Platform

Provision Tenant Member

Required role: admin or higher.

Add a member to the acting tenant by identity, before the user's first login. The membership authorizes on its own: as soon as that identity authenticates through the platform's identity provider, the user may act in this tenant, and a headerless login with exactly this one membership lands in it. The role is capped at the caller's own role and may not be owner.

post/v0/tenant/users

Request

  • The document declares no server URL.
  • Auth: HTTP bearer

Request body

emailstring nullable

Optional email for display in the member list.

role'read' | 'write' | 'admin' required

A role assignable to a tenant member: read, write, or admin. owner is a platform-wide role, not a tenant membership, so it is not a valid value here.

subjectstring required

OIDC subject (matches the JWT sub claim). The issuer is not settable: members authenticate through the platform's single configured issuer, so the grant is keyed to that issuer automatically.

Example request

{
  "subject": "user@acme.com"
}

Response

Member added

user_idstring uuid required

Identifier of a persisted user (the principal behind an OIDC sub).

Changes

No recorded changes to this operation across all 51 revisions of this API.