Invite a member

post

https://api.qfp.quantnetwork.net/api/tenants/{id}/users

Creates a user inside the caller's own tenant and sends them a Cognito
invitation email. The path tenant must equal the caller's tenant_id
claim; a mismatch is 403 Invalid tenant id.

The permission required depends on the role being granted:

`roleName`	permission
`SUPER_ADMIN`	`super_admin:create`
`ADMIN`	`admin:create`
`USER`, or omitted	`user:create`
a custom role of this tenant	`user:create`, plus every permission the role grants

Platform role names match case-insensitively; any other name is looked
up as a custom role of the path tenant (404 Role {name} not found
when it matches nothing), and a custom role may not grant a permission
the caller does not hold. A blank or absent roleName means USER.

The new user starts INVITED and cannot sign in until they set their
own password through POST /api/auth/activate or
POST /api/auth/new-password. The Cognito account is created first
and its sub becomes the platform user id. tenantId in the body is
ignored. Returns 200, not 201.

Path Params

uuid

required

The tenant. Must equal the caller's tenant_id claim; a mismatch is
403 Invalid tenant id.

Body Params

The user to create. These fields are not validated up front, so an
absent or malformed value is not rejected here; the email uniqueness
check, the role lookup and Cognito decide.

firstName

string

lastName

string

Unique across all tenants, and the Cognito username. The
invitation email is sent here.

roleName

string

A platform role (SUPER_ADMIN, ADMIN, USER, matched
case-insensitively) or the name of a custom role belonging to the
tenant in the path. Blank or absent is treated as USER; a name
that is neither is 404. Overwritten with SUPER_ADMIN on
POST /api/tenants, which has no custom roles yet.

tenantId

uuid

Accepted by the schema and ignored. The tenant comes from the path
and the token, or is the tenant being created.

Headers

API-Version

string

required

^\d+\.\d+\.\d+$

The version of the Quant Flow API the request follows, as major.minor.patch (for example 1.0.0). The request is interpreted, and the response shaped, according to that version.

Responses

Language

Credentials

Bearer

JWT

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200The created member, status INVITED.

400The request body or parameters failed validation. A field violation reads Invalid Request parameter. {field}; unreadable JSON reads Malformed JSON request.

401No usable token, or the caller's own row exists with a status other than ACTIVE (Your access has been revoked.).

404roleName is not one of the three known roles, the role row is missing, or no tenant with this id exists.

409A user with this email already exists.

500The Cognito account could not be created.