+	var res ListOrganizationMembersOKBodyMembersItems0
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/operations/admin/list_organization_members_parameters.go

@@ -0,0 +1,74 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/validate"
+)
+
+// NewListOrganizationMembersParams creates a new ListOrganizationMembersParams object
+//
+// There are no default values defined in the spec.
+func NewListOrganizationMembersParams() ListOrganizationMembersParams {
+
+	return ListOrganizationMembersParams{}
+}
+
+// ListOrganizationMembersParams contains all the bound params for the list organization members operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters listOrganizationMembers
+type ListOrganizationMembersParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  In: body
+	*/
+	Body ListOrganizationMembersBody
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewListOrganizationMembersParams() beforehand.
+func (o *ListOrganizationMembersParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if runtime.HasBody(r) {
+		defer r.Body.Close()
+		var body ListOrganizationMembersBody
+		if err := route.Consumer.Consume(r.Body, &body); err != nil {
+			res = append(res, errors.NewParseError("body", "body", "", err))
+		} else {
+			// validate body object
+			if err := body.Validate(route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			ctx := validate.WithOperationRequest(r.Context())
+			if err := body.ContextValidate(ctx, route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			if len(res) == 0 {
+				o.Body = body
+			}
+		}
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_server_zrok/operations/admin/list_organization_members_responses.go

@@ -0,0 +1,132 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+)
+
+// ListOrganizationMembersOKCode is the HTTP code returned for type ListOrganizationMembersOK
+const ListOrganizationMembersOKCode int = 200
+
+/*
+ListOrganizationMembersOK list organization members
+
+swagger:response listOrganizationMembersOK
+*/
+type ListOrganizationMembersOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *ListOrganizationMembersOKBody `json:"body,omitempty"`
+}
+
+// NewListOrganizationMembersOK creates ListOrganizationMembersOK with default headers values
+func NewListOrganizationMembersOK() *ListOrganizationMembersOK {
+
+	return &ListOrganizationMembersOK{}
+}
+
+// WithPayload adds the payload to the list organization members o k response
+func (o *ListOrganizationMembersOK) WithPayload(payload *ListOrganizationMembersOKBody) *ListOrganizationMembersOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the list organization members o k response
+func (o *ListOrganizationMembersOK) SetPayload(payload *ListOrganizationMembersOKBody) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *ListOrganizationMembersOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// ListOrganizationMembersUnauthorizedCode is the HTTP code returned for type ListOrganizationMembersUnauthorized
+const ListOrganizationMembersUnauthorizedCode int = 401
+
+/*
+ListOrganizationMembersUnauthorized unauthorized
+
+swagger:response listOrganizationMembersUnauthorized
+*/
+type ListOrganizationMembersUnauthorized struct {
+}
+
+// NewListOrganizationMembersUnauthorized creates ListOrganizationMembersUnauthorized with default headers values
+func NewListOrganizationMembersUnauthorized() *ListOrganizationMembersUnauthorized {
+
+	return &ListOrganizationMembersUnauthorized{}
+}
+
+// WriteResponse to the client
+func (o *ListOrganizationMembersUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(401)
+}
+
+// ListOrganizationMembersNotFoundCode is the HTTP code returned for type ListOrganizationMembersNotFound
+const ListOrganizationMembersNotFoundCode int = 404
+
+/*
+ListOrganizationMembersNotFound not found
+
+swagger:response listOrganizationMembersNotFound
+*/
+type ListOrganizationMembersNotFound struct {
+}
+
+// NewListOrganizationMembersNotFound creates ListOrganizationMembersNotFound with default headers values
+func NewListOrganizationMembersNotFound() *ListOrganizationMembersNotFound {
+
+	return &ListOrganizationMembersNotFound{}
+}
+
+// WriteResponse to the client
+func (o *ListOrganizationMembersNotFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(404)
+}
+
+// ListOrganizationMembersInternalServerErrorCode is the HTTP code returned for type ListOrganizationMembersInternalServerError
+const ListOrganizationMembersInternalServerErrorCode int = 500
+
+/*
+ListOrganizationMembersInternalServerError internal server error
+
+swagger:response listOrganizationMembersInternalServerError
+*/
+type ListOrganizationMembersInternalServerError struct {
+}
+
+// NewListOrganizationMembersInternalServerError creates ListOrganizationMembersInternalServerError with default headers values
+func NewListOrganizationMembersInternalServerError() *ListOrganizationMembersInternalServerError {
+
+	return &ListOrganizationMembersInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *ListOrganizationMembersInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/admin/list_organization_members_urlbuilder.go

@@ -0,0 +1,87 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// ListOrganizationMembersURL generates an URL for the list organization members operation
+type ListOrganizationMembersURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListOrganizationMembersURL) WithBasePath(bp string) *ListOrganizationMembersURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListOrganizationMembersURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *ListOrganizationMembersURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/organization/list"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *ListOrganizationMembersURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *ListOrganizationMembersURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *ListOrganizationMembersURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on ListOrganizationMembersURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on ListOrganizationMembersURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *ListOrganizationMembersURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/admin/list_organizations.go

@@ -0,0 +1,222 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// ListOrganizationsHandlerFunc turns a function with the right signature into a list organizations handler
+type ListOrganizationsHandlerFunc func(ListOrganizationsParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn ListOrganizationsHandlerFunc) Handle(params ListOrganizationsParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// ListOrganizationsHandler interface for that can handle valid list organizations params
+type ListOrganizationsHandler interface {
+	Handle(ListOrganizationsParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewListOrganizations creates a new http.Handler for the list organizations operation
+func NewListOrganizations(ctx *middleware.Context, handler ListOrganizationsHandler) *ListOrganizations {
+	return &ListOrganizations{Context: ctx, Handler: handler}
+}
+
+/*
+	ListOrganizations swagger:route GET /organizations admin listOrganizations
+
+ListOrganizations list organizations API
+*/
+type ListOrganizations struct {
+	Context *middleware.Context
+	Handler ListOrganizationsHandler
+}
+
+func (o *ListOrganizations) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewListOrganizationsParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
+
+// ListOrganizationsOKBody list organizations o k body
+//
+// swagger:model ListOrganizationsOKBody
+type ListOrganizationsOKBody struct {
+
+	// organizations
+	Organizations []*ListOrganizationsOKBodyOrganizationsItems0 `json:"organizations"`
+}
+
+// Validate validates this list organizations o k body
+func (o *ListOrganizationsOKBody) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.validateOrganizations(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrganizationsOKBody) validateOrganizations(formats strfmt.Registry) error {
+	if swag.IsZero(o.Organizations) { // not required
+		return nil
+	}
+
+	for i := 0; i < len(o.Organizations); i++ {
+		if swag.IsZero(o.Organizations[i]) { // not required
+			continue
+		}
+
+		if o.Organizations[i] != nil {
+			if err := o.Organizations[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrganizationsOK" + "." + "organizations" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrganizationsOK" + "." + "organizations" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// ContextValidate validate this list organizations o k body based on the context it is used
+func (o *ListOrganizationsOKBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.contextValidateOrganizations(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrganizationsOKBody) contextValidateOrganizations(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(o.Organizations); i++ {
+
+		if o.Organizations[i] != nil {
+
+			if swag.IsZero(o.Organizations[i]) { // not required
+				return nil
+			}
+
+			if err := o.Organizations[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrganizationsOK" + "." + "organizations" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrganizationsOK" + "." + "organizations" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrganizationsOKBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrganizationsOKBody) UnmarshalBinary(b []byte) error {
+	var res ListOrganizationsOKBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+// ListOrganizationsOKBodyOrganizationsItems0 list organizations o k body organizations items0
+//
+// swagger:model ListOrganizationsOKBodyOrganizationsItems0
+type ListOrganizationsOKBodyOrganizationsItems0 struct {
+
+	// description
+	Description string `json:"description,omitempty"`
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this list organizations o k body organizations items0
+func (o *ListOrganizationsOKBodyOrganizationsItems0) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list organizations o k body organizations items0 based on context it is used
+func (o *ListOrganizationsOKBodyOrganizationsItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrganizationsOKBodyOrganizationsItems0) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrganizationsOKBodyOrganizationsItems0) UnmarshalBinary(b []byte) error {
+	var res ListOrganizationsOKBodyOrganizationsItems0
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/operations/admin/list_organizations_parameters.go

@@ -0,0 +1,46 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// NewListOrganizationsParams creates a new ListOrganizationsParams object
+//
+// There are no default values defined in the spec.
+func NewListOrganizationsParams() ListOrganizationsParams {
+
+	return ListOrganizationsParams{}
+}
+
+// ListOrganizationsParams contains all the bound params for the list organizations operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters listOrganizations
+type ListOrganizationsParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewListOrganizationsParams() beforehand.
+func (o *ListOrganizationsParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_server_zrok/operations/admin/list_organizations_responses.go

@@ -0,0 +1,107 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+)
+
+// ListOrganizationsOKCode is the HTTP code returned for type ListOrganizationsOK
+const ListOrganizationsOKCode int = 200
+
+/*
+ListOrganizationsOK ok
+
+swagger:response listOrganizationsOK
+*/
+type ListOrganizationsOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *ListOrganizationsOKBody `json:"body,omitempty"`
+}
+
+// NewListOrganizationsOK creates ListOrganizationsOK with default headers values
+func NewListOrganizationsOK() *ListOrganizationsOK {
+
+	return &ListOrganizationsOK{}
+}
+
+// WithPayload adds the payload to the list organizations o k response
+func (o *ListOrganizationsOK) WithPayload(payload *ListOrganizationsOKBody) *ListOrganizationsOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the list organizations o k response
+func (o *ListOrganizationsOK) SetPayload(payload *ListOrganizationsOKBody) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *ListOrganizationsOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// ListOrganizationsUnauthorizedCode is the HTTP code returned for type ListOrganizationsUnauthorized
+const ListOrganizationsUnauthorizedCode int = 401
+
+/*
+ListOrganizationsUnauthorized unauthorized
+
+swagger:response listOrganizationsUnauthorized
+*/
+type ListOrganizationsUnauthorized struct {
+}
+
+// NewListOrganizationsUnauthorized creates ListOrganizationsUnauthorized with default headers values
+func NewListOrganizationsUnauthorized() *ListOrganizationsUnauthorized {
+
+	return &ListOrganizationsUnauthorized{}
+}
+
+// WriteResponse to the client
+func (o *ListOrganizationsUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(401)
+}
+
+// ListOrganizationsInternalServerErrorCode is the HTTP code returned for type ListOrganizationsInternalServerError
+const ListOrganizationsInternalServerErrorCode int = 500
+
+/*
+ListOrganizationsInternalServerError internal server error
+
+swagger:response listOrganizationsInternalServerError
+*/
+type ListOrganizationsInternalServerError struct {
+}
+
+// NewListOrganizationsInternalServerError creates ListOrganizationsInternalServerError with default headers values
+func NewListOrganizationsInternalServerError() *ListOrganizationsInternalServerError {
+
+	return &ListOrganizationsInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *ListOrganizationsInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/admin/list_organizations_urlbuilder.go

@@ -0,0 +1,87 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// ListOrganizationsURL generates an URL for the list organizations operation
+type ListOrganizationsURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListOrganizationsURL) WithBasePath(bp string) *ListOrganizationsURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListOrganizationsURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *ListOrganizationsURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/organizations"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *ListOrganizationsURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *ListOrganizationsURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *ListOrganizationsURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on ListOrganizationsURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on ListOrganizationsURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *ListOrganizationsURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/admin/remove_organization_member.go

@@ -0,0 +1,114 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// RemoveOrganizationMemberHandlerFunc turns a function with the right signature into a remove organization member handler
+type RemoveOrganizationMemberHandlerFunc func(RemoveOrganizationMemberParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn RemoveOrganizationMemberHandlerFunc) Handle(params RemoveOrganizationMemberParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// RemoveOrganizationMemberHandler interface for that can handle valid remove organization member params
+type RemoveOrganizationMemberHandler interface {
+	Handle(RemoveOrganizationMemberParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewRemoveOrganizationMember creates a new http.Handler for the remove organization member operation
+func NewRemoveOrganizationMember(ctx *middleware.Context, handler RemoveOrganizationMemberHandler) *RemoveOrganizationMember {
+	return &RemoveOrganizationMember{Context: ctx, Handler: handler}
+}
+
+/*
+	RemoveOrganizationMember swagger:route POST /organization/remove admin removeOrganizationMember
+
+RemoveOrganizationMember remove organization member API
+*/
+type RemoveOrganizationMember struct {
+	Context *middleware.Context
+	Handler RemoveOrganizationMemberHandler
+}
+
+func (o *RemoveOrganizationMember) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewRemoveOrganizationMemberParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
+
+// RemoveOrganizationMemberBody remove organization member body
+//
+// swagger:model RemoveOrganizationMemberBody
+type RemoveOrganizationMemberBody struct {
+
+	// email
+	Email string `json:"email,omitempty"`
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this remove organization member body
+func (o *RemoveOrganizationMemberBody) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this remove organization member body based on context it is used
+func (o *RemoveOrganizationMemberBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *RemoveOrganizationMemberBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *RemoveOrganizationMemberBody) UnmarshalBinary(b []byte) error {
+	var res RemoveOrganizationMemberBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/operations/admin/remove_organization_member_parameters.go

@@ -0,0 +1,74 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/validate"
+)
+
+// NewRemoveOrganizationMemberParams creates a new RemoveOrganizationMemberParams object
+//
+// There are no default values defined in the spec.
+func NewRemoveOrganizationMemberParams() RemoveOrganizationMemberParams {
+
+	return RemoveOrganizationMemberParams{}
+}
+
+// RemoveOrganizationMemberParams contains all the bound params for the remove organization member operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters removeOrganizationMember
+type RemoveOrganizationMemberParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  In: body
+	*/
+	Body RemoveOrganizationMemberBody
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewRemoveOrganizationMemberParams() beforehand.
+func (o *RemoveOrganizationMemberParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if runtime.HasBody(r) {
+		defer r.Body.Close()
+		var body RemoveOrganizationMemberBody
+		if err := route.Consumer.Consume(r.Body, &body); err != nil {
+			res = append(res, errors.NewParseError("body", "body", "", err))
+		} else {
+			// validate body object
+			if err := body.Validate(route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			ctx := validate.WithOperationRequest(r.Context())
+			if err := body.ContextValidate(ctx, route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			if len(res) == 0 {
+				o.Body = body
+			}
+		}
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_server_zrok/operations/admin/remove_organization_member_responses.go

@@ -0,0 +1,112 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+)
+
+// RemoveOrganizationMemberOKCode is the HTTP code returned for type RemoveOrganizationMemberOK
+const RemoveOrganizationMemberOKCode int = 200
+
+/*
+RemoveOrganizationMemberOK member removed
+
+swagger:response removeOrganizationMemberOK
+*/
+type RemoveOrganizationMemberOK struct {
+}
+
+// NewRemoveOrganizationMemberOK creates RemoveOrganizationMemberOK with default headers values
+func NewRemoveOrganizationMemberOK() *RemoveOrganizationMemberOK {
+
+	return &RemoveOrganizationMemberOK{}
+}
+
+// WriteResponse to the client
+func (o *RemoveOrganizationMemberOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(200)
+}
+
+// RemoveOrganizationMemberUnauthorizedCode is the HTTP code returned for type RemoveOrganizationMemberUnauthorized
+const RemoveOrganizationMemberUnauthorizedCode int = 401
+
+/*
+RemoveOrganizationMemberUnauthorized unauthorized
+
+swagger:response removeOrganizationMemberUnauthorized
+*/
+type RemoveOrganizationMemberUnauthorized struct {
+}
+
+// NewRemoveOrganizationMemberUnauthorized creates RemoveOrganizationMemberUnauthorized with default headers values
+func NewRemoveOrganizationMemberUnauthorized() *RemoveOrganizationMemberUnauthorized {
+
+	return &RemoveOrganizationMemberUnauthorized{}
+}
+
+// WriteResponse to the client
+func (o *RemoveOrganizationMemberUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(401)
+}
+
+// RemoveOrganizationMemberNotFoundCode is the HTTP code returned for type RemoveOrganizationMemberNotFound
+const RemoveOrganizationMemberNotFoundCode int = 404
+
+/*
+RemoveOrganizationMemberNotFound not found
+
+swagger:response removeOrganizationMemberNotFound
+*/
+type RemoveOrganizationMemberNotFound struct {
+}
+
+// NewRemoveOrganizationMemberNotFound creates RemoveOrganizationMemberNotFound with default headers values
+func NewRemoveOrganizationMemberNotFound() *RemoveOrganizationMemberNotFound {
+
+	return &RemoveOrganizationMemberNotFound{}
+}
+
+// WriteResponse to the client
+func (o *RemoveOrganizationMemberNotFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(404)
+}
+
+// RemoveOrganizationMemberInternalServerErrorCode is the HTTP code returned for type RemoveOrganizationMemberInternalServerError
+const RemoveOrganizationMemberInternalServerErrorCode int = 500
+
+/*
+RemoveOrganizationMemberInternalServerError internal server error
+
+swagger:response removeOrganizationMemberInternalServerError
+*/
+type RemoveOrganizationMemberInternalServerError struct {
+}
+
+// NewRemoveOrganizationMemberInternalServerError creates RemoveOrganizationMemberInternalServerError with default headers values
+func NewRemoveOrganizationMemberInternalServerError() *RemoveOrganizationMemberInternalServerError {
+
+	return &RemoveOrganizationMemberInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *RemoveOrganizationMemberInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/admin/remove_organization_member_urlbuilder.go

@@ -0,0 +1,87 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package admin
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// RemoveOrganizationMemberURL generates an URL for the remove organization member operation
+type RemoveOrganizationMemberURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *RemoveOrganizationMemberURL) WithBasePath(bp string) *RemoveOrganizationMemberURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *RemoveOrganizationMemberURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *RemoveOrganizationMemberURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/organization/remove"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *RemoveOrganizationMemberURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *RemoveOrganizationMemberURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *RemoveOrganizationMemberURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on RemoveOrganizationMemberURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on RemoveOrganizationMemberURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *RemoveOrganizationMemberURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/metadata/list_members.go

@@ -0,0 +1,222 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// ListMembersHandlerFunc turns a function with the right signature into a list members handler
+type ListMembersHandlerFunc func(ListMembersParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn ListMembersHandlerFunc) Handle(params ListMembersParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// ListMembersHandler interface for that can handle valid list members params
+type ListMembersHandler interface {
+	Handle(ListMembersParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewListMembers creates a new http.Handler for the list members operation
+func NewListMembers(ctx *middleware.Context, handler ListMembersHandler) *ListMembers {
+	return &ListMembers{Context: ctx, Handler: handler}
+}
+
+/*
+	ListMembers swagger:route GET /members/{organizationToken} metadata listMembers
+
+ListMembers list members API
+*/
+type ListMembers struct {
+	Context *middleware.Context
+	Handler ListMembersHandler
+}
+
+func (o *ListMembers) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewListMembersParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
+
+// ListMembersOKBody list members o k body
+//
+// swagger:model ListMembersOKBody
+type ListMembersOKBody struct {
+
+	// members
+	Members []*ListMembersOKBodyMembersItems0 `json:"members"`
+}
+
+// Validate validates this list members o k body
+func (o *ListMembersOKBody) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.validateMembers(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListMembersOKBody) validateMembers(formats strfmt.Registry) error {
+	if swag.IsZero(o.Members) { // not required
+		return nil
+	}
+
+	for i := 0; i < len(o.Members); i++ {
+		if swag.IsZero(o.Members[i]) { // not required
+			continue
+		}
+
+		if o.Members[i] != nil {
+			if err := o.Members[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// ContextValidate validate this list members o k body based on the context it is used
+func (o *ListMembersOKBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.contextValidateMembers(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListMembersOKBody) contextValidateMembers(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(o.Members); i++ {
+
+		if o.Members[i] != nil {
+
+			if swag.IsZero(o.Members[i]) { // not required
+				return nil
+			}
+
+			if err := o.Members[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListMembersOKBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListMembersOKBody) UnmarshalBinary(b []byte) error {
+	var res ListMembersOKBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+// ListMembersOKBodyMembersItems0 list members o k body members items0
+//
+// swagger:model ListMembersOKBodyMembersItems0
+type ListMembersOKBodyMembersItems0 struct {
+
+	// admin
+	Admin bool `json:"admin,omitempty"`
+
+	// email
+	Email string `json:"email,omitempty"`
+}
+
+// Validate validates this list members o k body members items0
+func (o *ListMembersOKBodyMembersItems0) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list members o k body members items0 based on context it is used
+func (o *ListMembersOKBodyMembersItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListMembersOKBodyMembersItems0) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListMembersOKBodyMembersItems0) UnmarshalBinary(b []byte) error {
+	var res ListMembersOKBodyMembersItems0
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/operations/metadata/list_members_parameters.go

@@ -0,0 +1,71 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewListMembersParams creates a new ListMembersParams object
+//
+// There are no default values defined in the spec.
+func NewListMembersParams() ListMembersParams {
+
+	return ListMembersParams{}
+}
+
+// ListMembersParams contains all the bound params for the list members operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters listMembers
+type ListMembersParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  Required: true
+	  In: path
+	*/
+	OrganizationToken string
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewListMembersParams() beforehand.
+func (o *ListMembersParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	rOrganizationToken, rhkOrganizationToken, _ := route.Params.GetOK("organizationToken")
+	if err := o.bindOrganizationToken(rOrganizationToken, rhkOrganizationToken, route.Formats); err != nil {
+		res = append(res, err)
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// bindOrganizationToken binds and validates parameter OrganizationToken from path.
+func (o *ListMembersParams) bindOrganizationToken(rawData []string, hasKey bool, formats strfmt.Registry) error {
+	var raw string
+	if len(rawData) > 0 {
+		raw = rawData[len(rawData)-1]
+	}
+
+	// Required: true
+	// Parameter is provided by construction from the route
+	o.OrganizationToken = raw
+
+	return nil
+}

rest_server_zrok/operations/metadata/list_members_responses.go

@@ -0,0 +1,107 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+)
+
+// ListMembersOKCode is the HTTP code returned for type ListMembersOK
+const ListMembersOKCode int = 200
+
+/*
+ListMembersOK ok
+
+swagger:response listMembersOK
+*/
+type ListMembersOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *ListMembersOKBody `json:"body,omitempty"`
+}
+
+// NewListMembersOK creates ListMembersOK with default headers values
+func NewListMembersOK() *ListMembersOK {
+
+	return &ListMembersOK{}
+}
+
+// WithPayload adds the payload to the list members o k response
+func (o *ListMembersOK) WithPayload(payload *ListMembersOKBody) *ListMembersOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the list members o k response
+func (o *ListMembersOK) SetPayload(payload *ListMembersOKBody) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *ListMembersOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// ListMembersNotFoundCode is the HTTP code returned for type ListMembersNotFound
+const ListMembersNotFoundCode int = 404
+
+/*
+ListMembersNotFound not found
+
+swagger:response listMembersNotFound
+*/
+type ListMembersNotFound struct {
+}
+
+// NewListMembersNotFound creates ListMembersNotFound with default headers values
+func NewListMembersNotFound() *ListMembersNotFound {
+
+	return &ListMembersNotFound{}
+}
+
+// WriteResponse to the client
+func (o *ListMembersNotFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(404)
+}
+
+// ListMembersInternalServerErrorCode is the HTTP code returned for type ListMembersInternalServerError
+const ListMembersInternalServerErrorCode int = 500
+
+/*
+ListMembersInternalServerError internal server error
+
+swagger:response listMembersInternalServerError
+*/
+type ListMembersInternalServerError struct {
+}
+
+// NewListMembersInternalServerError creates ListMembersInternalServerError with default headers values
+func NewListMembersInternalServerError() *ListMembersInternalServerError {
+
+	return &ListMembersInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *ListMembersInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/metadata/list_members_urlbuilder.go

@@ -0,0 +1,99 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+	"strings"
+)
+
+// ListMembersURL generates an URL for the list members operation
+type ListMembersURL struct {
+	OrganizationToken string
+
+	_basePath string
+	// avoid unkeyed usage
+	_ struct{}
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListMembersURL) WithBasePath(bp string) *ListMembersURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListMembersURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *ListMembersURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/members/{organizationToken}"
+
+	organizationToken := o.OrganizationToken
+	if organizationToken != "" {
+		_path = strings.Replace(_path, "{organizationToken}", organizationToken, -1)
+	} else {
+		return nil, errors.New("organizationToken is required on ListMembersURL")
+	}
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *ListMembersURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *ListMembersURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *ListMembersURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on ListMembersURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on ListMembersURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *ListMembersURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/metadata/list_memberships.go

@@ -0,0 +1,225 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// ListMembershipsHandlerFunc turns a function with the right signature into a list memberships handler
+type ListMembershipsHandlerFunc func(ListMembershipsParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn ListMembershipsHandlerFunc) Handle(params ListMembershipsParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// ListMembershipsHandler interface for that can handle valid list memberships params
+type ListMembershipsHandler interface {
+	Handle(ListMembershipsParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewListMemberships creates a new http.Handler for the list memberships operation
+func NewListMemberships(ctx *middleware.Context, handler ListMembershipsHandler) *ListMemberships {
+	return &ListMemberships{Context: ctx, Handler: handler}
+}
+
+/*
+	ListMemberships swagger:route GET /memberships metadata listMemberships
+
+ListMemberships list memberships API
+*/
+type ListMemberships struct {
+	Context *middleware.Context
+	Handler ListMembershipsHandler
+}
+
+func (o *ListMemberships) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewListMembershipsParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
+
+// ListMembershipsOKBody list memberships o k body
+//
+// swagger:model ListMembershipsOKBody
+type ListMembershipsOKBody struct {
+
+	// memberships
+	Memberships []*ListMembershipsOKBodyMembershipsItems0 `json:"memberships"`
+}
+
+// Validate validates this list memberships o k body
+func (o *ListMembershipsOKBody) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.validateMemberships(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListMembershipsOKBody) validateMemberships(formats strfmt.Registry) error {
+	if swag.IsZero(o.Memberships) { // not required
+		return nil
+	}
+
+	for i := 0; i < len(o.Memberships); i++ {
+		if swag.IsZero(o.Memberships[i]) { // not required
+			continue
+		}
+
+		if o.Memberships[i] != nil {
+			if err := o.Memberships[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listMembershipsOK" + "." + "memberships" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listMembershipsOK" + "." + "memberships" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// ContextValidate validate this list memberships o k body based on the context it is used
+func (o *ListMembershipsOKBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.contextValidateMemberships(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListMembershipsOKBody) contextValidateMemberships(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(o.Memberships); i++ {
+
+		if o.Memberships[i] != nil {
+
+			if swag.IsZero(o.Memberships[i]) { // not required
+				return nil
+			}
+
+			if err := o.Memberships[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listMembershipsOK" + "." + "memberships" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listMembershipsOK" + "." + "memberships" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListMembershipsOKBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListMembershipsOKBody) UnmarshalBinary(b []byte) error {
+	var res ListMembershipsOKBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+// ListMembershipsOKBodyMembershipsItems0 list memberships o k body memberships items0
+//
+// swagger:model ListMembershipsOKBodyMembershipsItems0
+type ListMembershipsOKBodyMembershipsItems0 struct {
+
+	// admin
+	Admin bool `json:"admin,omitempty"`
+
+	// description
+	Description string `json:"description,omitempty"`
+
+	// token
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates this list memberships o k body memberships items0
+func (o *ListMembershipsOKBodyMembershipsItems0) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list memberships o k body memberships items0 based on context it is used
+func (o *ListMembershipsOKBodyMembershipsItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListMembershipsOKBodyMembershipsItems0) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListMembershipsOKBodyMembershipsItems0) UnmarshalBinary(b []byte) error {
+	var res ListMembershipsOKBodyMembershipsItems0
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/operations/metadata/list_memberships_parameters.go

@@ -0,0 +1,46 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// NewListMembershipsParams creates a new ListMembershipsParams object
+//
+// There are no default values defined in the spec.
+func NewListMembershipsParams() ListMembershipsParams {
+
+	return ListMembershipsParams{}
+}
+
+// ListMembershipsParams contains all the bound params for the list memberships operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters listMemberships
+type ListMembershipsParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewListMembershipsParams() beforehand.
+func (o *ListMembershipsParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_server_zrok/operations/metadata/list_memberships_responses.go

@@ -0,0 +1,82 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+)
+
+// ListMembershipsOKCode is the HTTP code returned for type ListMembershipsOK
+const ListMembershipsOKCode int = 200
+
+/*
+ListMembershipsOK ok
+
+swagger:response listMembershipsOK
+*/
+type ListMembershipsOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *ListMembershipsOKBody `json:"body,omitempty"`
+}
+
+// NewListMembershipsOK creates ListMembershipsOK with default headers values
+func NewListMembershipsOK() *ListMembershipsOK {
+
+	return &ListMembershipsOK{}
+}
+
+// WithPayload adds the payload to the list memberships o k response
+func (o *ListMembershipsOK) WithPayload(payload *ListMembershipsOKBody) *ListMembershipsOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the list memberships o k response
+func (o *ListMembershipsOK) SetPayload(payload *ListMembershipsOKBody) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *ListMembershipsOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// ListMembershipsInternalServerErrorCode is the HTTP code returned for type ListMembershipsInternalServerError
+const ListMembershipsInternalServerErrorCode int = 500
+
+/*
+ListMembershipsInternalServerError internal server error
+
+swagger:response listMembershipsInternalServerError
+*/
+type ListMembershipsInternalServerError struct {
+}
+
+// NewListMembershipsInternalServerError creates ListMembershipsInternalServerError with default headers values
+func NewListMembershipsInternalServerError() *ListMembershipsInternalServerError {
+
+	return &ListMembershipsInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *ListMembershipsInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/metadata/list_memberships_urlbuilder.go

@@ -0,0 +1,87 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// ListMembershipsURL generates an URL for the list memberships operation
+type ListMembershipsURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListMembershipsURL) WithBasePath(bp string) *ListMembershipsURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListMembershipsURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *ListMembershipsURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/memberships"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *ListMembershipsURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *ListMembershipsURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *ListMembershipsURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on ListMembershipsURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on ListMembershipsURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *ListMembershipsURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/metadata/list_org_members.go

@@ -0,0 +1,222 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// ListOrgMembersHandlerFunc turns a function with the right signature into a list org members handler
+type ListOrgMembersHandlerFunc func(ListOrgMembersParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn ListOrgMembersHandlerFunc) Handle(params ListOrgMembersParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// ListOrgMembersHandler interface for that can handle valid list org members params
+type ListOrgMembersHandler interface {
+	Handle(ListOrgMembersParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewListOrgMembers creates a new http.Handler for the list org members operation
+func NewListOrgMembers(ctx *middleware.Context, handler ListOrgMembersHandler) *ListOrgMembers {
+	return &ListOrgMembers{Context: ctx, Handler: handler}
+}
+
+/*
+	ListOrgMembers swagger:route GET /members/{organizationToken} metadata listOrgMembers
+
+ListOrgMembers list org members API
+*/
+type ListOrgMembers struct {
+	Context *middleware.Context
+	Handler ListOrgMembersHandler
+}
+
+func (o *ListOrgMembers) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewListOrgMembersParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}
+
+// ListOrgMembersOKBody list org members o k body
+//
+// swagger:model ListOrgMembersOKBody
+type ListOrgMembersOKBody struct {
+
+	// members
+	Members []*ListOrgMembersOKBodyMembersItems0 `json:"members"`
+}
+
+// Validate validates this list org members o k body
+func (o *ListOrgMembersOKBody) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.validateMembers(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrgMembersOKBody) validateMembers(formats strfmt.Registry) error {
+	if swag.IsZero(o.Members) { // not required
+		return nil
+	}
+
+	for i := 0; i < len(o.Members); i++ {
+		if swag.IsZero(o.Members[i]) { // not required
+			continue
+		}
+
+		if o.Members[i] != nil {
+			if err := o.Members[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrgMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrgMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// ContextValidate validate this list org members o k body based on the context it is used
+func (o *ListOrgMembersOKBody) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	var res []error
+
+	if err := o.contextValidateMembers(ctx, formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (o *ListOrgMembersOKBody) contextValidateMembers(ctx context.Context, formats strfmt.Registry) error {
+
+	for i := 0; i < len(o.Members); i++ {
+
+		if o.Members[i] != nil {
+
+			if swag.IsZero(o.Members[i]) { // not required
+				return nil
+			}
+
+			if err := o.Members[i].ContextValidate(ctx, formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName("listOrgMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				} else if ce, ok := err.(*errors.CompositeError); ok {
+					return ce.ValidateName("listOrgMembersOK" + "." + "members" + "." + strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrgMembersOKBody) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrgMembersOKBody) UnmarshalBinary(b []byte) error {
+	var res ListOrgMembersOKBody
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}
+
+// ListOrgMembersOKBodyMembersItems0 list org members o k body members items0
+//
+// swagger:model ListOrgMembersOKBodyMembersItems0
+type ListOrgMembersOKBodyMembersItems0 struct {
+
+	// admin
+	Admin bool `json:"admin,omitempty"`
+
+	// email
+	Email string `json:"email,omitempty"`
+}
+
+// Validate validates this list org members o k body members items0
+func (o *ListOrgMembersOKBodyMembersItems0) Validate(formats strfmt.Registry) error {
+	return nil
+}
+
+// ContextValidate validates this list org members o k body members items0 based on context it is used
+func (o *ListOrgMembersOKBodyMembersItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (o *ListOrgMembersOKBodyMembersItems0) MarshalBinary() ([]byte, error) {
+	if o == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(o)
+}
+
+// UnmarshalBinary interface implementation
+func (o *ListOrgMembersOKBodyMembersItems0) UnmarshalBinary(b []byte) error {
+	var res ListOrgMembersOKBodyMembersItems0
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*o = res
+	return nil
+}

rest_server_zrok/operations/metadata/list_org_members_parameters.go

@@ -0,0 +1,71 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewListOrgMembersParams creates a new ListOrgMembersParams object
+//
+// There are no default values defined in the spec.
+func NewListOrgMembersParams() ListOrgMembersParams {
+
+	return ListOrgMembersParams{}
+}
+
+// ListOrgMembersParams contains all the bound params for the list org members operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters listOrgMembers
+type ListOrgMembersParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  Required: true
+	  In: path
+	*/
+	OrganizationToken string
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewListOrgMembersParams() beforehand.
+func (o *ListOrgMembersParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	rOrganizationToken, rhkOrganizationToken, _ := route.Params.GetOK("organizationToken")
+	if err := o.bindOrganizationToken(rOrganizationToken, rhkOrganizationToken, route.Formats); err != nil {
+		res = append(res, err)
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// bindOrganizationToken binds and validates parameter OrganizationToken from path.
+func (o *ListOrgMembersParams) bindOrganizationToken(rawData []string, hasKey bool, formats strfmt.Registry) error {
+	var raw string
+	if len(rawData) > 0 {
+		raw = rawData[len(rawData)-1]
+	}
+
+	// Required: true
+	// Parameter is provided by construction from the route
+	o.OrganizationToken = raw
+
+	return nil
+}

rest_server_zrok/operations/metadata/list_org_members_responses.go

@@ -0,0 +1,107 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+)
+
+// ListOrgMembersOKCode is the HTTP code returned for type ListOrgMembersOK
+const ListOrgMembersOKCode int = 200
+
+/*
+ListOrgMembersOK ok
+
+swagger:response listOrgMembersOK
+*/
+type ListOrgMembersOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *ListOrgMembersOKBody `json:"body,omitempty"`
+}
+
+// NewListOrgMembersOK creates ListOrgMembersOK with default headers values
+func NewListOrgMembersOK() *ListOrgMembersOK {
+
+	return &ListOrgMembersOK{}
+}
+
+// WithPayload adds the payload to the list org members o k response
+func (o *ListOrgMembersOK) WithPayload(payload *ListOrgMembersOKBody) *ListOrgMembersOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the list org members o k response
+func (o *ListOrgMembersOK) SetPayload(payload *ListOrgMembersOKBody) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *ListOrgMembersOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// ListOrgMembersNotFoundCode is the HTTP code returned for type ListOrgMembersNotFound
+const ListOrgMembersNotFoundCode int = 404
+
+/*
+ListOrgMembersNotFound not found
+
+swagger:response listOrgMembersNotFound
+*/
+type ListOrgMembersNotFound struct {
+}
+
+// NewListOrgMembersNotFound creates ListOrgMembersNotFound with default headers values
+func NewListOrgMembersNotFound() *ListOrgMembersNotFound {
+
+	return &ListOrgMembersNotFound{}
+}
+
+// WriteResponse to the client
+func (o *ListOrgMembersNotFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(404)
+}
+
+// ListOrgMembersInternalServerErrorCode is the HTTP code returned for type ListOrgMembersInternalServerError
+const ListOrgMembersInternalServerErrorCode int = 500
+
+/*
+ListOrgMembersInternalServerError internal server error
+
+swagger:response listOrgMembersInternalServerError
+*/
+type ListOrgMembersInternalServerError struct {
+}
+
+// NewListOrgMembersInternalServerError creates ListOrgMembersInternalServerError with default headers values
+func NewListOrgMembersInternalServerError() *ListOrgMembersInternalServerError {
+
+	return &ListOrgMembersInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *ListOrgMembersInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/metadata/list_org_members_urlbuilder.go

@@ -0,0 +1,99 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+	"strings"
+)
+
+// ListOrgMembersURL generates an URL for the list org members operation
+type ListOrgMembersURL struct {
+	OrganizationToken string
+
+	_basePath string
+	// avoid unkeyed usage
+	_ struct{}
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListOrgMembersURL) WithBasePath(bp string) *ListOrgMembersURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListOrgMembersURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *ListOrgMembersURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/members/{organizationToken}"
+
+	organizationToken := o.OrganizationToken
+	if organizationToken != "" {
+		_path = strings.Replace(_path, "{organizationToken}", organizationToken, -1)
+	} else {
+		return nil, errors.New("organizationToken is required on ListOrgMembersURL")
+	}
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *ListOrgMembersURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *ListOrgMembersURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *ListOrgMembersURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on ListOrgMembersURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on ListOrgMembersURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *ListOrgMembersURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/metadata/org_account_overview.go

@@ -0,0 +1,71 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// OrgAccountOverviewHandlerFunc turns a function with the right signature into a org account overview handler
+type OrgAccountOverviewHandlerFunc func(OrgAccountOverviewParams, *rest_model_zrok.Principal) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn OrgAccountOverviewHandlerFunc) Handle(params OrgAccountOverviewParams, principal *rest_model_zrok.Principal) middleware.Responder {
+	return fn(params, principal)
+}
+
+// OrgAccountOverviewHandler interface for that can handle valid org account overview params
+type OrgAccountOverviewHandler interface {
+	Handle(OrgAccountOverviewParams, *rest_model_zrok.Principal) middleware.Responder
+}
+
+// NewOrgAccountOverview creates a new http.Handler for the org account overview operation
+func NewOrgAccountOverview(ctx *middleware.Context, handler OrgAccountOverviewHandler) *OrgAccountOverview {
+	return &OrgAccountOverview{Context: ctx, Handler: handler}
+}
+
+/*
+	OrgAccountOverview swagger:route GET /overview/{organizationToken}/{accountEmail} metadata orgAccountOverview
+
+OrgAccountOverview org account overview API
+*/
+type OrgAccountOverview struct {
+	Context *middleware.Context
+	Handler OrgAccountOverviewHandler
+}
+
+func (o *OrgAccountOverview) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		*r = *rCtx
+	}
+	var Params = NewOrgAccountOverviewParams()
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		*r = *aCtx
+	}
+	var principal *rest_model_zrok.Principal
+	if uprinc != nil {
+		principal = uprinc.(*rest_model_zrok.Principal) // this is really a rest_model_zrok.Principal, I promise
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}

rest_server_zrok/operations/metadata/org_account_overview_parameters.go

@@ -0,0 +1,95 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewOrgAccountOverviewParams creates a new OrgAccountOverviewParams object
+//
+// There are no default values defined in the spec.
+func NewOrgAccountOverviewParams() OrgAccountOverviewParams {
+
+	return OrgAccountOverviewParams{}
+}
+
+// OrgAccountOverviewParams contains all the bound params for the org account overview operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters orgAccountOverview
+type OrgAccountOverviewParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  Required: true
+	  In: path
+	*/
+	AccountEmail string
+	/*
+	  Required: true
+	  In: path
+	*/
+	OrganizationToken string
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewOrgAccountOverviewParams() beforehand.
+func (o *OrgAccountOverviewParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	rAccountEmail, rhkAccountEmail, _ := route.Params.GetOK("accountEmail")
+	if err := o.bindAccountEmail(rAccountEmail, rhkAccountEmail, route.Formats); err != nil {
+		res = append(res, err)
+	}
+
+	rOrganizationToken, rhkOrganizationToken, _ := route.Params.GetOK("organizationToken")
+	if err := o.bindOrganizationToken(rOrganizationToken, rhkOrganizationToken, route.Formats); err != nil {
+		res = append(res, err)
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// bindAccountEmail binds and validates parameter AccountEmail from path.
+func (o *OrgAccountOverviewParams) bindAccountEmail(rawData []string, hasKey bool, formats strfmt.Registry) error {
+	var raw string
+	if len(rawData) > 0 {
+		raw = rawData[len(rawData)-1]
+	}
+
+	// Required: true
+	// Parameter is provided by construction from the route
+	o.AccountEmail = raw
+
+	return nil
+}
+
+// bindOrganizationToken binds and validates parameter OrganizationToken from path.
+func (o *OrgAccountOverviewParams) bindOrganizationToken(rawData []string, hasKey bool, formats strfmt.Registry) error {
+	var raw string
+	if len(rawData) > 0 {
+		raw = rawData[len(rawData)-1]
+	}
+
+	// Required: true
+	// Parameter is provided by construction from the route
+	o.OrganizationToken = raw
+
+	return nil
+}

rest_server_zrok/operations/metadata/org_account_overview_responses.go

@@ -0,0 +1,109 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+
+	"github.com/openziti/zrok/rest_model_zrok"
+)
+
+// OrgAccountOverviewOKCode is the HTTP code returned for type OrgAccountOverviewOK
+const OrgAccountOverviewOKCode int = 200
+
+/*
+OrgAccountOverviewOK ok
+
+swagger:response orgAccountOverviewOK
+*/
+type OrgAccountOverviewOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model_zrok.Overview `json:"body,omitempty"`
+}
+
+// NewOrgAccountOverviewOK creates OrgAccountOverviewOK with default headers values
+func NewOrgAccountOverviewOK() *OrgAccountOverviewOK {
+
+	return &OrgAccountOverviewOK{}
+}
+
+// WithPayload adds the payload to the org account overview o k response
+func (o *OrgAccountOverviewOK) WithPayload(payload *rest_model_zrok.Overview) *OrgAccountOverviewOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the org account overview o k response
+func (o *OrgAccountOverviewOK) SetPayload(payload *rest_model_zrok.Overview) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *OrgAccountOverviewOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// OrgAccountOverviewNotFoundCode is the HTTP code returned for type OrgAccountOverviewNotFound
+const OrgAccountOverviewNotFoundCode int = 404
+
+/*
+OrgAccountOverviewNotFound not found
+
+swagger:response orgAccountOverviewNotFound
+*/
+type OrgAccountOverviewNotFound struct {
+}
+
+// NewOrgAccountOverviewNotFound creates OrgAccountOverviewNotFound with default headers values
+func NewOrgAccountOverviewNotFound() *OrgAccountOverviewNotFound {
+
+	return &OrgAccountOverviewNotFound{}
+}
+
+// WriteResponse to the client
+func (o *OrgAccountOverviewNotFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(404)
+}
+
+// OrgAccountOverviewInternalServerErrorCode is the HTTP code returned for type OrgAccountOverviewInternalServerError
+const OrgAccountOverviewInternalServerErrorCode int = 500
+
+/*
+OrgAccountOverviewInternalServerError internal server error
+
+swagger:response orgAccountOverviewInternalServerError
+*/
+type OrgAccountOverviewInternalServerError struct {
+}
+
+// NewOrgAccountOverviewInternalServerError creates OrgAccountOverviewInternalServerError with default headers values
+func NewOrgAccountOverviewInternalServerError() *OrgAccountOverviewInternalServerError {
+
+	return &OrgAccountOverviewInternalServerError{}
+}
+
+// WriteResponse to the client
+func (o *OrgAccountOverviewInternalServerError) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses
+
+	rw.WriteHeader(500)
+}

rest_server_zrok/operations/metadata/org_account_overview_urlbuilder.go

@@ -0,0 +1,107 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+package metadata
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+	"strings"
+)
+
+// OrgAccountOverviewURL generates an URL for the org account overview operation
+type OrgAccountOverviewURL struct {
+	AccountEmail      string
+	OrganizationToken string
+
+	_basePath string
+	// avoid unkeyed usage
+	_ struct{}
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *OrgAccountOverviewURL) WithBasePath(bp string) *OrgAccountOverviewURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *OrgAccountOverviewURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *OrgAccountOverviewURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/overview/{organizationToken}/{accountEmail}"
+
+	accountEmail := o.AccountEmail
+	if accountEmail != "" {
+		_path = strings.Replace(_path, "{accountEmail}", accountEmail, -1)
+	} else {
+		return nil, errors.New("accountEmail is required on OrgAccountOverviewURL")
+	}
+
+	organizationToken := o.OrganizationToken
+	if organizationToken != "" {
+		_path = strings.Replace(_path, "{organizationToken}", organizationToken, -1)
+	} else {
+		return nil, errors.New("organizationToken is required on OrgAccountOverviewURL")
+	}
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/api/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *OrgAccountOverviewURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *OrgAccountOverviewURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *OrgAccountOverviewURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on OrgAccountOverviewURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on OrgAccountOverviewURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *OrgAccountOverviewURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server_zrok/operations/zrok_api.go

@@ -52,6 +52,9 @@ func NewZrokAPI(spec *loads.Document) *ZrokAPI {
 		ShareAccessHandler: share.AccessHandlerFunc(func(params share.AccessParams, principal *rest_model_zrok.Principal) middleware.Responder {
 			return middleware.NotImplemented("operation share.Access has not yet been implemented")
 		}),
+		AdminAddOrganizationMemberHandler: admin.AddOrganizationMemberHandlerFunc(func(params admin.AddOrganizationMemberParams, principal *rest_model_zrok.Principal) middleware.Responder {
+			return middleware.NotImplemented("operation admin.AddOrganizationMember has not yet been implemented")
+		}),
 		AccountChangePasswordHandler: account.ChangePasswordHandlerFunc(func(params account.ChangePasswordParams, principal *rest_model_zrok.Principal) middleware.Responder {
 			return middleware.NotImplemented("operation account.ChangePassword has not yet been implemented")
 		}),
@@ -67,9 +70,15 @@ func NewZrokAPI(spec *loads.Document) *ZrokAPI {
 		AdminCreateIdentityHandler: admin.CreateIdentityHandlerFunc(func(params admin.CreateIdentityParams, principal *rest_model_zrok.Principal) middleware.Responder {
 			return middleware.NotImplemented("operation admin.CreateIdentity has not yet been implemented")
 		}),
+		AdminCreateOrganizationHandler: admin.CreateOrganizationHandlerFunc(func(params admin.CreateOrganizationParams, principal *rest_model_zrok.Principal) middleware.Responder {
+			return middleware.NotImplemented("operation admin.CreateOrganization has not yet been implemented")
+		}),
 		AdminDeleteFrontendHandler: admin.DeleteFrontendHandlerFunc(func(params admin.DeleteFrontendParams, principal *rest_model_zrok.Principal) middleware.Responder {
 			return middleware.NotImplemented("operation admin.DeleteFrontend has not yet been implemented")
 		}),
+		AdminDeleteOrganizationHandler: admin.DeleteOrganizationHandlerFunc(func(params admin.DeleteOrganizationParams, principal *rest_model_zrok.Principal) middleware.Responder {
+			return middleware.NotImplemented("operation admin.DeleteOrganization has not yet been implemented")
+		}),
 		EnvironmentDisableHandler: environment.DisableHandlerFunc(func(params environment.DisableParams, principal *rest_model_zrok.Principal) middleware.Responder {
 			return middleware.NotImplemented("operation environment.Disable has not yet been implemented")
 		}),
@@ -109,9 +118,24 @@ func NewZrokAPI(spec *loads.Document) *ZrokAPI {
 		AdminListFrontendsHandler: admin.ListFrontendsHandlerFunc(func(params admin.ListFrontendsParams, principal *rest_model_zrok.Principal) middleware.Responder {
 			return middleware.NotImplemented("operation admin.ListFrontends has not yet been implemented")
 		}),
+		MetadataListMembershipsHandler: metadata.ListMembershipsHandlerFunc(func(params metadata.ListMembershipsParams, principal *rest_model_zrok.Principal) middleware.Responder {
+			return middleware.NotImplemented("operation metadata.ListMemberships has not yet been implemented")
+		}),
+		MetadataListOrgMembersHandler: metadata.ListOrgMembersHandlerFunc(func(params metadata.ListOrgMembersParams, principal *rest_model_zrok.Principal) middleware.Responder {
+			return middleware.NotImplemented("operation metadata.ListOrgMembers has not yet been implemented")
+		}),
+		AdminListOrganizationMembersHandler: admin.ListOrganizationMembersHandlerFunc(func(params admin.ListOrganizationMembersParams, principal *rest_model_zrok.Principal) middleware.Responder {
+			return middleware.NotImplemented("operation admin.ListOrganizationMembers has not yet been implemented")
+		}),
+		AdminListOrganizationsHandler: admin.ListOrganizationsHandlerFunc(func(params admin.ListOrganizationsParams, principal *rest_model_zrok.Principal) middleware.Responder {
+			return middleware.NotImplemented("operation admin.ListOrganizations has not yet been implemented")
+		}),
 		AccountLoginHandler: account.LoginHandlerFunc(func(params account.LoginParams) middleware.Responder {
 			return middleware.NotImplemented("operation account.Login has not yet been implemented")
 		}),
+		MetadataOrgAccountOverviewHandler: metadata.OrgAccountOverviewHandlerFunc(func(params metadata.OrgAccountOverviewParams, principal *rest_model_zrok.Principal) middleware.Responder {
+			return middleware.NotImplemented("operation metadata.OrgAccountOverview has not yet been implemented")
+		}),
 		MetadataOverviewHandler: metadata.OverviewHandlerFunc(func(params metadata.OverviewParams, principal *rest_model_zrok.Principal) middleware.Responder {
 			return middleware.NotImplemented("operation metadata.Overview has not yet been implemented")
 		}),
@@ -121,6 +145,9 @@ func NewZrokAPI(spec *loads.Document) *ZrokAPI {
 		AccountRegisterHandler: account.RegisterHandlerFunc(func(params account.RegisterParams) middleware.Responder {
 			return middleware.NotImplemented("operation account.Register has not yet been implemented")
 		}),
+		AdminRemoveOrganizationMemberHandler: admin.RemoveOrganizationMemberHandlerFunc(func(params admin.RemoveOrganizationMemberParams, principal *rest_model_zrok.Principal) middleware.Responder {
+			return middleware.NotImplemented("operation admin.RemoveOrganizationMember has not yet been implemented")
+		}),
 		AccountResetPasswordHandler: account.ResetPasswordHandlerFunc(func(params account.ResetPasswordParams) middleware.Responder {
 			return middleware.NotImplemented("operation account.ResetPassword has not yet been implemented")
 		}),
@@ -200,6 +227,8 @@ type ZrokAPI struct {
 
 	// ShareAccessHandler sets the operation handler for the access operation
 	ShareAccessHandler share.AccessHandler
+	// AdminAddOrganizationMemberHandler sets the operation handler for the add organization member operation
+	AdminAddOrganizationMemberHandler admin.AddOrganizationMemberHandler
 	// AccountChangePasswordHandler sets the operation handler for the change password operation
 	AccountChangePasswordHandler account.ChangePasswordHandler
 	// MetadataConfigurationHandler sets the operation handler for the configuration operation
@@ -210,8 +239,12 @@ type ZrokAPI struct {
 	AdminCreateFrontendHandler admin.CreateFrontendHandler
 	// AdminCreateIdentityHandler sets the operation handler for the create identity operation
 	AdminCreateIdentityHandler admin.CreateIdentityHandler
+	// AdminCreateOrganizationHandler sets the operation handler for the create organization operation
+	AdminCreateOrganizationHandler admin.CreateOrganizationHandler
 	// AdminDeleteFrontendHandler sets the operation handler for the delete frontend operation
 	AdminDeleteFrontendHandler admin.DeleteFrontendHandler
+	// AdminDeleteOrganizationHandler sets the operation handler for the delete organization operation
+	AdminDeleteOrganizationHandler admin.DeleteOrganizationHandler
 	// EnvironmentDisableHandler sets the operation handler for the disable operation
 	EnvironmentDisableHandler environment.DisableHandler
 	// EnvironmentEnableHandler sets the operation handler for the enable operation
@@ -238,14 +271,26 @@ type ZrokAPI struct {
 	AdminInviteTokenGenerateHandler admin.InviteTokenGenerateHandler
 	// AdminListFrontendsHandler sets the operation handler for the list frontends operation
 	AdminListFrontendsHandler admin.ListFrontendsHandler
+	// MetadataListMembershipsHandler sets the operation handler for the list memberships operation
+	MetadataListMembershipsHandler metadata.ListMembershipsHandler
+	// MetadataListOrgMembersHandler sets the operation handler for the list org members operation
+	MetadataListOrgMembersHandler metadata.ListOrgMembersHandler
+	// AdminListOrganizationMembersHandler sets the operation handler for the list organization members operation
+	AdminListOrganizationMembersHandler admin.ListOrganizationMembersHandler
+	// AdminListOrganizationsHandler sets the operation handler for the list organizations operation
+	AdminListOrganizationsHandler admin.ListOrganizationsHandler
 	// AccountLoginHandler sets the operation handler for the login operation
 	AccountLoginHandler account.LoginHandler
+	// MetadataOrgAccountOverviewHandler sets the operation handler for the org account overview operation
+	MetadataOrgAccountOverviewHandler metadata.OrgAccountOverviewHandler
 	// MetadataOverviewHandler sets the operation handler for the overview operation
 	MetadataOverviewHandler metadata.OverviewHandler
 	// AccountRegenerateTokenHandler sets the operation handler for the regenerate token operation
 	AccountRegenerateTokenHandler account.RegenerateTokenHandler
 	// AccountRegisterHandler sets the operation handler for the register operation
 	AccountRegisterHandler account.RegisterHandler
+	// AdminRemoveOrganizationMemberHandler sets the operation handler for the remove organization member operation
+	AdminRemoveOrganizationMemberHandler admin.RemoveOrganizationMemberHandler
 	// AccountResetPasswordHandler sets the operation handler for the reset password operation
 	AccountResetPasswordHandler account.ResetPasswordHandler
 	// AccountResetPasswordRequestHandler sets the operation handler for the reset password request operation
@@ -348,6 +393,9 @@ func (o *ZrokAPI) Validate() error {
 	if o.ShareAccessHandler == nil {
 		unregistered = append(unregistered, "share.AccessHandler")
 	}
+	if o.AdminAddOrganizationMemberHandler == nil {
+		unregistered = append(unregistered, "admin.AddOrganizationMemberHandler")
+	}
 	if o.AccountChangePasswordHandler == nil {
 		unregistered = append(unregistered, "account.ChangePasswordHandler")
 	}
@@ -363,9 +411,15 @@ func (o *ZrokAPI) Validate() error {
 	if o.AdminCreateIdentityHandler == nil {
 		unregistered = append(unregistered, "admin.CreateIdentityHandler")
 	}
+	if o.AdminCreateOrganizationHandler == nil {
+		unregistered = append(unregistered, "admin.CreateOrganizationHandler")
+	}
 	if o.AdminDeleteFrontendHandler == nil {
 		unregistered = append(unregistered, "admin.DeleteFrontendHandler")
 	}
+	if o.AdminDeleteOrganizationHandler == nil {
+		unregistered = append(unregistered, "admin.DeleteOrganizationHandler")
+	}
 	if o.EnvironmentDisableHandler == nil {
 		unregistered = append(unregistered, "environment.DisableHandler")
 	}
@@ -405,9 +459,24 @@ func (o *ZrokAPI) Validate() error {
 	if o.AdminListFrontendsHandler == nil {
 		unregistered = append(unregistered, "admin.ListFrontendsHandler")
 	}
+	if o.MetadataListMembershipsHandler == nil {
+		unregistered = append(unregistered, "metadata.ListMembershipsHandler")
+	}
+	if o.MetadataListOrgMembersHandler == nil {
+		unregistered = append(unregistered, "metadata.ListOrgMembersHandler")
+	}
+	if o.AdminListOrganizationMembersHandler == nil {
+		unregistered = append(unregistered, "admin.ListOrganizationMembersHandler")
+	}
+	if o.AdminListOrganizationsHandler == nil {
+		unregistered = append(unregistered, "admin.ListOrganizationsHandler")
+	}
 	if o.AccountLoginHandler == nil {
 		unregistered = append(unregistered, "account.LoginHandler")
 	}
+	if o.MetadataOrgAccountOverviewHandler == nil {
+		unregistered = append(unregistered, "metadata.OrgAccountOverviewHandler")
+	}
 	if o.MetadataOverviewHandler == nil {
 		unregistered = append(unregistered, "metadata.OverviewHandler")
 	}
@@ -417,6 +486,9 @@ func (o *ZrokAPI) Validate() error {
 	if o.AccountRegisterHandler == nil {
 		unregistered = append(unregistered, "account.RegisterHandler")
 	}
+	if o.AdminRemoveOrganizationMemberHandler == nil {
+		unregistered = append(unregistered, "admin.RemoveOrganizationMemberHandler")
+	}
 	if o.AccountResetPasswordHandler == nil {
 		unregistered = append(unregistered, "account.ResetPasswordHandler")
 	}
@@ -550,6 +622,10 @@ func (o *ZrokAPI) initHandlerCache() {
 	if o.handlers["POST"] == nil {
 		o.handlers["POST"] = make(map[string]http.Handler)
 	}
+	o.handlers["POST"]["/organization/add"] = admin.NewAddOrganizationMember(o.context, o.AdminAddOrganizationMemberHandler)
+	if o.handlers["POST"] == nil {
+		o.handlers["POST"] = make(map[string]http.Handler)
+	}
 	o.handlers["POST"]["/changePassword"] = account.NewChangePassword(o.context, o.AccountChangePasswordHandler)
 	if o.handlers["GET"] == nil {
 		o.handlers["GET"] = make(map[string]http.Handler)
@@ -567,10 +643,18 @@ func (o *ZrokAPI) initHandlerCache() {
 		o.handlers["POST"] = make(map[string]http.Handler)
 	}
 	o.handlers["POST"]["/identity"] = admin.NewCreateIdentity(o.context, o.AdminCreateIdentityHandler)
+	if o.handlers["POST"] == nil {
+		o.handlers["POST"] = make(map[string]http.Handler)
+	}
+	o.handlers["POST"]["/organization"] = admin.NewCreateOrganization(o.context, o.AdminCreateOrganizationHandler)
 	if o.handlers["DELETE"] == nil {
 		o.handlers["DELETE"] = make(map[string]http.Handler)
 	}
 	o.handlers["DELETE"]["/frontend"] = admin.NewDeleteFrontend(o.context, o.AdminDeleteFrontendHandler)
+	if o.handlers["DELETE"] == nil {
+		o.handlers["DELETE"] = make(map[string]http.Handler)
+	}
+	o.handlers["DELETE"]["/organization"] = admin.NewDeleteOrganization(o.context, o.AdminDeleteOrganizationHandler)
 	if o.handlers["POST"] == nil {
 		o.handlers["POST"] = make(map[string]http.Handler)
 	}
@@ -623,6 +707,22 @@ func (o *ZrokAPI) initHandlerCache() {
 		o.handlers["GET"] = make(map[string]http.Handler)
 	}
 	o.handlers["GET"]["/frontends"] = admin.NewListFrontends(o.context, o.AdminListFrontendsHandler)
+	if o.handlers["GET"] == nil {
+		o.handlers["GET"] = make(map[string]http.Handler)
+	}
+	o.handlers["GET"]["/memberships"] = metadata.NewListMemberships(o.context, o.MetadataListMembershipsHandler)
+	if o.handlers["GET"] == nil {
+		o.handlers["GET"] = make(map[string]http.Handler)
+	}
+	o.handlers["GET"]["/members/{organizationToken}"] = metadata.NewListOrgMembers(o.context, o.MetadataListOrgMembersHandler)
+	if o.handlers["POST"] == nil {
+		o.handlers["POST"] = make(map[string]http.Handler)
+	}
+	o.handlers["POST"]["/organization/list"] = admin.NewListOrganizationMembers(o.context, o.AdminListOrganizationMembersHandler)
+	if o.handlers["GET"] == nil {
+		o.handlers["GET"] = make(map[string]http.Handler)
+	}
+	o.handlers["GET"]["/organizations"] = admin.NewListOrganizations(o.context, o.AdminListOrganizationsHandler)
 	if o.handlers["POST"] == nil {
 		o.handlers["POST"] = make(map[string]http.Handler)
 	}
@@ -630,6 +730,10 @@ func (o *ZrokAPI) initHandlerCache() {
 	if o.handlers["GET"] == nil {
 		o.handlers["GET"] = make(map[string]http.Handler)
 	}
+	o.handlers["GET"]["/overview/{organizationToken}/{accountEmail}"] = metadata.NewOrgAccountOverview(o.context, o.MetadataOrgAccountOverviewHandler)
+	if o.handlers["GET"] == nil {
+		o.handlers["GET"] = make(map[string]http.Handler)
+	}
 	o.handlers["GET"]["/overview"] = metadata.NewOverview(o.context, o.MetadataOverviewHandler)
 	if o.handlers["POST"] == nil {
 		o.handlers["POST"] = make(map[string]http.Handler)
@@ -642,6 +746,10 @@ func (o *ZrokAPI) initHandlerCache() {
 	if o.handlers["POST"] == nil {
 		o.handlers["POST"] = make(map[string]http.Handler)
 	}
+	o.handlers["POST"]["/organization/remove"] = admin.NewRemoveOrganizationMember(o.context, o.AdminRemoveOrganizationMemberHandler)
+	if o.handlers["POST"] == nil {
+		o.handlers["POST"] = make(map[string]http.Handler)
+	}
 	o.handlers["POST"]["/resetPassword"] = account.NewResetPassword(o.context, o.AccountResetPasswordHandler)
 	if o.handlers["POST"] == nil {
 		o.handlers["POST"] = make(map[string]http.Handler)

sdk/nodejs/sdk/src/zrok/api/.openapi-generator/FILES

@@ -8,6 +8,7 @@ api/metadataApi.ts
 api/shareApi.ts
 model/accessRequest.ts
 model/accessResponse.ts
+model/addOrganizationMemberRequest.ts
 model/authUser.ts
 model/changePasswordRequest.ts
 model/configuration.ts
@@ -16,6 +17,7 @@ model/createFrontendRequest.ts
 model/createFrontendResponse.ts
 model/createIdentity201Response.ts
 model/createIdentityRequest.ts
+model/createOrganizationRequest.ts
 model/deleteFrontendRequest.ts
 model/disableRequest.ts
 model/enableRequest.ts
@@ -26,6 +28,12 @@ model/frontend.ts
 model/grantsRequest.ts
 model/inviteRequest.ts
 model/inviteTokenGenerateRequest.ts
+model/listMemberships200Response.ts
+model/listMemberships200ResponseMembershipsInner.ts
+model/listOrganizationMembers200Response.ts
+model/listOrganizationMembers200ResponseMembersInner.ts
+model/listOrganizations200Response.ts
+model/listOrganizations200ResponseOrganizationsInner.ts
 model/loginRequest.ts
 model/metrics.ts
 model/metricsSample.ts
@@ -38,6 +46,7 @@ model/regenerateToken200Response.ts
 model/regenerateTokenRequest.ts
 model/registerRequest.ts
 model/registerResponse.ts
+model/removeOrganizationMemberRequest.ts
 model/resetPasswordRequest.ts
 model/share.ts
 model/shareRequest.ts

sdk/nodejs/sdk/src/zrok/api/api/adminApi.ts

@@ -15,16 +15,21 @@ import localVarRequest from 'request';
 import http from 'http';
 
 /* tslint:disable:no-unused-locals */
+import { AddOrganizationMemberRequest } from '../model/addOrganizationMemberRequest';
 import { CreateAccountRequest } from '../model/createAccountRequest';
 import { CreateFrontendRequest } from '../model/createFrontendRequest';
 import { CreateFrontendResponse } from '../model/createFrontendResponse';
 import { CreateIdentity201Response } from '../model/createIdentity201Response';
 import { CreateIdentityRequest } from '../model/createIdentityRequest';
+import { CreateOrganizationRequest } from '../model/createOrganizationRequest';
 import { DeleteFrontendRequest } from '../model/deleteFrontendRequest';
 import { GrantsRequest } from '../model/grantsRequest';
 import { InviteTokenGenerateRequest } from '../model/inviteTokenGenerateRequest';
+import { ListOrganizationMembers200Response } from '../model/listOrganizationMembers200Response';
+import { ListOrganizations200Response } from '../model/listOrganizations200Response';
 import { PublicFrontend } from '../model/publicFrontend';
 import { RegenerateToken200Response } from '../model/regenerateToken200Response';
+import { RemoveOrganizationMemberRequest } from '../model/removeOrganizationMemberRequest';
 import { UpdateFrontendRequest } from '../model/updateFrontendRequest';
 
 import { ObjectSerializer, Authentication, VoidAuth, Interceptor } from '../model/models';
@@ -99,6 +104,64 @@ export class AdminApi {
         this.interceptors.push(interceptor);
     }
 
+    /**
+     * 
+     * @param body 
+     */
+    public async addOrganizationMember (body?: AddOrganizationMemberRequest, options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body?: any;  }> {
+        const localVarPath = this.basePath + '/organization/add';
+        let localVarQueryParameters: any = {};
+        let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
+        let localVarFormParams: any = {};
+
+        (<any>Object).assign(localVarHeaderParams, options.headers);
+
+        let localVarUseFormData = false;
+
+        let localVarRequestOptions: localVarRequest.Options = {
+            method: 'POST',
+            qs: localVarQueryParameters,
+            headers: localVarHeaderParams,
+            uri: localVarPath,
+            useQuerystring: this._useQuerystring,
+            json: true,
+            body: ObjectSerializer.serialize(body, "AddOrganizationMemberRequest")
+        };
+
+        let authenticationPromise = Promise.resolve();
+        if (this.authentications.key.apiKey) {
+            authenticationPromise = authenticationPromise.then(() => this.authentications.key.applyToRequest(localVarRequestOptions));
+        }
+        authenticationPromise = authenticationPromise.then(() => this.authentications.default.applyToRequest(localVarRequestOptions));
+
+        let interceptorPromise = authenticationPromise;
+        for (const interceptor of this.interceptors) {
+            interceptorPromise = interceptorPromise.then(() => interceptor(localVarRequestOptions));
+        }
+
+        return interceptorPromise.then(() => {
+            if (Object.keys(localVarFormParams).length) {
+                if (localVarUseFormData) {
+                    (<any>localVarRequestOptions).formData = localVarFormParams;
+                } else {
+                    localVarRequestOptions.form = localVarFormParams;
+                }
+            }
+            return new Promise<{ response: http.IncomingMessage; body?: any;  }>((resolve, reject) => {
+                localVarRequest(localVarRequestOptions, (error, response, body) => {
+                    if (error) {
+                        reject(error);
+                    } else {
+                        if (response.statusCode && response.statusCode >= 200 && response.statusCode <= 299) {
+                            resolve({ response: response, body: body });
+                        } else {
+                            reject(new HttpError(response, body, response.statusCode));
+                        }
+                    }
+                });
+            });
+        });
+    }
     /**
      * 
      * @param body 
@@ -297,6 +360,72 @@ export class AdminApi {
             });
         });
     }
+    /**
+     * 
+     * @param body 
+     */
+    public async createOrganization (body?: CreateOrganizationRequest, options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body: RegenerateToken200Response;  }> {
+        const localVarPath = this.basePath + '/organization';
+        let localVarQueryParameters: any = {};
+        let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
+        const produces = ['application/zrok.v1+json'];
+        // give precedence to 'application/json'
+        if (produces.indexOf('application/json') >= 0) {
+            localVarHeaderParams.Accept = 'application/json';
+        } else {
+            localVarHeaderParams.Accept = produces.join(',');
+        }
+        let localVarFormParams: any = {};
+
+        (<any>Object).assign(localVarHeaderParams, options.headers);
+
+        let localVarUseFormData = false;
+
+        let localVarRequestOptions: localVarRequest.Options = {
+            method: 'POST',
+            qs: localVarQueryParameters,
+            headers: localVarHeaderParams,
+            uri: localVarPath,
+            useQuerystring: this._useQuerystring,
+            json: true,
+            body: ObjectSerializer.serialize(body, "CreateOrganizationRequest")
+        };
+
+        let authenticationPromise = Promise.resolve();
+        if (this.authentications.key.apiKey) {
+            authenticationPromise = authenticationPromise.then(() => this.authentications.key.applyToRequest(localVarRequestOptions));
+        }
+        authenticationPromise = authenticationPromise.then(() => this.authentications.default.applyToRequest(localVarRequestOptions));
+
+        let interceptorPromise = authenticationPromise;
+        for (const interceptor of this.interceptors) {
+            interceptorPromise = interceptorPromise.then(() => interceptor(localVarRequestOptions));
+        }
+
+        return interceptorPromise.then(() => {
+            if (Object.keys(localVarFormParams).length) {
+                if (localVarUseFormData) {
+                    (<any>localVarRequestOptions).formData = localVarFormParams;
+                } else {
+                    localVarRequestOptions.form = localVarFormParams;
+                }
+            }
+            return new Promise<{ response: http.IncomingMessage; body: RegenerateToken200Response;  }>((resolve, reject) => {
+                localVarRequest(localVarRequestOptions, (error, response, body) => {
+                    if (error) {
+                        reject(error);
+                    } else {
+                        if (response.statusCode && response.statusCode >= 200 && response.statusCode <= 299) {
+                            body = ObjectSerializer.deserialize(body, "RegenerateToken200Response");
+                            resolve({ response: response, body: body });
+                        } else {
+                            reject(new HttpError(response, body, response.statusCode));
+                        }
+                    }
+                });
+            });
+        });
+    }
     /**
      * 
      * @param body 
@@ -355,6 +484,64 @@ export class AdminApi {
             });
         });
     }
+    /**
+     * 
+     * @param body 
+     */
+    public async deleteOrganization (body?: RegenerateToken200Response, options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body?: any;  }> {
+        const localVarPath = this.basePath + '/organization';
+        let localVarQueryParameters: any = {};
+        let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
+        let localVarFormParams: any = {};
+
+        (<any>Object).assign(localVarHeaderParams, options.headers);
+
+        let localVarUseFormData = false;
+
+        let localVarRequestOptions: localVarRequest.Options = {
+            method: 'DELETE',
+            qs: localVarQueryParameters,
+            headers: localVarHeaderParams,
+            uri: localVarPath,
+            useQuerystring: this._useQuerystring,
+            json: true,
+            body: ObjectSerializer.serialize(body, "RegenerateToken200Response")
+        };
+
+        let authenticationPromise = Promise.resolve();
+        if (this.authentications.key.apiKey) {
+            authenticationPromise = authenticationPromise.then(() => this.authentications.key.applyToRequest(localVarRequestOptions));
+        }
+        authenticationPromise = authenticationPromise.then(() => this.authentications.default.applyToRequest(localVarRequestOptions));
+
+        let interceptorPromise = authenticationPromise;
+        for (const interceptor of this.interceptors) {
+            interceptorPromise = interceptorPromise.then(() => interceptor(localVarRequestOptions));
+        }
+
+        return interceptorPromise.then(() => {
+            if (Object.keys(localVarFormParams).length) {
+                if (localVarUseFormData) {
+                    (<any>localVarRequestOptions).formData = localVarFormParams;
+                } else {
+                    localVarRequestOptions.form = localVarFormParams;
+                }
+            }
+            return new Promise<{ response: http.IncomingMessage; body?: any;  }>((resolve, reject) => {
+                localVarRequest(localVarRequestOptions, (error, response, body) => {
+                    if (error) {
+                        reject(error);
+                    } else {
+                        if (response.statusCode && response.statusCode >= 200 && response.statusCode <= 299) {
+                            resolve({ response: response, body: body });
+                        } else {
+                            reject(new HttpError(response, body, response.statusCode));
+                        }
+                    }
+                });
+            });
+        });
+    }
     /**
      * 
      * @param body 
@@ -535,6 +722,194 @@ export class AdminApi {
             });
         });
     }
+    /**
+     * 
+     * @param body 
+     */
+    public async listOrganizationMembers (body?: RegenerateToken200Response, options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body: ListOrganizationMembers200Response;  }> {
+        const localVarPath = this.basePath + '/organization/list';
+        let localVarQueryParameters: any = {};
+        let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
+        const produces = ['application/zrok.v1+json'];
+        // give precedence to 'application/json'
+        if (produces.indexOf('application/json') >= 0) {
+            localVarHeaderParams.Accept = 'application/json';
+        } else {
+            localVarHeaderParams.Accept = produces.join(',');
+        }
+        let localVarFormParams: any = {};
+
+        (<any>Object).assign(localVarHeaderParams, options.headers);
+
+        let localVarUseFormData = false;
+
+        let localVarRequestOptions: localVarRequest.Options = {
+            method: 'POST',
+            qs: localVarQueryParameters,
+            headers: localVarHeaderParams,
+            uri: localVarPath,
+            useQuerystring: this._useQuerystring,
+            json: true,
+            body: ObjectSerializer.serialize(body, "RegenerateToken200Response")
+        };
+
+        let authenticationPromise = Promise.resolve();
+        if (this.authentications.key.apiKey) {
+            authenticationPromise = authenticationPromise.then(() => this.authentications.key.applyToRequest(localVarRequestOptions));
+        }
+        authenticationPromise = authenticationPromise.then(() => this.authentications.default.applyToRequest(localVarRequestOptions));
+
+        let interceptorPromise = authenticationPromise;
+        for (const interceptor of this.interceptors) {
+            interceptorPromise = interceptorPromise.then(() => interceptor(localVarRequestOptions));
+        }
+
+        return interceptorPromise.then(() => {
+            if (Object.keys(localVarFormParams).length) {
+                if (localVarUseFormData) {
+                    (<any>localVarRequestOptions).formData = localVarFormParams;
+                } else {
+                    localVarRequestOptions.form = localVarFormParams;
+                }
+            }
+            return new Promise<{ response: http.IncomingMessage; body: ListOrganizationMembers200Response;  }>((resolve, reject) => {
+                localVarRequest(localVarRequestOptions, (error, response, body) => {
+                    if (error) {
+                        reject(error);
+                    } else {
+                        if (response.statusCode && response.statusCode >= 200 && response.statusCode <= 299) {
+                            body = ObjectSerializer.deserialize(body, "ListOrganizationMembers200Response");
+                            resolve({ response: response, body: body });
+                        } else {
+                            reject(new HttpError(response, body, response.statusCode));
+                        }
+                    }
+                });
+            });
+        });
+    }
+    /**
+     * 
+     */
+    public async listOrganizations (options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body: ListOrganizations200Response;  }> {
+        const localVarPath = this.basePath + '/organizations';
+        let localVarQueryParameters: any = {};
+        let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
+        const produces = ['application/zrok.v1+json'];
+        // give precedence to 'application/json'
+        if (produces.indexOf('application/json') >= 0) {
+            localVarHeaderParams.Accept = 'application/json';
+        } else {
+            localVarHeaderParams.Accept = produces.join(',');
+        }
+        let localVarFormParams: any = {};
+
+        (<any>Object).assign(localVarHeaderParams, options.headers);
+
+        let localVarUseFormData = false;
+
+        let localVarRequestOptions: localVarRequest.Options = {
+            method: 'GET',
+            qs: localVarQueryParameters,
+            headers: localVarHeaderParams,
+            uri: localVarPath,
+            useQuerystring: this._useQuerystring,
+            json: true,
+        };
+
+        let authenticationPromise = Promise.resolve();
+        if (this.authentications.key.apiKey) {
+            authenticationPromise = authenticationPromise.then(() => this.authentications.key.applyToRequest(localVarRequestOptions));
+        }
+        authenticationPromise = authenticationPromise.then(() => this.authentications.default.applyToRequest(localVarRequestOptions));
+
+        let interceptorPromise = authenticationPromise;
+        for (const interceptor of this.interceptors) {
+            interceptorPromise = interceptorPromise.then(() => interceptor(localVarRequestOptions));
+        }
+
+        return interceptorPromise.then(() => {
+            if (Object.keys(localVarFormParams).length) {
+                if (localVarUseFormData) {
+                    (<any>localVarRequestOptions).formData = localVarFormParams;
+                } else {
+                    localVarRequestOptions.form = localVarFormParams;
+                }
+            }
+            return new Promise<{ response: http.IncomingMessage; body: ListOrganizations200Response;  }>((resolve, reject) => {
+                localVarRequest(localVarRequestOptions, (error, response, body) => {
+                    if (error) {
+                        reject(error);
+                    } else {
+                        if (response.statusCode && response.statusCode >= 200 && response.statusCode <= 299) {
+                            body = ObjectSerializer.deserialize(body, "ListOrganizations200Response");
+                            resolve({ response: response, body: body });
+                        } else {
+                            reject(new HttpError(response, body, response.statusCode));
+                        }
+                    }
+                });
+            });
+        });
+    }
+    /**
+     * 
+     * @param body 
+     */
+    public async removeOrganizationMember (body?: RemoveOrganizationMemberRequest, options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body?: any;  }> {
+        const localVarPath = this.basePath + '/organization/remove';
+        let localVarQueryParameters: any = {};
+        let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
+        let localVarFormParams: any = {};
+
+        (<any>Object).assign(localVarHeaderParams, options.headers);
+
+        let localVarUseFormData = false;
+
+        let localVarRequestOptions: localVarRequest.Options = {
+            method: 'POST',
+            qs: localVarQueryParameters,
+            headers: localVarHeaderParams,
+            uri: localVarPath,
+            useQuerystring: this._useQuerystring,
+            json: true,
+            body: ObjectSerializer.serialize(body, "RemoveOrganizationMemberRequest")
+        };
+
+        let authenticationPromise = Promise.resolve();
+        if (this.authentications.key.apiKey) {
+            authenticationPromise = authenticationPromise.then(() => this.authentications.key.applyToRequest(localVarRequestOptions));
+        }
+        authenticationPromise = authenticationPromise.then(() => this.authentications.default.applyToRequest(localVarRequestOptions));
+
+        let interceptorPromise = authenticationPromise;
+        for (const interceptor of this.interceptors) {
+            interceptorPromise = interceptorPromise.then(() => interceptor(localVarRequestOptions));
+        }
+
+        return interceptorPromise.then(() => {
+            if (Object.keys(localVarFormParams).length) {
+                if (localVarUseFormData) {
+                    (<any>localVarRequestOptions).formData = localVarFormParams;
+                } else {
+                    localVarRequestOptions.form = localVarFormParams;
+                }
+            }
+            return new Promise<{ response: http.IncomingMessage; body?: any;  }>((resolve, reject) => {
+                localVarRequest(localVarRequestOptions, (error, response, body) => {
+                    if (error) {
+                        reject(error);
+                    } else {
+                        if (response.statusCode && response.statusCode >= 200 && response.statusCode <= 299) {
+                            resolve({ response: response, body: body });
+                        } else {
+                            reject(new HttpError(response, body, response.statusCode));
+                        }
+                    }
+                });
+            });
+        });
+    }
     /**
      * 
      * @param body 

sdk/nodejs/sdk/src/zrok/api/api/metadataApi.ts

@@ -19,6 +19,8 @@ import { Configuration } from '../model/configuration';
 import { Environment } from '../model/environment';
 import { EnvironmentAndResources } from '../model/environmentAndResources';
 import { Frontend } from '../model/frontend';
+import { ListMemberships200Response } from '../model/listMemberships200Response';
+import { ListOrganizationMembers200Response } from '../model/listOrganizationMembers200Response';
 import { Metrics } from '../model/metrics';
 import { Overview } from '../model/overview';
 import { Share } from '../model/share';
@@ -654,6 +656,219 @@ export class MetadataApi {
             });
         });
     }
+    /**
+     * 
+     */
+    public async listMemberships (options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body: ListMemberships200Response;  }> {
+        const localVarPath = this.basePath + '/memberships';
+        let localVarQueryParameters: any = {};
+        let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
+        const produces = ['application/zrok.v1+json'];
+        // give precedence to 'application/json'
+        if (produces.indexOf('application/json') >= 0) {
+            localVarHeaderParams.Accept = 'application/json';
+        } else {
+            localVarHeaderParams.Accept = produces.join(',');
+        }
+        let localVarFormParams: any = {};
+
+        (<any>Object).assign(localVarHeaderParams, options.headers);
+
+        let localVarUseFormData = false;
+
+        let localVarRequestOptions: localVarRequest.Options = {
+            method: 'GET',
+            qs: localVarQueryParameters,
+            headers: localVarHeaderParams,
+            uri: localVarPath,
+            useQuerystring: this._useQuerystring,
+            json: true,
+        };
+
+        let authenticationPromise = Promise.resolve();
+        if (this.authentications.key.apiKey) {
+            authenticationPromise = authenticationPromise.then(() => this.authentications.key.applyToRequest(localVarRequestOptions));
+        }
+        authenticationPromise = authenticationPromise.then(() => this.authentications.default.applyToRequest(localVarRequestOptions));
+
+        let interceptorPromise = authenticationPromise;
+        for (const interceptor of this.interceptors) {
+            interceptorPromise = interceptorPromise.then(() => interceptor(localVarRequestOptions));
+        }
+
+        return interceptorPromise.then(() => {
+            if (Object.keys(localVarFormParams).length) {
+                if (localVarUseFormData) {
+                    (<any>localVarRequestOptions).formData = localVarFormParams;
+                } else {
+                    localVarRequestOptions.form = localVarFormParams;
+                }
+            }
+            return new Promise<{ response: http.IncomingMessage; body: ListMemberships200Response;  }>((resolve, reject) => {
+                localVarRequest(localVarRequestOptions, (error, response, body) => {
+                    if (error) {
+                        reject(error);
+                    } else {
+                        if (response.statusCode && response.statusCode >= 200 && response.statusCode <= 299) {
+                            body = ObjectSerializer.deserialize(body, "ListMemberships200Response");
+                            resolve({ response: response, body: body });
+                        } else {
+                            reject(new HttpError(response, body, response.statusCode));
+                        }
+                    }
+                });
+            });
+        });
+    }
+    /**
+     * 
+     * @param organizationToken 
+     */
+    public async listOrgMembers (organizationToken: string, options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body: ListOrganizationMembers200Response;  }> {
+        const localVarPath = this.basePath + '/members/{organizationToken}'
+            .replace('{' + 'organizationToken' + '}', encodeURIComponent(String(organizationToken)));
+        let localVarQueryParameters: any = {};
+        let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
+        const produces = ['application/zrok.v1+json'];
+        // give precedence to 'application/json'
+        if (produces.indexOf('application/json') >= 0) {
+            localVarHeaderParams.Accept = 'application/json';
+        } else {
+            localVarHeaderParams.Accept = produces.join(',');
+        }
+        let localVarFormParams: any = {};
+
+        // verify required parameter 'organizationToken' is not null or undefined
+        if (organizationToken === null || organizationToken === undefined) {
+            throw new Error('Required parameter organizationToken was null or undefined when calling listOrgMembers.');
+        }
+
+        (<any>Object).assign(localVarHeaderParams, options.headers);
+
+        let localVarUseFormData = false;
+
+        let localVarRequestOptions: localVarRequest.Options = {
+            method: 'GET',
+            qs: localVarQueryParameters,
+            headers: localVarHeaderParams,
+            uri: localVarPath,
+            useQuerystring: this._useQuerystring,
+            json: true,
+        };
+
+        let authenticationPromise = Promise.resolve();
+        if (this.authentications.key.apiKey) {
+            authenticationPromise = authenticationPromise.then(() => this.authentications.key.applyToRequest(localVarRequestOptions));
+        }
+        authenticationPromise = authenticationPromise.then(() => this.authentications.default.applyToRequest(localVarRequestOptions));
+
+        let interceptorPromise = authenticationPromise;
+        for (const interceptor of this.interceptors) {
+            interceptorPromise = interceptorPromise.then(() => interceptor(localVarRequestOptions));
+        }
+
+        return interceptorPromise.then(() => {
+            if (Object.keys(localVarFormParams).length) {
+                if (localVarUseFormData) {
+                    (<any>localVarRequestOptions).formData = localVarFormParams;
+                } else {
+                    localVarRequestOptions.form = localVarFormParams;
+                }
+            }
+            return new Promise<{ response: http.IncomingMessage; body: ListOrganizationMembers200Response;  }>((resolve, reject) => {
+                localVarRequest(localVarRequestOptions, (error, response, body) => {
+                    if (error) {
+                        reject(error);
+                    } else {
+                        if (response.statusCode && response.statusCode >= 200 && response.statusCode <= 299) {
+                            body = ObjectSerializer.deserialize(body, "ListOrganizationMembers200Response");
+                            resolve({ response: response, body: body });
+                        } else {
+                            reject(new HttpError(response, body, response.statusCode));
+                        }
+                    }
+                });
+            });
+        });
+    }
+    /**
+     * 
+     * @param organizationToken 
+     * @param accountEmail 
+     */
+    public async orgAccountOverview (organizationToken: string, accountEmail: string, options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body: Overview;  }> {
+        const localVarPath = this.basePath + '/overview/{organizationToken}/{accountEmail}'
+            .replace('{' + 'organizationToken' + '}', encodeURIComponent(String(organizationToken)))
+            .replace('{' + 'accountEmail' + '}', encodeURIComponent(String(accountEmail)));
+        let localVarQueryParameters: any = {};
+        let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
+        const produces = ['application/zrok.v1+json'];
+        // give precedence to 'application/json'
+        if (produces.indexOf('application/json') >= 0) {
+            localVarHeaderParams.Accept = 'application/json';
+        } else {
+            localVarHeaderParams.Accept = produces.join(',');
+        }
+        let localVarFormParams: any = {};
+
+        // verify required parameter 'organizationToken' is not null or undefined
+        if (organizationToken === null || organizationToken === undefined) {
+            throw new Error('Required parameter organizationToken was null or undefined when calling orgAccountOverview.');
+        }
+
+        // verify required parameter 'accountEmail' is not null or undefined
+        if (accountEmail === null || accountEmail === undefined) {
+            throw new Error('Required parameter accountEmail was null or undefined when calling orgAccountOverview.');
+        }
+
+        (<any>Object).assign(localVarHeaderParams, options.headers);
+
+        let localVarUseFormData = false;
+
+        let localVarRequestOptions: localVarRequest.Options = {
+            method: 'GET',
+            qs: localVarQueryParameters,
+            headers: localVarHeaderParams,
+            uri: localVarPath,
+            useQuerystring: this._useQuerystring,
+            json: true,
+        };
+
+        let authenticationPromise = Promise.resolve();
+        if (this.authentications.key.apiKey) {
+            authenticationPromise = authenticationPromise.then(() => this.authentications.key.applyToRequest(localVarRequestOptions));
+        }
+        authenticationPromise = authenticationPromise.then(() => this.authentications.default.applyToRequest(localVarRequestOptions));
+
+        let interceptorPromise = authenticationPromise;
+        for (const interceptor of this.interceptors) {
+            interceptorPromise = interceptorPromise.then(() => interceptor(localVarRequestOptions));
+        }
+
+        return interceptorPromise.then(() => {
+            if (Object.keys(localVarFormParams).length) {
+                if (localVarUseFormData) {
+                    (<any>localVarRequestOptions).formData = localVarFormParams;
+                } else {
+                    localVarRequestOptions.form = localVarFormParams;
+                }
+            }
+            return new Promise<{ response: http.IncomingMessage; body: Overview;  }>((resolve, reject) => {
+                localVarRequest(localVarRequestOptions, (error, response, body) => {
+                    if (error) {
+                        reject(error);
+                    } else {
+                        if (response.statusCode && response.statusCode >= 200 && response.statusCode <= 299) {
+                            body = ObjectSerializer.deserialize(body, "Overview");
+                            resolve({ response: response, body: body });
+                        } else {
+                            reject(new HttpError(response, body, response.statusCode));
+                        }
+                    }
+                });
+            });
+        });
+    }
     /**
      * 
      */

sdk/nodejs/sdk/src/zrok/api/model/addOrganizationMemberRequest.ts

@@ -0,0 +1,43 @@
+/**
+ * zrok
+ * zrok client access
+ *
+ * The version of the OpenAPI document: 0.3.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { RequestFile } from './models';
+
+export class AddOrganizationMemberRequest {
+    'token'?: string;
+    'email'?: string;
+    'admin'?: boolean;
+
+    static discriminator: string | undefined = undefined;
+
+    static attributeTypeMap: Array<{name: string, baseName: string, type: string}> = [
+        {
+            "name": "token",
+            "baseName": "token",
+            "type": "string"
+        },
+        {
+            "name": "email",
+            "baseName": "email",
+            "type": "string"
+        },
+        {
+            "name": "admin",
+            "baseName": "admin",
+            "type": "boolean"
+        }    ];
+
+    static getAttributeTypeMap() {
+        return AddOrganizationMemberRequest.attributeTypeMap;
+    }
+}
+

sdk/nodejs/sdk/src/zrok/api/model/createOrganizationRequest.ts

@@ -0,0 +1,31 @@
+/**
+ * zrok
+ * zrok client access
+ *
+ * The version of the OpenAPI document: 0.3.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { RequestFile } from './models';
+
+export class CreateOrganizationRequest {
+    'description'?: string;
+
+    static discriminator: string | undefined = undefined;
+
+    static attributeTypeMap: Array<{name: string, baseName: string, type: string}> = [
+        {
+            "name": "description",
+            "baseName": "description",
+            "type": "string"
+        }    ];
+
+    static getAttributeTypeMap() {
+        return CreateOrganizationRequest.attributeTypeMap;
+    }
+}
+

sdk/nodejs/sdk/src/zrok/api/model/listMemberships200Response.ts

@@ -0,0 +1,32 @@
+/**
+ * zrok
+ * zrok client access
+ *
+ * The version of the OpenAPI document: 0.3.0
+ * 
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+import { RequestFile } from './models';
+import { ListMemberships200ResponseMembershipsInner } from './listMemberships200ResponseMembershipsInner';
+
+export class ListMemberships200Response {
+    'memberships'?: Array<ListMemberships200ResponseMembershipsInner>;
+
+    static discriminator: string | undefined = undefined;
+
+    static attributeTypeMap: Array<{name: string, baseName: string, type: string}> = [
+        {
+            "name": "memberships",
+            "baseName": "memberships",
+            "type": "Array<ListMemberships200ResponseMembershipsInner>"
+        }    ];
+
+    static getAttributeTypeMap() {
+        return ListMemberships200Response.attributeTypeMap;
+    }
+}
+