opbox

Org membership

All 2 verbs in the `orgmember.*` family - what each does, who can call it, and its inputs.

The orgmember.* family (2 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.

Removeorgmember.remove

PropertyValue
Capabilityorg.membership.write
Risk classSensitive - autonomy L2
Min. permissionAdmin
AvailabilityAdmin only (CLI/HTTP; never advertised over MCP)
IdempotentYes
EgressNone - in-box (pure Postgres, no outbound call)

Delete an organization membership (org fenced to the caller’s org). Idempotent.

Call POST /v/orgmember.remove with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Setorgmember.set

PropertyValue
Capabilityorg.membership.write
Risk classSensitive - autonomy L2
Min. permissionAdmin
AvailabilityAdmin only (CLI/HTTP; never advertised over MCP)
IdempotentYes
EgressNone - in-box (pure Postgres, no outbound call)

Upsert an organization membership (create / role-change). The target organizationId MUST equal the caller’s org. Covers the create/upsert/update(role) sites.

Call POST /v/orgmember.set with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.