Skip to main content
POST
Add a team member

Authorizations

Authorization
string
header
required

OAuth 2.1 authorization code + PKCE (S256). Tokens are tenant-bound (company_id) and scoped. Discover endpoints via /.well-known/oauth-authorization-server.

Body

application/json

Add a user to the company's team. companyId is injected from the token tenant and must NOT be supplied. Required (validated in the use-case): userId, email. Source: lib/api/team/add-member.usecase.ts + add_team_member call.body. The route zod (AddMemberInput) is .passthrough(). When role is Admin/Owner the platform forces full permissions.

userId
string
required

User id of the member to add.

Minimum string length: 1
email
string<email>
required

Email address of the user to add.

role
enum<string>

Role to grant (defaults to Employee).

Available options:
Owner,
Admin,
Employee
inviteId
string

Invite id when joining via self-registration (required when userId equals the caller's own id).

permissions
object

Team permissions share the public capability scope vocabulary. When scopes is present it is the exact grant, including an empty array for no access, and the boolean fields are compatibility projections. Owners always retain full access. Admin and Employee grants can be customized. Omitting scopes retains the legacy permission behavior. A caller cannot grant more access than they hold.

emailPreferences
object

Per-member email-notification preferences. Source: lib/team-email-preferences.ts TEAM_EMAIL_PREFERENCE_KEYS + normalizeTeamEmailPreferences (always returns the closed key set).

Response

Add-member success ({ success: true }).

data
object
required

Add-member result. Source: addTeamMember returns { success: true } (lib/api/team/add-member.usecase.ts).