The desired state of one membership (billing contract `product-provisioning`): creates the tenant of an unknown workspace, the user of an unknown identity (never by email; `external_user_id` moves a known user to a new identity) and maps the role: admin → admin binding, member → viewer binding, on the whole tenant. Older versions change nothing. `revoked` removes the membership, its bindings, tokens and team memberships, and ends the user's sessions in this tenant.

PUT 
/internal/billing/memberships/:membership_id

The desired state of one membership (billing contract product-provisioning): creates the tenant of an unknown workspace, the user of an unknown identity (never by email; external_user_id moves a known user to a new identity) and maps the role: admin → admin binding, member → viewer binding, on the whole tenant. Older versions change nothing. revoked removes the membership, its bindings, tokens and team memberships, and ends the user's sessions in this tenant.

Request

Responses

200

The resulting state.

401

Not a valid JWT of billing's provisioning machine user.

404

Not in service mode.

422

{"reason": "role_not_allowed"}: rejected for good.