display_name string — OPTIONALThe member's name, as the identity provider spells it; null until the
provider has been asked. |
email string — OPTIONALEmail, if the identity provider supplied one or an administrator
recorded one when pre-provisioning the membership. |
email_verified boolean — OPTIONALWhether the identity provider vouches for email. False until the
provider has been asked, and for providers that say nothing either way.
An email an administrator typed is never verified, so this is what
separates an address the provider stands behind from a claim about one. |
origin string — OPTIONALPossible values: [claim, derived, api] How a membership row came into existence, kept for audit. |
provider stringOIDC issuer the user authenticates through. |
role stringPossible values: [read, write, admin, owner] A role in the RBAC model. Declaration order defines the privilege order. |
subject string |
user_id uuidIdentifier of a persisted user (the principal behind an OIDC sub). |