authorization
Advanced household roles, groups, and membership access administration
List household authorization groups
Requires groups.manage. Groups grant nothing until a roles.manage actor explicitly binds a role to one.
Create an unbound household authorization group
Requires groups.manage and an exact same-origin browser mutation proof. A new group is inert until a separately authorized role binding is added.
Remove a household member from a group
Requires groups.manage and an exact same-origin browser mutation proof. A removal may target a suspended member, allowing access cleanup after suspension.
Add an active household member to a group
Requires groups.manage and an exact same-origin browser mutation proof. Before the add, the group's cumulative permissions must be a subset of the actor's effective permissions.
Remove a role binding from a household group
Requires roles.manage and an exact same-origin browser mutation proof.
Bind a role to a household group
Requires roles.manage and an exact same-origin browser mutation proof. The actor may bind only a role whose complete permission set they already possess.
List the bounded household member directory
Requires members.read. It returns local display names, opaque principal identifiers, and access state only; external identity claims and invitation credentials are never exposed.
Remove a direct role binding from a household member
Requires roles.manage and an exact same-origin browser mutation proof. A removal may target a suspended member, allowing access cleanup after suspension.
Bind a role directly to an active household member
Requires roles.manage and an exact same-origin browser mutation proof. The actor may assign only a role whose complete permission set is already a subset of the actor's effective permissions.
Suspend or reactivate a household member
Requires members.manage and an exact same-origin browser mutation proof. The installation owner is protected from state changes through this endpoint so the break-glass local owner remains active.
List the fixed permission vocabulary for custom roles
Requires roles.manage. The returned codes are application-owned; custom roles cannot introduce a new code that has no server-side enforcement point.
List built-in and household custom roles
Requires roles.manage. Built-in roles are immutable; custom-role permissions remain explicit and local to this household.
Create a household custom role
Requires roles.manage and an exact same-origin browser mutation proof. Every requested permission must be one the acting member already has; built-in roles remain immutable.