Manage Members & Role Bindings

A Member's access changes over time as roles are added and removed. This page covers the day-to-day mechanics: granting access, narrowing it, revoking it entirely, and auditing what a given Member can currently do.

If you're setting up a Member for the first time, Build a Service Account walks through that from scratch.

To grant additional capability, bind another role. This endpoint replaces the member's role bindings entirely, so read the current list first, add the new role, then send the complete result. Any role omitted from the list will be removed:

curl -i -X PUT \
  'https://api.synqly.com/v1/members/{memberId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "role_binding": [
      "provisioning-service-accounts",
      "provisioning-service-token-issuer",
      "incident-response-viewer"
    ]
  }'

When you update a member's roles, the list you send becomes their complete set of role bindings — not an addition to what they already have. To remove a role, send the full list of roles the member should keep, leaving out only the one you want to remove.

curl -i -X PUT \
  'https://api.synqly.com/v1/members/{memberId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "role_binding": [
      "provisioning-service-accounts"
    ]
  }'

If you want to remove a single role without reading the current list first, use the PATCH endpoint instead — it supports targeted JSON Patch operations that leave all other bindings untouched.

Three options depending on the intended outcome:

To disable without deleting:

curl -i -X PUT \
  'https://api.synqly.com/v1/members/{memberId}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "options": {
      "options": [
        "disabled"
      ]
    }
  }'

To determine everything a member can do, reconstruct the member's effective access from their role bindings:

1. Fetch the Member and read its current RoleBinding list.
2. For each role name, check its permission set and resource restriction via the Roles API.
3. If you need the exact actions a permission set grants, query the Permission Sets API.