Add a member to this organization.
Send permission_set plus optional permission_added / permission_removed
overrides; the server resolves them and returns the effective grants in
permissions. The older flat permissions array still works and is read as
permission_added against no set. The address is trimmed and lowercased.
Accounts are global, membership is per-organization: inviting someone who
already has an account elsewhere reuses it, so a 409 means they are already a
member here — error is user_exists, or user_disabled if the account is
disabled globally and should be re-enabled instead. Being added does not by
itself guarantee sign-in: the organization’s allowed_sign_ins list is
applied separately, at sign-in. The welcome email is best-effort — the member
exists even if it fails to send.
Authorizations
A scoped AgentEye API key. Mint one in the dashboard under Settings → API keys, or with POST /v1/keys. Each endpoint names the permission it requires; a key without it gets 403 and a required_permission field naming what was missing.
Body
Grants added on top of the set.
Grants removed from the set.
New shape: name of the permission set this user is linked to.
Legacy shape: explicit permission list. When set, it's treated as
permission_added against no set. The dashboard's new code path
sends permission_set + permission_added + permission_removed
instead; this field exists only for backwards compatibility with
callers that haven't been upgraded.
Response
Member added, with their resolved permissions.