> ## Documentation Index
> Fetch the complete documentation index at: https://docs-consumer.voucher.allride.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Members and groups

> Invite users to your partner, organise their permissions in groups, and require multi-factor authentication or single sign-on.

People sign in to the consumer dashboards as **users**. A user gets access to your partner through a **Partner Membership**, and what the membership may do is the union of the permissions of its **groups** and the permissions granted to it **directly** (its **effective permissions**). API keys do not belong to members: they carry their own scopes (see [Permissions and scopes](https://docs-consumer.voucher.allride.io/guides/permissions.md)).

One person (one email address) is one user across the whole platform and can be a member of several partners, for example of your production partner and of a sister company's partner. They choose the partner when they sign in.

## Members and invitations

* **Invite** a member with [Invite a member](https://docs-consumer.voucher.allride.io/api-reference/partner-members-create.md) or in the dashboard: give an email address and, optionally, groups (`groupIds`, at most 20) and direct permissions (`directPermissions`). The member starts as `invited` and receives an invitation email. The invitation expires after **7 days**; [resend it](https://docs-consumer.voucher.allride.io/api-reference/partner-members-resend-invitation.md) to issue a new one (the old link stops working).
* An email that already has a membership in your partner answers `409` [`membership-exists`](https://docs-consumer.voucher.allride.io/errors/catalog#membership-exists).
* Membership statuses: `invited` → `active` (on accepting) → `suspended` ↔ `active` → `removed`. [Suspend](https://docs-consumer.voucher.allride.io/api-reference/partner-members-suspend.md) blocks a member temporarily; [Remove](https://docs-consumer.voucher.allride.io/api-reference/partner-members-remove.md) is final (also for open invitations). A removed person can be invited again; that creates a new membership.
* [Change a member's direct permissions](https://docs-consumer.voucher.allride.io/api-reference/partner-members-update.md) replaces `directPermissions` as a whole. Group memberships are changed on the group.
* Changes take effect within **60 seconds** on the member's next request.

Guard rails that keep your partner manageable:

* You can grant only permissions that you hold yourself (`403` [`missing-permission`](https://docs-consumer.voucher.allride.io/errors/catalog#missing-permission)).
* Nobody can change their own permissions, groups or status (`409` [`self-modification-not-allowed`](https://docs-consumer.voucher.allride.io/errors/catalog#self-modification-not-allowed)).
* Only members of `owners` can change the members of `owners` and `administrators` or suspend or remove an owner (`403` [`owner-membership-required`](https://docs-consumer.voucher.allride.io/errors/catalog#owner-membership-required)).
* The last active owner cannot be suspended or removed (`409` [`last-owner`](https://docs-consumer.voucher.allride.io/errors/catalog#last-owner)).

Managing members needs `manage-members` and managing groups `manage-groups`; both are **dashboard only** (not delegable to API keys), and several of these operations need a recent sign-in. Reading members (`view-members`) and groups (`view-groups`) works with API keys too.

## Groups and permissions

A group has a `name`, an optional `description`, a list of `permissions` and its members (`memberIds`, at most 500).

* [Create a group](https://docs-consumer.voucher.allride.io/api-reference/partner-groups-create.md) and [update a group](https://docs-consumer.voucher.allride.io/api-reference/partner-groups-update.md): `permissions` and `memberIds` are replaced as a whole. When two admins save the same group at the same time, the later save wins, so read the group again before you edit it.
* Group names are unique among your active groups (`409` [`group-name-taken`](https://docs-consumer.voucher.allride.io/errors/catalog#group-name-taken)).
* [Delete a group](https://docs-consumer.voucher.allride.io/api-reference/partner-groups-delete.md) removes its member links; a group used as the default group of single sign-on provisioning cannot be deleted (`409` [`group-in-use`](https://docs-consumer.voucher.allride.io/errors/catalog#group-in-use)).
* [List permissions](https://docs-consumer.voucher.allride.io/api-reference/partner-permissions-list.md) returns the permission catalog with a label, a description, whether a permission is `delegable` to API keys and whether it is `applicable` to your partner's role. For a consumer partner every `view-provider-…` or `manage-provider-…` permission is not applicable.

The full list with what each permission allows is in [Permissions and scopes](https://docs-consumer.voucher.allride.io/guides/permissions.md).

## Default groups

Every consumer partner starts with these groups. Default groups cannot be renamed or deleted; except for `owners`, you can edit their permissions.

| Group | Permissions |
| - | - |
| `owners` | Every permission that applies to your partner, computed and immutable. |
| `administrators` | Every applicable permission except `manage-sso` and `request-api-access`. |
| `developers` | `view-profile`, `view-audit`, `request-api-access`, `view-api-keys`, `manage-api-keys`, `view-webhooks`, `manage-webhooks`, `view-webhook-deliveries`, `view-ip-allowlist`, `manage-ip-allowlist`, `view-domains`, plus every `view-…` permission except `view-consumer-billing` and `view-consumer-pricing`. |
| `redemption-operators` | `view-profile`, `view-consumer-catalog`, `view-consumer-redemptions`, `create-consumer-redemptions`, `void-consumer-redemptions`, `view-consumer-redemption-entities`, `manage-consumer-redemption-entities`, `view-consumer-redemption-links`, `manage-consumer-redemption-links`. |
| `billing` | `view-profile`, `view-consumer-billing`, `manage-consumer-billing`, `view-consumer-analytics`, `view-consumer-pricing`, `accept-consumer-pricing`. |
| `viewers` | Every `view-…` permission except `view-api-keys`, `view-consumer-billing` and `view-consumer-pricing`. |

`developers` and `viewers` deliberately cannot read billing data or prices. Put finance staff in `billing`.

## Multi-factor authentication and SSO

* **Multi-factor authentication.** With the partner setting `mfaRequired` on, every member must use a second factor to work in your partner; members without one are asked to enrol (`403` [`mfa-required`](https://docs-consumer.voucher.allride.io/errors/catalog#mfa-required) for their requests until they do). Change it with [Update security settings](https://docs-consumer.voucher.allride.io/api-reference/partner-partner-update-settings.md) (`manage-settings`, dashboard only). Each member's `mfaEnrolled` shows whether they have a second factor. Partner administrators can never change another user's factors.
* **Single sign-on.** Connect your identity provider through SAML or OIDC with the [single sign-on operations](https://docs-consumer.voucher.allride.io/api-reference/partner-sso-connections-create.md) or in the dashboard. You list your email domains, prove ownership of each with a DNS TXT record, test the connection and then activate it. With `enforced` on, users of those domains must sign in through your identity provider (`403` [`sso-required`](https://docs-consumer.voucher.allride.io/errors/catalog#sso-required) otherwise). With automatic provisioning on first sign-in (`jitProvisioning`) a first SSO sign-in creates an `active` membership in the group you choose. SSO needs `view-sso` / `manage-sso`, which are dashboard only.

API keys are not affected by MFA or SSO; protect them with scopes and the [IP allowlist](https://docs-consumer.voucher.allride.io/guides/ip-allowlist.md).

## Related

* [Permissions and scopes](https://docs-consumer.voucher.allride.io/guides/permissions.md)
* [Audit log](https://docs-consumer.voucher.allride.io/workspace/audit-log.md)
* [API keys](https://docs-consumer.voucher.allride.io/guides/api-keys.md)
* [Authentication](https://docs-consumer.voucher.allride.io/guides/authentication.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.