Appearance
Add a user to a project or component
POST
/memberships
Creates a membership linking a user to a project or component with the specified role (viewer, author, reviewer, admin). Requires admin role on the target project. Duplicate memberships are rejected.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "membership": { "user_id": 42, "membership_id": 4, "membership_type": "Project", "role": "author" }
{
}
Responses
Membership created
application/json
JSON "toast": { "title": "Member added.", "message": [ "Jane Doe added as author." ], "variant": "success" }
{
}
Full replacement of membership role
PUT
/memberships/{membershipId}
Full replacement — all fields required. Changes the role (viewer, author, reviewer, admin) for an existing membership. Requires admin role on the parent project. Cannot demote the last admin on a project.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "membership": { "role": "reviewer" }
{
}
Responses
Membership updated
application/json
JSON "toast": { "title": "Role updated.", "message": [ "Jane Doe is now a reviewer." ], "variant": "success" }
{
}
Remove a user from a project or component
DELETE
/memberships/{membershipId}
Deletes the membership, revoking the user's access. Requires admin role on the parent project. Removed users lose authority over all project-scoped resources including their own pending comments. The last admin of a project cannot be removed — transfer the admin role first.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
Membership removed
application/json
JSON "toast": { "title": "Member removed.", "message": [ "Jane Doe removed from project." ], "variant": "success" }
{
}
Partial update of membership role
PATCH
/memberships/{membershipId}
Partial update — send only the fields to change. Changes the role (viewer, author, reviewer, admin) for an existing membership. Requires admin role on the parent project. Cannot demote the last admin on a project.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "membership": { "role": "reviewer" }
{
}
Responses
Membership updated
application/json
JSON "toast": { "title": "Role updated.", "message": [ "Jane Doe is now a reviewer." ], "variant": "success" }
{
}