Groups

Add a member to a group

POST/groups/{group_id}/members
groups:writecreate_group_member

Adds a user of your organisations to the group and returns the member with a Location. role is editor or viewer (default viewer) and signatory defaults to false. A user who is already a member with the same role and signatory returns 200 with the existing member and nothing changes; with a different role or signatory it returns 409 conflict, and PATCH /groups/{group_id}/members/{id} changes them. The lead, or a user outside your organisations, returns 422 on user_id. If the group is classified automatically the new member gets its classification. Callers need update rights on the group, as for PATCH /groups/{id}; otherwise 403 missing_permission. dry_run shows the result without saving it. Emits group_member.created and sends no email. DELETE /groups/{group_id}/members/{id} undoes it.

Path parameters

  • group_idstring (uuid)Required#

    The group's id, a uuid. An unknown group, or one your organisations cannot see, returns 404.

Query parameters

  • dry_runboolean#

    Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

  • Idempotency-Keystring#

    Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Request body

application/json, required · GroupMemberCreate

  • user_idstring (uuid)Required#

    A user of your organisations who is not the group's lead.

  • rolestring#

    What the member may do in the group: editor or viewer.

    One of: editor, viewerDefault: "viewer"
  • signatoryboolean#

    Whether the member signs for the group.

    Default: false
{
  "user_id": "1b2c3d4e-5f60-4172-8394-a5b6c7d8e9f0",
  "role": "editor",
  "signatory": true
}

Responses

200

The user was already a member with this role and signatory, and nothing changed.

GroupMember
{
  "data": {
    "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "first_name": "string",
    "last_name": "string",
    "email": "string",
    "role": "editor",
    "signatory": true,
    "created_at": "2026-06-12T10:00:00+00:00",
    "updated_at": "2026-06-12T10:00:00+00:00"
  }
}
201

The member was added.

GroupMember
{
  "data": {
    "id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
    "first_name": "string",
    "last_name": "string",
    "email": "string",
    "role": "editor",
    "signatory": true,
    "created_at": "2026-06-12T10:00:00+00:00",
    "updated_at": "2026-06-12T10:00:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is missing_permission when the caller may not change the group, with the permissions that would allow it in details, or one of missing_scope, scope_disabled, org_disabled, ip_blocked, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
409

The request conflicts with existing state (error.code = conflict), e.g. a compliance flow with the requested name already exists.

Error
422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error
429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/groups/{group_id}/members\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "user_id": "1b2c3d4e-5f60-4172-8394-a5b6c7d8e9f0",
  "role": "editor",
  "signatory": true
}'