Skip to content
/
Invite a User with Permis...
Last updated

Invite a User and Assign Permissions

You need to give a single user access to a specific subscription, and you don't want to set up a group for it. Instead of inviting the user and creating policies afterwards, you can include the permissions in the invitation itself. The permissions are granted automatically when the user accepts.

Approach: Create an invitation with predefined permissions, then track it until the user accepts.

When to use groups instead

If several users need the same access, or you expect access to change over time, onboard them as a team with a group. Permissions granted through an invitation are tied to the individual user.

Prerequisites

  • An access token with tenant.subjects.manage on scope /
  • iam.policy.write on every scope you want to grant in the invitation
  • The actions and scope URIs to grant (see Policies)

Step 1: Create the invitation with permissions

curl -i -X POST \
  https://developer.aritma.com/_mock/apis/platform/iam/openapi/iam-openapi/v1/invitations \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "jane.doe@example.com",
    "permissions": [
      {
        "action": "string",
        "scope": "string"
      }
    ],
    "ttlDays": 0,
    "redirectUri": "string"
  }'

Example request body:

{
  "email": "jane.doe@example.com",
  "permissions": [
    { "action": "banking.ais.read", "scope": "/subscriptions/123" }
  ],
  "ttlDays": 7,
  "redirectUri": "https://app.example.com/welcome"
}
  • permissions lists the action and scope pairs granted when the invitation is accepted.
  • ttlDays sets how many days the invitation stays valid.
  • redirectUri is optional. It is where the user is sent after completing registration.

The user receives an email with a link to complete registration in Aritma ID. Note the id from the response so you can track the invitation.

Step 2: Track the invitation

curl -i -X GET \
  'https://developer.aritma.com/_mock/apis/platform/iam/openapi/iam-openapi/v1/invitations/{id}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

When the user completes registration, the status changes to Accepted and the permissions take effect. If the user doesn't accept within ttlDays, the status changes to Expired and no permissions are granted.

To see all invitations in your tenant, use GetInvitations.

Step 3: Resend or cancel if needed

If the user didn't receive the email, or you wish to extend the TTL, resend it:

curl -i -X POST \
  'https://developer.aritma.com/_mock/apis/platform/iam/openapi/iam-openapi/v1/invitations/{id}/resend?ttlDays=0' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

If the invitation was sent by mistake or with the wrong permissions, cancel it and create a new one:

curl -i -X DELETE \
  'https://developer.aritma.com/_mock/apis/platform/iam/openapi/iam-openapi/v1/invitations/{id}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Next steps

Previous page
Next page