Manage Members

Tenant membership has two roles, and only admin members can change it: adding, updating, or removing a member all require an admin key.

For the full schema, see Reference: members.

Roles

Role	Can do
admin	Full access: create, update, and delete resources, and manage members and API keys.
readonly	Read-only: list and get resources, and fetch cluster connection details. No changes.

Add a member

export KUPE_TENANT="<tenant>"

curl -X POST \
  -H "Authorization: Bearer $KUPE_API_KEY" \
  -H "Content-Type: application/json" \
  "https://api.kupe.cloud/api/v1/tenants/$KUPE_TENANT/members" \
  -d '{"email": "developer@example.com", "role": "readonly"}'

The email address must be unique within the tenant. The user can authenticate immediately via SSO once added.

Update a member’s role

The email is the path identifier and must be URL-encoded (@ → %40):

curl -X PATCH \
  -H "Authorization: Bearer $KUPE_API_KEY" \
  -H "Content-Type: application/json" \
  "https://api.kupe.cloud/api/v1/tenants/$KUPE_TENANT/members/developer%40example.com" \
  -d '{"role": "admin"}'

A tenant must always keep at least one admin member. Demoting the tenant’s last admin to readonly is rejected with 400 Bad Request.

Remove a member

curl -X DELETE \
  -H "Authorization: Bearer $KUPE_API_KEY" \
  "https://api.kupe.cloud/api/v1/tenants/$KUPE_TENANT/members/developer%40example.com"

The member loses access immediately. You cannot remove yourself; the API returns 400 Bad Request if you try. Removing the tenant’s last admin member is also rejected with 400 Bad Request, even if the caller is a different admin.

List members

curl -s \
  -H "Authorization: Bearer $KUPE_API_KEY" \
  "https://api.kupe.cloud/api/v1/tenants/$KUPE_TENANT/members" \
  | jq

Concurrency note

Add, update, and remove member operations support If-Match. Use the ETag from GET /tenants/{tenant} when several admins or automation flows might change membership at the same time.

See Reference: list members for the response shape.