Add members to a group
POST/groups/:groupName/members
Adds users to a group.
This grants AWS access, immediately. Everyone added inherits every
permission set already assigned to the group, in every account those
assignments cover, with no further approval step and no notification to
anyone. Read GET /groups/{groupName}/assignments before you add
someone.
Identify users by their directory username, not their email address. An email matches no user, and because this operation reports nothing about individual names the mistake surfaces only as a 500.
The response echoes your request, not the result. usersAdded is the
array you sent, returned verbatim, and count is its length. Neither
says which adds actually happened. Confirm with
GET /groups/{groupName}/members.
The operation is not atomic. Users are added one at a time and the failures are collected and reported together at the end, so a 500 can mean some were added and some were not. Re-sending the whole list is the usual way to recover.
A group name that matches nothing is a 500 here, not a 404, unlike
GET on the same path.
A body of {} or {"users": null} is accepted rather than rejected:
nothing is added and the response is a 200 with usersAdded: null and
count: 0.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 500
The request was processed. Every name you sent is echoed back whether or not it was added; see the note above.
The request body was missing or was not valid JSON. Nothing was added.
Authentication failed: the X-API-Token header was missing, malformed,
expired or not recognised.
This response is text/plain, not JSON. It is written by
http.Error in the authentication middleware, which runs before any
handler and therefore before anything that would build a JSON envelope.
A client that unconditionally JSON-parses response bodies will fail on
this one, so check the status code first.
The token is valid, but it is not allowed to act on this tenant.
An API token is minted inside one tenant and stays bound to it for life.
Sending it to a path whose tenant segment names a different tenant is
refused here, in middleware, before the operation runs, so this says
nothing about the resource you asked for, only about which tenant the
path named. Check the tenant server variable against the console the
token was created in.
No tenant matches the tenant segment of the request path. A group that does not exist is not reported here; that is a 500.
One or more users could not be added. This single status covers a
group that does not exist, a username that matches no user, and a
failure in the directory itself. Read error to tell them apart;
where individual users failed it names each one. Some of the other
users may have been added; the operation does not roll back.