Memberships

Memberships link users to organizations. Each membership carries a role that your app can use for authorization logic.

For human onboarding, prefer Email Invitations over directly creating a user and assigning a password. Invitations are email-bound, expiring, one-time links that create or activate membership only after the invited identity is verified.

Create a membership#

SDK:

var membership = await adminService.CreateMembershipAsync(
    org.Id,
    new SqlOSCreateMembershipRequest(
        UserId: user.Id,
        Role: "admin"));

Admin API:

curl -X POST http://localhost:5062/sqlos/admin/auth/api/memberships \
  -b "$SQLOS_DASHBOARD_COOKIE_JAR" \
  -H "Content-Type: application/json" \
  -d '{"organizationId": "org_...", "userId": "usr_...", "role": "admin"}'

The Admin API requires an operator session; see Authenticate operator API calls.

Check membership#

bool isMember = await adminService.UserHasMembershipAsync(userId, organizationId, ct);

The check returns true only when the user, organization, and membership are all active. Organization selection excludes inactive organizations.

An inactive membership is an offboarding state. SqlOS rejects organization-scoped authorization codes, refreshes, AuthPage reuse, SAML callbacks, and stateful access-token validation for that membership. SAML JIT provisioning can create a genuinely missing membership, but it does not reactivate an existing inactive membership; use an explicit invitation or trusted admin workflow to restore access.

List user organizations#

var orgs = await adminService.GetUserOrganizationsAsync(userId, ct);

Syncing to FGA#

When using FGA, membership roles can be mapped to explicit FGA grants. Use Turn AuthServer memberships into FGA access for role upgrade, downgrade, removal, organization switching, and cross-tenant guidance. Syncing Auth to FGA is the shorter API reference.

Invite a member#

var invite = await authService.CreateEmailInvitationAsync(
    new SqlOSCreateEmailInvitationRequest(
        OrganizationId: org.Id,
        Email: "teammate@example.com",
        Role: "member"),
    httpContext,
    ct);

When the teammate accepts the invite, SqlOS creates or reactivates the membership. Existing active memberships are accepted idempotently and are not downgraded.