Skip to main content

Team Members

Invite people to your organization. They sign in through Cognito and, once they accept the invitation in the dashboard, get the roles it carries. Nothing is granted until the invitee accepts.

How it works​

Inviting​

cURL

curl -X POST https://api.wardenauthz.com/v1/scope/workspace-eng/team-members \
  -H "x-api-key: YOUR_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "email": "alice@example.com", "name": "Alice", "roleIds": ["viewer"] }'

The member's status is pending until they accept. Requires team-member:add.

A scope can have at most 25 pending invitations, and one per email address.

Accepting or declining​

Invitations are never accepted automatically at sign-in. The invitee sees their pending invitations in the dashboard and chooses Join or Decline. A new user who joins this way gets your organization as their organization; they don't need to create their own.

Resending an invitation​

If the invite email failed or got lost (the dashboard marks a failed send as Email not sent), send it again:

curl -X POST https://api.wardenauthz.com/v1/scope/workspace-eng/team-members/pending-invite-123/resend-invite \
  -H "x-api-key: YOUR_MANAGEMENT_KEY"

Each invitation can be sent at most 5 times, at least 10 minutes apart; beyond that the endpoint answers 429. Requires team-member:add.

Removing​

curl -X DELETE https://api.wardenauthz.com/v1/scope/workspace-eng/team-members/subject-alice \
  -H "x-api-key: YOUR_MANAGEMENT_KEY"

Removes the member and their access policy. Their Cognito account is not deleted — only membership in this scope is revoked. Requires team-member:remove.