---
title: "Connect a member to their Microsoft or Slack account"
method: POST
path: "/v1/members/{membership_id}/identity-assertion"
tags: ["members"]
---

# Connect a member to their Microsoft or Slack account

`POST /v1/members/{membership_id}/identity-assertion`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/members/{membership_id}/identity-assertion`
- Auth: HTTP bearer

Record that this member is a Microsoft Teams or Slack teammate Patricia has already seen, so their approvals carry their role. Use it for someone who will not sign in to the dashboard themselves; anyone who does can connect their own account from Settings. The body accepts a provider field that defaults to microsoft; send slack for a Slack teammate.

## Path parameters

- `membership_id` string, uuid, required

## Headers

- `X-Tenant-Id` string, nullable

## Request body

- IdentityAssertionBody: POST /members/{id}/identity-assertion request body. The chat teammate, by Patricia's own actor id, never by a directory id typed in by hand: the object id is read off that row rather than taken from a request body. The row alone does not establish that a provider ever saw the teammate, because actors are creatable through the generic CRUD surface. What each service does about that is its own ``_observation_evidence`` (:func:`services.identity_binding.microsoft_link._observation_evidence`, :func:`services.identity_binding.slack_link._observation_evidence`). ``provider`` selects which assertion service the route calls. It defaults to microsoft, so an omitted field keeps the Microsoft rung; ``slack`` reaches the Slack one.
  - `actor_id` string, uuid, required: The chat teammate this member is, as listed by GET /v1/actors.
  - `provider` 'microsoft' | 'slack': Which chat platform the teammate is on. Defaults to microsoft, so an omitted value keeps the Microsoft assertion. Send slack to connect a Slack teammate.

## Response `200`

Successful Response

- IdentityAssertionResult: What the assertion established. Ids only — no addresses and no directory object id.
  - `membership_id` string, uuid, required
  - `actor_id` string, uuid, required
  - `identity_id` string, uuid, required
  - `directory_id` string, required
  - `created` boolean, required
  - `awaiting_email_confirmation` boolean, required: True when this member has not confirmed their own email address. The connection is written and correct either way, and it grants no role in chat until they confirm. Reported on a repeat assertion as well as on a new one, because it describes the member's address rather than this call.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden. Inspect response body `code` for the specific reason (for example: PERMISSION_DENIED, EMAIL_NOT_VERIFIED, TENANT_ACCESS_REQUIRED, ROLE_UNRESOLVED)
- `404`: Not found
- `409`: Conflict
- `422`: Validation error

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)