Provision Tenant Member

Required role: admin or higher.

Add a member to the acting tenant by identity, before the user's first login. The membership authorizes on its own: as soon as that identity authenticates through the platform's identity provider, the user may act in this tenant, and a headerless login with exactly this one membership lands in it. The role is capped at the caller's own role and may not be owner.

Request Body — REQUIRED
email string Optional email for display in the member list.
role string — REQUIRED Possible values: [read, write, admin] A role assignable to a tenant member: read, write, or admin. owner is a platform-wide role, not a tenant membership, so it is not a valid value here.
subject string — REQUIRED OIDC subject (matches the JWT sub claim). The issuer is not settable: members authenticate through the platform's single configured issuer, so the grant is keyed to that issuer automatically.

Responses
200 Member added Schema — OPTIONAL user_id uuid Identifier of a persisted user (the principal behind an OIDC sub).
403 Caller's role is below the required role, or the requested role is owner Schema — OPTIONAL details Detailed error metadata. The contents of this field is determined by error_code. error_code string Error code is a string that specifies this error type. message string Human-readable error message.
500 Schema — OPTIONAL details Detailed error metadata. The contents of this field is determined by error_code. error_code string Error code is a string that specifies this error type. message string Human-readable error message.