Podio User Management API Guide

Auth method: OAuth 2.0

Setup steps

1. Register an API application at https://podio.com/settings/api to obtain a client_id and client_secret.
2. Choose an OAuth 2.0 grant type: Authorization Code (user-facing apps), Client Credentials (server-to-server), or Password (trusted apps).
3. Exchange credentials for an access_token and refresh_token via POST https://podio.com/oauth/token.
4. Include the access token in all API requests as an Authorization header: 'Authorization: OAuth2 {access_token}'.
5. Refresh the access token using the refresh_token before expiry (tokens expire after a set period).

Required scopes

Get current authenticated user

• Method: GET
• URL: https://api.podio.com/user/
• Watch out for: Returns data for the token owner only; cannot retrieve arbitrary users without org-admin privileges.

Request example

GET /user/ HTTP/1.1
Host: api.podio.com
Authorization: OAuth2 {access_token}

Response example

{
  "user_id": 12345,
  "mail": [{"type":"primary","mail":"user@example.com"}],
  "status": "active",
  "locale": "en_US",
  "timezone": "UTC"
}

Get user by ID

• Method: GET
• URL: https://api.podio.com/user/{user_id}
• Watch out for: Access may be restricted based on the requesting user's relationship to the target user (same org/space required).

Request example

GET /user/12345 HTTP/1.1
Host: api.podio.com
Authorization: OAuth2 {access_token}

Response example

{
  "user_id": 12345,
  "profile": {"name": "Jane Doe", "title": "Engineer"},
  "status": "active"
}

Update current user properties

• Method: PUT
• URL: https://api.podio.com/user/
• Watch out for: Only updates the authenticated user's own properties; no admin endpoint to update arbitrary users via this path.

Request example

PUT /user/ HTTP/1.1
Host: api.podio.com
Authorization: OAuth2 {access_token}
Content-Type: application/json

{"locale":"en_GB","timezone":"Europe/London"}

Response example

HTTP/1.1 204 No Content

Get organization members

• Method: GET
• URL: https://api.podio.com/org/{org_id}/member/
• Watch out for: Requires the authenticated user to be an org admin. Supports offset/limit pagination.

Request example

GET /org/678/member/ HTTP/1.1
Host: api.podio.com
Authorization: OAuth2 {access_token}

Response example

[
  {"user_id":12345,"role":"admin","profile":{"name":"Jane Doe"}},
  {"user_id":12346,"role":"regular","profile":{"name":"John Smith"}}
]

Get organization member by user ID

• Method: GET
• URL: https://api.podio.com/org/{org_id}/member/{user_id}
• Watch out for: Org admin token required.

Request example

GET /org/678/member/12345 HTTP/1.1
Host: api.podio.com
Authorization: OAuth2 {access_token}

Response example

{
  "user_id": 12345,
  "role": "admin",
  "profile": {"name": "Jane Doe", "title": "Engineer"}
}

Remove member from organization

• Method: DELETE
• URL: https://api.podio.com/org/{org_id}/member/{user_id}
• Watch out for: Permanently removes the user from the org. Cannot remove the last admin. Action is irreversible via API.

Request example

DELETE /org/678/member/12345 HTTP/1.1
Host: api.podio.com
Authorization: OAuth2 {access_token}

Response example

HTTP/1.1 204 No Content

Get space members

• Method: GET
• URL: https://api.podio.com/space/{space_id}/member/
• Watch out for: Space admin or org admin token required. Pagination via offset/limit.

Request example

GET /space/999/member/ HTTP/1.1
Host: api.podio.com
Authorization: OAuth2 {access_token}

Response example

[
  {"user_id":12345,"role":"admin"},
  {"user_id":12346,"role":"regular"}
]

Add member to space

• Method: POST
• URL: https://api.podio.com/space/{space_id}/member/
• Watch out for: Users must already exist in the org. Cannot create net-new Podio accounts via API; user provisioning requires the user to self-register or be invited via email.

Request example

POST /space/999/member/ HTTP/1.1
Host: api.podio.com
Authorization: OAuth2 {access_token}
Content-Type: application/json

{"users":[12346],"role":"regular"}

Response example

HTTP/1.1 204 No Content

• Rate limits: Podio enforces rate limits per API client (client_id). Exceeding limits returns HTTP 420 with a Retry-After header.
• Rate-limit headers: Yes
• Retry-After header: Yes
• Rate-limit notes: HTTP 420 is returned when rate limited. The X-Rate-Limit-Limit and X-Rate-Limit-Remaining headers indicate current quota. Retry-After header specifies seconds to wait. Limits are per OAuth client_id, not per user.
• Pagination method: offset
• Default page size: 20
• Max page size: 100
• Pagination pointer: offset / limit

• Webhooks available: Yes
• Webhook notes: Podio supports webhooks (called 'hooks') that can be registered on organizations, spaces, apps, and items. User-related events are limited; hooks are primarily item/app-centric.
• Alternative event strategy: No dedicated user.created or user.deactivated webhook events are documented. Poll GET /org/{org_id}/member/ for membership changes.
• Webhook events: hook.verify, item.create, item.update, item.delete, comment.create, app.create, app.update, space.create, space.update

• SCIM available: No
• SCIM version: Not documented
• Plan required: Enterprise
• Endpoint: Not documented

Limitations:

• SCIM provisioning is not documented in official Podio developer or help center documentation.
• SSO via SAML is supported (Okta, Entra ID, OneLogin) but automated SCIM user lifecycle management is not confirmed.
• User provisioning must be handled via Podio's native API or manual invitation flows.

Three API scenarios cover the core identity lifecycle for Podio. For org-wide auditing to populate an identity graph, paginate GET /org/{org_id}/member/?

limit=100&offset=0, collecting user_id, status, last_seen_on, profile. name, and role fields; increment offset until the response array length falls below the requested limit.

For offboarding, there is no bulk-remove endpoint - each space requires a discrete DELETE /space/{space_id}/member/{user_id} call before the final DELETE /org/{org_id}/member/{user_id}; confirm removal with a GET that returns 404.

For HR-driven profile sync, PUT /user/profile/ updates profile fields but requires the target user's own OAuth token - an admin cannot update another user's profile on their behalf, making bulk sync impractical without per-user password grant authentication.

Critically, there is no API endpoint to create a net-new Podio account programmatically. User provisioning always requires a UI-initiated email invitation or self-registration, which is a hard constraint for any automated onboarding pipeline.

Audit all members of an organization

1. Obtain an OAuth 2.0 access token using client credentials or password grant for an org admin account.
2. GET https://api.podio.com/org/{org_id}/member/?limit=100&offset=0 to retrieve the first page of members.
3. Increment offset by 100 and repeat until the returned array length is less than the requested limit.
4. Collect user_id, role, profile.name, and status fields from each member object for the audit report.

Watch out for: The authenticated account must be an org admin. Offset-based pagination can miss users added/removed mid-iteration.

Remove a departed employee from all spaces and the organization

1. Identify the user's user_id via GET /org/{org_id}/member/ filtered by email or name.
2. Enumerate spaces via GET /org/{org_id}/space/ and for each space call DELETE /space/{space_id}/member/{user_id} to remove the user.
3. Finally, call DELETE /org/{org_id}/member/{user_id} to remove the user from the organization entirely.
4. Verify removal by attempting GET /org/{org_id}/member/{user_id} and confirming a 404 response.

Watch out for: There is no bulk-remove endpoint; each space removal is a separate API call. Removing from the org does not guarantee immediate space removal in all cases - explicit space removal is recommended first.

Sync user profile updates from an HR system

1. Authenticate as the target user (password grant) or use an admin token with delegated access.
2. PUT https://api.podio.com/user/ with updated fields (locale, timezone) for self-updates.
3. For profile fields (title, location), use PUT /user/profile/ with the relevant profile fields.
4. Handle HTTP 420 rate limit responses by reading the Retry-After header and pausing before retrying.

Watch out for: Podio does not allow an admin to update another user's profile via API on their behalf without that user's OAuth token. Bulk profile sync requires per-user authentication, which is impractical at scale without the password grant flow.

The most significant integration trap is the absence of SCIM. Podio supports SAML 2.0 SSO (Okta, Entra ID, OneLogin) on Premium, but automated user lifecycle management - provisioning, deprovisioning, attribute sync - is not available through any documented SCIM endpoint.

IdP-connected environments cannot rely on standard push provisioning; all lifecycle events must be handled via Podio's native API or manual flows.

For teams building identity graph coverage across their SaaS stack, Podio surfaces last_seen_on and status fields on the user object as the primary signals for detecting stale accounts. Without webhook events for user.created or user.deactivated, the only reliable detection method is polling GET /org/{org_id}/member/ on a schedule, adding latency to any real-time deprovisioning workflow.

The 420 rate limit and offset pagination constraints compound this for orgs with large member counts.