Chelabase
ManagementMembers

Make a member a tenant admin, or not

PATCH
/v1/members/{member_id}

A tenant admin manages people and projects and is admin on every project. Demoting one checks what they keep (their own grants, overrides and teams' grants) as any grant is checked. Every branch of the tenant reconciles its member roles.

Authorization

bearer
AuthorizationBearer <token>

In: header

Path Parameters

member_id*string

Member id

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

tenant_admin*boolean

Only an active member may become a tenant admin; the last active tenant admin can't step down.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PATCH "https://example.com/v1/members/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Content-Type: application/json" \  -d '{    "tenant_admin": true  }'
{  "accepted_at": "2019-08-24T14:15:22Z",  "access": {    "level": "tenant_admin",    "projects": [      {        "platform_role": "viewer",        "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9",        "via": "own"      }    ]  },  "created_at": "2019-08-24T14:15:22Z",  "display_name": "string",  "email": "string",  "has_access": true,  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "invite": {    "expires_at": "2019-08-24T14:15:22Z",    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"  },  "status": "invited",  "suspended_at": "2019-08-24T14:15:22Z",  "suspended_by": "c2e368d8-db1b-4e27-8850-4fa018b3a2bc",  "tenant_admin": true}

List the tenant's members GET

Invited, pending, active and suspended members, by email: names and emails, for grant pickers. An invited member carries its open invite; a pending one (signed up, waiting for approval) can be approved or declined. Each member carries `access`: the highest platform role over the projects the caller can see and the member's role on each of those projects (`other`: access only on projects the caller can't see; `none`: no project grant). No Postgres roles or overrides.

Remove a member DELETE

The member's grants, overrides and open invites go, their Postgres member roles are dropped on every branch, their personal logins are revoked (the member is marked offboarded) and realtime drops what they watched, all in this request. When they are an active member of no other tenant, their account's sessions end, and when no other tenant holds them at all (an open invite, a pending sign-up or a suspension counts) the account is banned too. While they are an active member of another tenant the account is left alone (its sessions name the tenant they were made for, and minting a token checks that membership). A still-valid token is refused at once. Every step runs even when one fails; removing a removed member again redoes every step after the removal.