---
title: "Add Member"
method: POST
path: "/api/folders/{domain_ref}/members"
tags: ["domains"]
---

# Add Member

`POST /api/folders/{domain_ref}/members`

## Request

- Base URL: `https://app.thinqos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.thinqos.com/api/folders/{domain_ref}/members`
- Auth: none declared

Add a person, an agent or an organization to a folder. Admin-only.

The principal may be an ORGANIZATION (TOS-4113 Lane C). An organization is
an identity whose id is its tenant id, so the row this writes needs no new
shape, and ``services/access/domain_reach`` carries every active member of
that organization into this folder at the granted role.

Two conditions, and the second is the new one:

* the caller is a direct ``admin`` of this folder, exactly as for a person;
* when the principal is an organization, the caller either belongs to it or
  it has opted into the directory. See :func:`_may_grant_to_organization`.

The second condition exists because an organization identity is
deliberately unfindable by ordinary means (migration 1066 mints it with
``discoverable_by_username`` and ``discoverable_by_email`` both false), so
"anyone active" (the rule for a person) would authorize handing a company
the contents of a folder by pasting a UUID, with no surface that could have
shown the admin whose company it was. The two conditions are exactly the two
ways an organization can legitimately be on a caller's screen:
``GET /api/me/organizations`` and the directory.

## Path parameters

- `domain_ref` string, required

## Headers

- `x-impersonate-identity-id` string, nullable

## Request body

- AddMemberRequest
  - `identity_id` string, uuid, required
  - `role` string, required

## Response `201`

Successful Response

- MemberResponse
  - `id` string, uuid, required
  - `library_id` string, uuid, required
  - `identity_id` string, uuid, required
  - `identity_display_name` string, required
  - `identity_email` string, nullable, required
  - `identity_avatar_url` string, nullable, required
  - `identity_kind` string, required
  - `role` string, required
  - `trust_mode` string, required
  - `is_active` boolean, required
  - `learns_from_library` boolean, required
  - `learned_document_count` integer, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/thinqos/apis/thinqos-api.md) · [All operations](https://skmtc.dev/thinqos/apis/thinqos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinqos/apis/thinqos-api/revisions/ce2c2ce318b1?raw)