Team & RBAC

Each tenant has a team of users with role-based access control (RBAC). Users can belong to multiple tenants.

List members

GET /v1/team/members
Authorization: Bearer <token>

Response

[
  {
    "id": "...",
    "tenant_id": "...",
    "user_id": "...",
    "role_id": "00000000-0000-0000-0000-000000000001",
    "joined_at": "2026-03-26T12:00:00Z",
    "email": "alice@example.com",
    "display_name": "Alice Martin",
    "role_name": "owner"
  }
]

Invite a member

POST /v1/team/invite
Authorization: Bearer <token>

Permission required: members:invite

Request body

Field	Type	Required	Description
`email`	string	Yes	Email to invite
`role_id`	string (UUID)	Yes	Role to assign (cannot be `owner`)

Invitations are subject to the tenant’s member limit.

Response

Returns an invitation with a token for the accept link.

Remove a member

DELETE /v1/team/members/:user_id
Authorization: Bearer <token>

Permission required: members:remove

Cannot remove yourself or the tenant owner.

Update member role

PATCH /v1/team/members/:user_id/role
Authorization: Bearer <token>

Permission required: members:update_role

Request body

{ "role_id": "00000000-0000-0000-0000-000000000003" }

Cannot change the owner’s role or assign the owner role.

List roles

GET /v1/roles
Authorization: Bearer <token>

Returns built-in system roles plus any custom roles for the tenant.

Get role permissions

GET /v1/roles/:role_id/permissions
Authorization: Bearer <token>

Response

["credentials:issue", "credentials:verify", "dids:list", "..."]

Create custom role

POST /v1/roles
Authorization: Bearer <token>

Permission required: roles:manage

Request body

{
  "name": "auditor",
  "description": "Read-only compliance access",
  "permissions": ["compliance:report", "compliance:audit", "credentials:list"]
}

Built-in roles

Role	Description	Key permissions
owner	Full tenant control	All 25 permissions including `tenant:manage`, `tenant:delete`
admin	Manage members and operations	All except `tenant:delete`
member	Issue, verify, manage credentials	Credentials, DIDs, DIDComm, compliance, trust, usage
viewer	Read-only access	`credentials:verify`, `credentials:list`, `dids:list`, `compliance:report/audit`, `trust:query`, `usage:view`
api-only	Programmatic operations	Credentials, DIDs, DIDComm, compliance, trust (no member management)

All permissions

Permission	Description
`tenant:manage`	Manage tenant settings, billing, domains
`tenant:delete`	Delete the tenant
`members:invite`	Invite new team members
`members:remove`	Remove team members
`members:update_role`	Change member roles
`roles:manage`	Create/edit custom roles
`api_keys:create`	Create API keys
`api_keys:revoke`	Revoke API keys
`credentials:issue`	Issue credentials
`credentials:verify`	Verify credentials
`credentials:revoke`	Revoke credentials
`credentials:list`	List/view credentials
`dids:create`	Create DIDs
`dids:list`	List/resolve DIDs
`dids:deactivate`	Deactivate DIDs
`didcomm:send`	Send DIDComm messages
`didcomm:receive`	Receive DIDComm messages
`compliance:report`	Generate compliance reports
`compliance:consent`	Manage consent records
`compliance:audit`	Query audit trail
`trust:attest`	Add trust attestations, create delegations
`trust:query`	Query trust scores, verify delegations
`webhooks:manage`	Manage webhooks
`usage:view`	View usage and billing