Groups
Teams mirrored from your identity provider, used to grant roles to many people at once.
List groups
Returns the groups mirrored from your identity provider, paginated. Groups are how access follows joining and leaving a team without anyone editing a user. Requires `group.read`.
Update a group
Changes a group's own fields. Membership is managed in the identity provider and mirrored here, not edited directly. Requires `group.update`.
Delete a group
Soft-deletes a group. Its members lose the roles they held through it on their next request, and it can be restored. Requires `group.delete`.
Get a group
Returns one group with the roles attached to it. Membership is a separate call. Returns 404 if the group does not exist, has been deleted, or belongs to another tenant — the three are indistinguishable by design, so one tenant cannot probe another's identifiers. Requires `group.read`.
Restore a deleted group
Reinstates a soft-deleted group together with its role bindings. Requires `group.restore`.
Add a member to a group
Adds a user to the group. They gain the roles bound to it on their next request. Requires `group.member.add`.
List a group's members
Returns the users in this group. Read it before changing the group's roles — this is who the change reaches. Requires `group.member.read`.
Remove a member from a group
Removes a user from the group. They lose the roles they held through it, unless they also hold them directly — effective permissions are the union of both. Requires `group.member.remove`.
List a group's roles
Returns the roles bound to this group. Every member inherits every permission these roles carry. Requires `group.role.read`.
Bind a role to a group
Grants a role to everyone in the group, now and in future. This is the arrangement to prefer over granting the role to each person. Requires `group.role.assign`.
Unbind a role from a group
Removes a role from the group. Members lose it unless they hold it directly. Requires `group.role.revoke`.