AIR Memberships

List members of the current org and invite new ones by email. Invites pre-create user + principal records when needed; the invitee logs in via email OTP — no password setup is required because the platform is invite-only. Owner/admin of a scope (or any ancestor up to the org root) may add existing members to sub-scopes, change roles, remove members, re-send invites, and change member emails.

📄️List org members

Returns all memberships for the caller's current org. Requires a user actor; service-account API keys are rejected with 403.

📄️List domain members

Returns memberships for the given `domainPid`. Requires a user actor with read access to the domain; returns 404 when the domain is unknown or not visible to the caller.

📄️List project members

Returns memberships for the given `projectPid`. Requires a user actor with read access to the project; returns 404 when the project is unknown or not visible to the caller.

📄️Invite member by email

Adds a user to the caller's org by email, provisioning user and principal records when needed. Dispatches an org-invite email; the invitee signs in via email OTP. Requires a trusted browser origin, org owner/admin role, and an active billing seat. Returns 422 `already_member` when the email is already in this org (the only client-visible invite failure — unknown emails are provisioned silently). Returns 403 when seat limits or billing block the invite.

📄️Get caller access for a scope

Returns whether the caller can manage or contribute in the given `scopeKind`/`scopePid`, plus their effective management role when present. Requires a user actor; returns 404 when the scope is unknown or not visible.

📄️Add existing member to domain or project

Grants an existing org member access to a `domain` or `project` sub-scope via `principalPid` and `role`. Org membership is created only through `invite`. Requires a trusted origin and owner/admin of the scope (or an ancestor). Returns 422 when the principal is not an org member, is already in the scope, is a service account, or the mutation would remove the last owner.

📄️Update member role in scope

Changes the `role` of `memberPid` within the path scope. Requires a trusted origin and scope owner/admin; admins cannot grant, modify, or remove owner-level membership. Returns 404 when the membership is not in the scope; returns 422 on owner-ceiling or last-owner violations.

📄️Remove member from scope

Revokes `memberPid` from the path scope. Requires a trusted origin and scope owner/admin; admins cannot remove owners. Returns 404 when the membership is not in the scope; returns 422 when removing the last owner.

📄️Resend invite email to scope member

Re-dispatches the org-invite email for `memberPid` bound to the path scope (prevents cross-scope invite by pid). Requires a trusted origin and scope owner/admin. Returns 404 when the member is not in the scope.

📄️Change member login email

Updates the login email for `memberPid` in the path scope, cascading to credentials and forcing re-login. Requires a trusted origin and scope owner/admin; admins cannot change an owner's email. Returns 409 when the new email is already in use; returns 404 when the member is not in the scope.