{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-apis/platform/iam/sidebars.yaml","oas-apis/platform/iam/openapi/iam-openapi.json":"oas-apis/platform/iam/openapi/iam-openapi.json"},"props":{"metadata":{"markdoc":{"tagList":["admonition","openapi-code-sample"]},"type":"markdown"},"seo":{"title":"Invite a User and Assign Permissions","keywords":"documentation, api, portal, banking, payment, account information, aritma, psd2, open banking, reconciliation","description":"Developer documentation for Aritma's banking and financial APIs - payments, account information, webhooks, authentication and integrations.","meta":[{"name":"google-site-verification","content":"hplqlK_5O42BZjNnjtVQMEpxv9JkxcD1eH4J1T-NQmI"}],"llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":["openapi"],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"invite-a-user-and-assign-permissions","__idx":0},"children":["Invite a User and Assign Permissions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You need to give a single user access to a specific subscription, and you don't want to set up a group for it. Instead of inviting the user and creating policies afterwards, you can include the permissions in the invitation itself. The permissions are granted automatically when the user accepts."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Approach:"]}," Create an invitation with predefined permissions, then track it until the user accepts."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"When to use groups instead"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If several users need the same access, or you expect access to change over time, ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/apis/platform/iam/use-cases/onboard-team"},"children":["onboard them as a team"]}," with a group. Permissions granted through an invitation are tied to the individual user."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":1},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An access token with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tenant.subjects.manage"]}," on scope ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["iam.policy.write"]}," on every scope you want to grant in the invitation"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The actions and scope URIs to grant (see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/apis/platform/iam/concepts/policies"},"children":["Policies"]},")"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-create-the-invitation-with-permissions","__idx":2},"children":["Step 1: Create the invitation with permissions"]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"oas-apis/platform/iam/openapi/iam-openapi.json","operationId":"CreateInvitation","language":"curl","parameters":{},"environments":{}},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example request body:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"email\": \"jane.doe@example.com\",\n  \"permissions\": [\n    { \"action\": \"banking.ais.read\", \"scope\": \"/subscriptions/123\" }\n  ],\n  \"ttlDays\": 7,\n  \"redirectUri\": \"https://app.example.com/welcome\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["permissions"]}," lists the action and scope pairs granted when the invitation is accepted."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ttlDays"]}," sets how many days the invitation stays valid."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirectUri"]}," is optional. It is where the user is sent after completing registration."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The user receives an email with a link to complete registration in Aritma ID. Note the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id"]}," from the response so you can track the invitation."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-track-the-invitation","__idx":3},"children":["Step 2: Track the invitation"]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"oas-apis/platform/iam/openapi/iam-openapi.json","operationId":"GetInvitation","language":"curl","parameters":{},"environments":{}},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When the user completes registration, the status changes to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Accepted"]}," and the permissions take effect. If the user doesn't accept within ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ttlDays"]},", the status changes to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Expired"]}," and no permissions are granted."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To see all invitations in your tenant, use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GetInvitations"]},"."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-resend-or-cancel-if-needed","__idx":4},"children":["Step 3: Resend or cancel if needed"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the user didn't receive the email, or you wish to extend the TTL, resend it:"]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"oas-apis/platform/iam/openapi/iam-openapi.json","operationId":"ResendInvitation","language":"curl","parameters":{},"environments":{}},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the invitation was sent by mistake or with the wrong permissions, cancel it and create a new one:"]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"oas-apis/platform/iam/openapi/iam-openapi.json","operationId":"CancelInvitation","language":"curl","parameters":{},"environments":{}},"children":[]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":5},"children":["Next steps"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["To confirm what the user can do after accepting, use ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/apis/platform/iam/guides/user-management#view-a-users-permissions"},"children":["View a user's permissions"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["To grant more access later, ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/apis/platform/iam/guides/policies#create-a-policy"},"children":["create a policy"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["To remove access when the user leaves, follow ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/apis/platform/iam/use-cases/revoke-access"},"children":["Revoke Access for a Departed User"]}]}]}]},"headings":[{"value":"Invite a User and Assign Permissions","id":"invite-a-user-and-assign-permissions","depth":1},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Step 1: Create the invitation with permissions","id":"step-1-create-the-invitation-with-permissions","depth":2},{"value":"Step 2: Track the invitation","id":"step-2-track-the-invitation","depth":2},{"value":"Step 3: Resend or cancel if needed","id":"step-3-resend-or-cancel-if-needed","depth":2},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"title":"Invite a User and Assign Permissions","seo":{"title":"Invite a User and Assign Permissions"}},"lastModified":"2026-10-21T08:39:49.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/apis/platform/iam/use-cases/invite-user-with-permissions","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}