BUILD

Members and invitations

Manage tenant-bound membership lifecycle with authenticated administrative controls.

GET/api/organizations/{id}/members

List tenant-bound members

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/members'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

membership

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

PATCH/api/organizations/{id}/members/{member_id}

Update a member role or status

This operation is part of the public Lucion Identity contract.

Safe request

curl -X PATCH 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/members/{member_id}'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

admin + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

DELETE/api/organizations/{id}/members/{member_id}

Revoke a membership without deleting the user

This operation is part of the public Lucion Identity contract.

Safe request

curl -X DELETE 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/members/{member_id}'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

admin + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/organizations/{id}/invitations

List tenant-bound invitations

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/invitations'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

admin

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/organizations/{id}/invitations

Create an organization invitation

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/invitations'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

admin + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/organizations/{id}/invitations/{invitation_id}

Resend an organization invitation

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/invitations/{invitation_id}'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

admin + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

DELETE/api/organizations/{id}/invitations/{invitation_id}

Revoke an organization invitation

This operation is part of the public Lucion Identity contract.

Safe request

curl -X DELETE 'https://identity.lucionglobal.com/api/organizations/YOUR_ID/invitations/{invitation_id}'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

admin + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/organizations/invitations/accept

Accept an invitation

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/organizations/invitations/accept'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

Invitation boundary

Invitation tokens are stored as hashes.
Acceptance requires the authenticated email to match the invited email.
Acceptance does not issue a session.
Administrative mutations require exact Origin, CSRF proof, recent passkey step-up, and Owner/Admin or explicit permission.