PUT/api/apps/{app_id}/service-account/organization-membershipAuthenticated

Make an app's service account a member of its organization

Makes the service account of an organization-owned client application a member of the organization that owns the app, with the given role (default member), or changes its role. Service accounts cannot accept invitations, so this is how the machine identity behind the app's client_credentials tokens passes organization membership checks, such as the required_organization / organization route guards of resource servers built on @schemavaults/auth-server-sdk (they ask GET /api/resource-server/organizations/{organization_id}/members/{uid}/role). The membership follows the app's owner and does not count against the organization membership limit. The service account must exist (create it with POST /api/apps/{app_id}/service-account first); removing it clears the membership, so a recreated service account starts outside the organization. Requires management access; hardcoded apps cannot be configured.

operationId put_api_apps_app_id_service_account_organization_membershipClient applications

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user

Path parameters

NameTypeDescription
app_id*string

Client application id

Request body

Required

application/json
SetAppServiceAccountOrganizationMembershipRequest
PropertyTypeDescription
role"member" | "owner"

Role of the service account in the organization that owns the app (default member)

default: "member"

JSONExample
"role""member"

Responses

application/json
AppServiceAccountOrganizationMembershipResponse
PropertyTypeDescription
success*true
message*string
organization_membership*AppServiceAccountOrganizationMembership
available*boolean

Whether the app is owned by an organization. Only the service account of an organization-owned app can be a member of an organization (its owner)

organization_id*string | null | null

The organization that owns the app, which the service account joins; null when the app is not organization-owned

role*"member" | "owner" | null | null

The service account's role in that organization, as reported to resource servers' organization membership checks; null when it is not a member

JSONExample
"success"true
"message""string"
"organization_membership"
"available"true
"organization_id""acme"
"role""member"

Example request

bashcurl
curl -X PUT 'https://auth.schemavaults.com/api/apps/<app_id>/service-account/organization-membership' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "role": "member"
}'

Other methods on this path

PUT /api/apps/{app_id}/service-account/organization-membership | SchemaVaults Auth API