User
A user is a person's identity in Perpetual, identified by a unique email.
Its id is prefixed USR_.
A user exists outside any single organization. The identity
is global, keyed on email. A user reaches an organization through a
membership, and one user can belong to several organizations at
once. A user holds one defaultOrganizationId, the organization a session opens
in when none is named. A user's capability inside an organization comes from
their roles.
Current user
The authenticated user reads and edits their own account through a dedicated endpoint (in the web app, the account and organization switcher). The current user returns every field in Outputs below plus the organizations they can act in.
| Field | Type | Description |
|---|---|---|
allOrganizations | array<object> | Every organization the user is a member of. Each entry has id and name. |
A user can change their own displayName and defaultOrganizationId. Changing
email, superuser, or another user is a superuser action.
Membership
A membership is the binding that places a user in an organization. It is the only path from a user to an organization and anything the organization contains. A user with no membership in an organization cannot reach it.
A membership identifies the user by id, displayName, and email. What the
membership grants comes from the roles assigned to it. A membership
with no roles can reach the organization but gains nothing inside it.
An organization owner manages memberships from the organization side (in the web app, on the organization's members settings): adding a user as a member, assigning that member's roles, and removing the member. Removing a membership revokes the user's access to that organization without deleting the user identity, which remains and keeps its other memberships.
Inputs
The fields the caller provides on create or update.
| Field | Type | Required | Description |
|---|---|---|---|
displayName | string | Required | The user's display name. |
email | string | Required | The user's email address. Unique across the whole platform. Used to sign in. |
password | string | Required | The user's password. At least 8 characters. Never returned. |
defaultOrganizationId | string | Optional | The organization a session opens in when none is named, prefixed ORG_. Null when none is set. |
superuser | boolean | Optional | Whether the user is a Perpetual superuser with platform-wide administrative access. Defaults to false. Setting this field is a superuser action. Creating a user at all is too. |
Outputs
The API returns every Inputs field above (except password, which
is never returned) plus the common resource fields.
Related
- Organizations. The tenant a user joins through a membership.
- Roles. What a membership grants a user inside an organization.
- Spaces. The access-controlled namespaces a role grants a user access to.