List the tenant's members
Invited, pending, active and suspended members, by email: names and emails, for grant pickers. An invited member carries its open invite; a pending one (signed up, waiting for approval) can be approved or declined. Each member carries access: the highest platform role over the projects the caller can see and the member's role on each of those projects (other: access only on projects the caller can't see; none: no project grant). No Postgres roles or overrides.
Authorization
bearer In: header
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/members"[ { "accepted_at": "2019-08-24T14:15:22Z", "access": { "level": "tenant_admin", "projects": [ { "platform_role": "viewer", "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9", "via": "own" } ] }, "created_at": "2019-08-24T14:15:22Z", "display_name": "string", "email": "string", "has_access": true, "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "invite": { "expires_at": "2019-08-24T14:15:22Z", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08" }, "status": "invited", "suspended_at": "2019-08-24T14:15:22Z", "suspended_by": "c2e368d8-db1b-4e27-8850-4fa018b3a2bc", "tenant_admin": true }]Send an invite again POST
A new code is mailed (the old one stops working; an account with a password and a verified email gets the notice again instead), or with `delivery: "link"` (only for an invitee with no password and an unverified email whom no other tenant holds; others get 409 `link_not_allowed`) the response carries the new link as `invite_url` (once, `Cache-Control: no-store`, never stored or logged); either way the link's token changes and the invite lives another 72 hours. An expired invite can be resent. At most 5 sends per person per hour, the first invite included (429 `rate_limited`). The body may be left out (then `email`).
Make a member a tenant admin, or not PATCH
A tenant admin manages people and projects and is admin on every project. Demoting one checks what they keep (their own grants, overrides and teams' grants) as any grant is checked. Every branch of the tenant reconciles its member roles.