Skip to main content

​
Members and invitations

A User is a person, identified by one email address across the platform. A Partner Membership makes a user a member of your partner; one person can be a member of several partners and switches between them in the dashboard.
  • Invite people with POST /partner/v1/members (email, optional groupIds and directPermissions). The invitation email is valid for 7 days; :resend-invitation sends a new link and invalidates the old one.
  • Membership status: invited, active, suspended, removed. :suspend, :unsuspend and :remove change it; removal is final (a new invitation creates a new membership).
  • Members see only their own partner’s data; you never see a person’s other memberships.
  • Membership changes take effect within 60 seconds.
Managing members (manage-members) is dashboard-only; API keys can list members with view-members. Rules that protect the account: nobody can change their own permissions, groups or status (409 self-modification-not-allowed); the last active owner cannot be suspended or removed (409 last-owner); only owners can change the owners and administrators groups or suspend an owner (403 owner-membership-required); and you can grant only permissions you hold.

​
Groups and permissions

A Group carries a list of permissions. A member’s effective permissions are the union of their groups’ permissions and their own direct permissions, limited to what applies to your partner’s roles (effectivePermissions; stored keys that do not apply are listed in inertPermissions).
  • Create custom groups with POST /partner/v1/groups (name, description, permissions, memberIds); change them with PATCH (lists are replaced whole, so read the group right before you change it: when two administrators edit the same list, the last write wins).
  • Group membership is edited on the group (memberIds), not on the member.
  • GET /partner/v1/permissions lists every permission with delegable and applicable; see the permission reference.
Group and member management (manage-groups, manage-members) needs a recent sign-in and cannot be done with API keys.

​
Default groups

Every partner starts with system groups. They cannot be renamed or deleted (409 system-group-immutable); except for owners, their permissions can be edited. Partners that are also consumers get the consumer groups as well.

​
Multi-factor authentication and SSO

  • Multi-factor authentication: set mfaRequired on your partner (dashboard, manage-settings). Members without a second factor (authenticator app or passkey) are asked to enrol; mfaEnrolled on each member shows who has one.
  • Single sign-on: connect your SAML or OIDC identity provider under /partner/v1/sso-connections (dashboard only, manage-sso). Publish the shown TXT record to verify each email domain (:verify), test, then :activate; with enforced members of those domains must sign in through your identity provider. Automatic provisioning can create members on their first sign-in, in a default group.
  • Sensitive operations (API keys, members, groups, IP allowlist, voucher reveal, webhook secrets) need a sign-in within the last 15 minutes.