Provision Tenant Member

Required role: admin or higher.

Add a member to the acting tenant by identity, before the user's first login. The grant is dormant until that identity authenticates into the tenant through the IdP. The role is capped at the caller's own role and may not be owner.

Request Body — REQUIRED
email string Optional email for display in the member list.
role string — REQUIRED Possible values: [read, write, admin] A role assignable to a tenant member: read, write, or admin. owner is a platform-wide role, not a tenant membership, so it is not a valid value here.
subject string — REQUIRED OIDC subject (matches the JWT sub claim). The issuer is not settable: members authenticate through the platform's single configured issuer, so the grant is keyed to that issuer automatically.

Responses
200 Member added Schema — OPTIONAL user_id uuid Identifier of a persisted user (the principal behind an OIDC sub).
403 Caller's role is below the required role, or the requested role is owner Schema — OPTIONAL details Detailed error metadata. The contents of this field is determined by error_code. error_code string Error code is a string that specifies this error type. message string Human-readable error message.
500 Schema — OPTIONAL details Detailed error metadata. The contents of this field is determined by error_code. error_code string Error code is a string that specifies this error type. message string Human-readable error message.