Skip to main content
API7.ai Logo

Members

Members belong to an organization in the AISIX Cloud control plane. They represent the people or service owners responsible for control-plane administration, API keys, usage, and limits.

The AISIX Cloud control plane supports two member onboarding paths:

  • Invite a member when they need to sign in to the dashboard.
  • Create a member directly when you need an API key owner that does not sign in to the dashboard.

Both paths create organization members. The difference is whether the member receives an invitation and can use the dashboard.

Invite a Member​

Use an invitation when the person needs dashboard access to manage resources, view usage, or administer the organization.

  1. Open Members and select Invite member.
  2. Enter the member's email address and choose a role.
  3. Send the invitation and share the one-time invitation link.

Opening the link shows the invitee who invited them, which organization they are joining, and with which role. An invitee who does not have an account yet creates one from that page — the email address is filled in and cannot be changed — and comes back to the invitation. Joining always takes an explicit Accept invitation: opening the link never changes membership on its own, which also means an existing user who is signed in to another organization is not moved by following it.

The invitation is bound to the address you entered. Only an account using that address can accept it; anyone else sees which address the invitation was issued to and is offered a way to sign in as that person. Until the invitee accepts, the invitation stays pending on the Pending invitations tab.

You cannot invite an address that already belongs to a member of the organization. Accepting an invitation never changes an existing member's role, so such an invitation would have nothing to do — change the role from the members list instead.

Invitation Lifetime​

An invitation expires 7 days after it is sent. Until then it stays on the Pending invitations tab, where you can revoke it to invalidate the link immediately.

That tab lists live invitations only. Select Show stale invitations to also see accepted, revoked, and expired ones. An expired invitation can be revoked from there when you want to retire the record.

An expired invitation does not keep the email address reserved: inviting the same person again issues a fresh link and retires the lapsed invitation, which stays visible under Show stale invitations. Only an invitation that is still pending and valid blocks a second invitation to the same address.

Create a Member Directly​

Create a member directly when the member only needs to own API keys and does not need dashboard access. Typical cases include services, applications, or developers in a private deployment where dashboard access is restricted.

A directly created member:

  • Becomes active immediately, with no invitation link or confirmation step.
  • Can be added to teams and assigned API keys.
  • Can be governed with rate limits and budgets.
  • Has no password, so it cannot sign in to the dashboard.

The member still has a name and email address. Use values that identify the responsible person, service, or application owner so usage and limits can be attributed correctly.

In the Dashboard​

  1. Open Members and select Create user.
  2. Enter a Name and an Email that identify the responsible owner.
  3. Select Create user.

The member appears in the list right away. You can then add the member to a team and issue API keys from the environment that serves its traffic.

Use the API​

Use the API when you need to provision members from automation.

Authenticate with an organization admin token that has write scope. Admin tokens are scoped to one organization, so the request does not need a separate organization header.

# AISIX_CP includes /api and has no trailing slash.
# The local On-Premises quickstart uses http://localhost:8080/api.
export AISIX_CP="YOUR_AISIX_CLOUD_ADMIN_API_BASE_URL"
export AISIX_TOKEN="YOUR_ADMIN_TOKEN"

Create the member:

curl -X POST "${AISIX_CP}/members" \
  -H "Authorization: Bearer ${AISIX_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Responsible Person",
    "email": "svc-payments@example.com"
  }'

A successful call returns 201 Created with the new member:

{
  "member": {
    "id": "8f3b2a1c-9d4e-4f6a-b7c8-1e2d3f4a5b6c",
    "user_id": "2c7d6e5f-4a3b-4c2d-8e1f-9a0b1c2d3e4f",
    "email": "svc-payments@example.com",
    "display_name": "Responsible Person",
    "role": "member"
  }
}

The email address must be valid and unique across the deployment. For an application owner, you can use a synthetic address such as svc-payments@example.com. Reusing an existing email address returns 409 Conflict. Directly created members always use the member role.

Browse and Search Members​

The Members list supports search and pagination, so large organizations stay manageable.

  • Use the search box to filter by name or email. The search runs server-side, so it matches across every page, not only the rows currently in view.
  • Use the controls below the list to change the page size or move between pages.

List Members with the API​

Reuse the AISIX_CP and AISIX_TOKEN values exported above. A token with read scope is sufficient for this request.

curl "${AISIX_CP}/members?page=1&page_size=20&q=payments" \
  -H "Authorization: Bearer ${AISIX_TOKEN}"

The query parameters are optional:

  • q: case-insensitive match against member name and email.
  • page: 1-based page number. Requires page_size; setting page on its own returns 400.
  • page_size: page size, up to 200. Omit both page and page_size to disable paging and return every member in a single response.

The response wraps the members in a pagination envelope:

{
  "data": [],
  "total": 128,
  "page": 1,
  "page_size": 20,
  "owner_count": 2
}

total is the number of members that match the filter across all pages, and owner_count is the number of owners in the organization.

Next Steps​

Continue with Teams to group members for attribution and shared controls, or use Roles and Custom Roles to control member permissions. Use SCIM Directory Sync when your identity provider should manage membership.