> ## Documentation Index
> Fetch the complete documentation index at: https://docs-provider.voucher.allride.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Members and groups

> People in your partner, their groups and permissions.

## Members and invitations

A **User** is a person, identified by one email address across the platform. A **Partner Membership** makes a user a member of your partner; one person can be a member of several partners and switches between them in the dashboard.

* Invite people with `POST /partner/v1/members` (`email`, optional `groupIds` and `directPermissions`). The invitation email is valid for **7 days**; `:resend-invitation` sends a new link and invalidates the old one.
* Membership `status`: `invited`, `active`, `suspended`, `removed`. `:suspend`, `:unsuspend` and `:remove` change it; removal is final (a new invitation creates a new membership).
* Members see only their own partner's data; you never see a person's other memberships.
* Membership changes take effect within 60 seconds.

Managing members (`manage-members`) is dashboard-only; API keys can list members with `view-members`. Rules that protect the account: nobody can change their own permissions, groups or status (409 `self-modification-not-allowed`); the last active owner cannot be suspended or removed (409 `last-owner`); only owners can change the `owners` and `administrators` groups or suspend an owner (403 `owner-membership-required`); and you can grant only permissions you hold.

## Groups and permissions

A **Group** carries a list of permissions. A member's **effective permissions** are the union of their groups' permissions and their own direct permissions, limited to what applies to your partner's roles (`effectivePermissions`; stored keys that do not apply are listed in `inertPermissions`).

* Create custom groups with `POST /partner/v1/groups` (`name`, `description`, `permissions`, `memberIds`); change them with `PATCH` (lists are replaced whole, so read the group right before you change it: when two administrators edit the same list, the last write wins).
* Group membership is edited on the group (`memberIds`), not on the member.
* `GET /partner/v1/permissions` lists every permission with `delegable` and `applicable`; see the [permission reference](https://docs-provider.voucher.allride.io/guides/permissions.md#permission-reference).

Group and member management (`manage-groups`, `manage-members`) needs a recent sign-in and cannot be done with API keys.

## Default groups

Every partner starts with system groups. They cannot be renamed or deleted (409 `system-group-immutable`); except for `owners`, their permissions can be edited.

| Group | Permissions |
| - | - |
| `owners` | All permissions that apply to your partner (fixed) |
| `administrators` | All except `manage-sso` and `request-api-access` |
| `developers` | `view-profile`, `view-audit`, `request-api-access`, API keys, webhooks and delivery log, IP allowlist, plus every applicable `view-*` permission |
| `voucher-managers` | `view-profile` and every provider permission except `reveal-provider-vouchers` |
| `viewers` | Every applicable `view-*` permission except `view-api-keys`, including the statistics |

Partners that are also consumers get the consumer groups as well.

## Multi-factor authentication and SSO

* **Multi-factor authentication**: set `mfaRequired` on your partner (dashboard, `manage-settings`). Members without a second factor (authenticator app or passkey) are asked to enrol; `mfaEnrolled` on each member shows who has one.
* **Single sign-on**: connect your SAML or OIDC identity provider under `/partner/v1/sso-connections` (dashboard only, `manage-sso`). Publish the shown TXT record to verify each email domain (`:verify`), test, then `:activate`; with `enforced` members of those domains must sign in through your identity provider. Automatic provisioning can create members on their first sign-in, in a default group.
* Sensitive operations (API keys, members, groups, IP allowlist, voucher reveal, webhook secrets) need a sign-in within the last 15 minutes.

## Related

* [Permissions and scopes](https://docs-provider.voucher.allride.io/guides/permissions.md)
* [Audit log](https://docs-provider.voucher.allride.io/workspace/audit-log.md)
* [API keys](https://docs-provider.voucher.allride.io/guides/api-keys.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.