Team and members
Not in
openapi.json. These routes belong to the sign-in module (src/ResilientLang.Identity, prefix/identity). They are used by the dashboard, are authenticated by a signed-in session cookie and not by secret API keys, so they will not appear in the key-based OpenAPI file. Source:docs/work/WP-32.md; a test checks the routes against the source.
Conventions#
- JSON,
Cache-Control: no-store. - Every
POST,PATCHandDELETEneeds the anti-forgery header. CallGET /identity/csrfto get{ headerName, token }, then send the token in that header and keep the cookie. - The team is always the session's active tenant; nothing tenant-related goes in the body or URL.
- Managing the team needs the Admin or Owner role with two-factor sign-in set up.
- Support (impersonation) sessions are read-only:
PATCHandDELETEare refused,GETis allowed.
Roles#
owner, admin, editor, viewer. Admins grant and manage only editors and viewers. Only an Owner grants owner or admin, or touches an Owner. Nobody changes their own role. The last Owner can be neither demoted nor removed.
Invitations#
| Route | Who | Request | Success |
|---|---|---|---|
POST /identity/invitations | Admin or Owner | { "email", "role" } | 201 { id, email, role, expiresAt }. The mail goes out separately; the token is never in the response. Re-inviting an address replaces its pending invitation |
GET /identity/invitations | Admin or Owner | none | 200 list of pending invitations (no tokens) |
DELETE /identity/invitations/{id} | Admin or Owner | none | 204; 404 if unknown, used or another tenant's |
POST /identity/invitations/accept | any signed-in user | { "token" } | 204. The same 400 text is returned for an unknown, used, expired or wrong-address token. After 5 failures in 15 minutes: 429 |
Members#
| Route | Request | Success |
|---|---|---|
GET /identity/members | none | 200 list: userId, displayName, email, role, joinedAt, status (active or disabled), twoFactor, lastSignInAt, you |
PATCH /identity/members/{userId} | { "role" } | 200 { userId, role }; takes effect on the person's next request |
DELETE /identity/members/{userId} | none | 204; their sessions in this team end at once |
Failures use 400, 401, 403, 404 and 409 (last Owner). Role changes, removals and invitations are written to the audit log without e-mail addresses.