Anchor a user to one organization in logiccloud orchestrate and Keycloak

POST

/api/v1/tenant-consistency/users/{userId}/anchor

curl --request POST \
  --url http://localhost:3000/api/v1/tenant-consistency/users/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/anchor \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --data '{ "organizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "roleId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }'

• Development
• Production

Makes the organization the user’s primary membership and sets the Keycloak organization_id attribute to exactly the user’s membership set, atomically with a rollback of Keycloak on failure. Creates the membership (default role viewer) when the user is not a member yet. A user without a live Keycloak account gets the database anchor only, and a link to a deleted Keycloak account is cleared. Requires Super Admin privileges.

Authorizations

• api-key
• bearer

Parameters

Path Parameters

userId

required

string format: uuid

Header Parameters

x-organization-id

string format: uuid

UUID of the organization (tenant) the request acts in. It selects the tenant and grants nothing: the server checks membership or an open tenant switch. Not needed for global operations. A malformed value returns 400. API keys are fixed to their own organization; another organization returns 403. The x-organization-source header grants nothing.

Request Body^required

Media typeapplication/json

object

organizationId

required

Organization to make the user primary in, in both logiccloud orchestrate and Keycloak.

string format: uuid

roleId

Role for a NEW membership; defaults to the system viewer role when the user is not yet a member. Rejected (400) when the user already is a member, because the existing role is kept.

string format: uuid

Example^generated

{
  "organizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "roleId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
}

Responses

200

Media typeapplication/json

object

userId

required

string format: uuid

email

required

string

organizationId

required

string format: uuid

membershipCreated

required

True when the user was not a member and a membership was created.

boolean

previousPrimaryOrganizationId

required

string format: uuid

nullable

previousKeycloakOrganizationIds

required

Organization_id attribute before the anchor, as Keycloak reported it.

Array<string>

keycloakOrganizationIds

required

Organization_id attribute now: exactly the membership set, de-duplicated. Order is not meaningful.

Array<string>

keycloakUpdated

required

False when the user has no live Keycloak account (never linked, or the linked account no longer exists): only the database primary was set (FM-1441).

boolean

keycloakLinkCleared

required

True when the linked Keycloak account no longer exists and the stale link was removed; the user is linked again on the next sign-in (FM-1441).

boolean

userCreated

required

True when a logiccloud orchestrate user row was created for a Keycloak-only account (FM-1441).

boolean

Example^generated

{
  "userId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "email": "example",
  "organizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "membershipCreated": true,
  "previousPrimaryOrganizationId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "previousKeycloakOrganizationIds": [
    "example"
  ],
  "keycloakOrganizationIds": [
    "example"
  ],
  "keycloakUpdated": true,
  "keycloakLinkCleared": true,
  "userCreated": true
}

400

Invalid input data

403

Forbidden - Super Admin required

404

User, organization or role not found

409

Organization not active

500

Rollback of Keycloak failed; the user must be checked manually

502

Keycloak rejected the update or could not be read; nothing changed