Approve a refused sign-in by creating its Member
POST /v1/members/sign-in-attempts/approve
| Property | Value |
|---|---|
| Operation | approve_sign_in |
| Group | Members |
| Scope | members:write |
| Route class | control |
| Idempotency | Idempotency-Key accepted: a retry with the same key replays the first answer |
| Audit | Audited identity.member.approve (mutation) |
| Released in | 1.12.0 |
| Phase 0 host | Served (the hosted api pins 1.65.0) |
Creates the Member of the attempt's email with the role, as invited until the next sign-in links it, and removes the attempt; not_found when no attempt has the email, validation_failed when a Member already holds it. From 1.51.0 its invitation lapses 72 hours later, as an invitation's does. From 1.34.0 a write that gives the operator role is refused with forbidden and the one detail operator_role_not_grantable, at path /role, in any Organization but the operator Organization, whoever asks, and there to any caller that does not hold the operator role; a write that keeps the role or takes it away is not a grant. Phase 0 accepts a Member ID token for this route, so an operator signed in to the cockpit makes the write.
Request
Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the members:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.
curl -X POST "$VOCAL_API/v1/members/sign-in-attempts/approve" \
-H "Authorization: Bearer $VOCAL_API_KEY" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{ "email": "<email>", "role": "owner" }'const response = await fetch(`${process.env.VOCAL_API}/v1/members/sign-in-attempts/approve`, {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
'Idempotency-Key': crypto.randomUUID(),
'Content-Type': 'application/json',
},
body: JSON.stringify({
"email": "<email>",
"role": "owner"
}),
});
console.log(response.status, await response.text());import os
import uuid
import requests
response = requests.post(
f"{os.environ['VOCAL_API']}/v1/members/sign-in-attempts/approve",
headers={
"Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
"Idempotency-Key": str(uuid.uuid4()),
},
json={
"email": "<email>",
"role": "owner",
},
)
print(response.status_code, response.text)Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
idempotency-key | header | string | no | A client-chosen key, kept 24 hours per Organization, environment and route. A replay returns the stored response. |
Request body
Content type application/json, required: SignInApproveRequest.
| Field | Type | Required | Description |
|---|---|---|---|
display_name | string | no | A display name. |
email | string | yes | An email address, compared ignoring case. |
role | MemberRole | yes |
Responses
| Status | Content type | Shape | Error codes |
|---|---|---|---|
201 | application/json | Member | |
400 | application/json | ErrorEnvelope | invalid_request |
401 | application/json | ErrorEnvelope | unauthenticated |
403 | application/json | ErrorEnvelope | forbidden, org_suspended |
404 | application/json | ErrorEnvelope | not_found |
409 | application/json | ErrorEnvelope | idempotency_in_progress, idempotency_key_reused |
422 | application/json | ErrorEnvelope | validation_failed |
429 | application/json | ErrorEnvelope | rate_limited |
500 | application/json | ErrorEnvelope | internal_error |
Fields of the 201 answer
The shape is Member.
| Field | Type | Required | Description |
|---|---|---|---|
created_at | Timestamp | yes | |
display_name | string or null | yes | A display name. |
email | string | yes | An email address, compared ignoring case. |
id | MemberId | yes | |
invitation_expires_at | Timestamp or null | no | When the invitation of an invited Member lapses (1.51.0): 72 hours after the invitation or the approval that created it. Null once the Member is active or disabled, and for a Member the seed created; absent from an api before 1.51.0. After it a sign-in with the email is refused with invitation_expired. |
invited_by | MemberId or null | no | The Member who invited or approved this Member (1.51.0), or null when the seed or an operator command created it; absent from an api before 1.51.0. |
last_sign_in_at | Timestamp or null | yes | The last sign-in, or null before the first. |
object | "member" | yes | |
revision | integer | yes | Counts writes to the Member; returned as the ETag and required in If-Match. |
role | MemberRole | yes | |
status | MemberStatus | yes | |
updated_at | Timestamp | yes |