| 方法 | 路径 | 摘要 | 认证 |
|---|---|---|---|
| GET | /v1/tenant/member-invitations | List the caller's tenant member invitations (pending ones past expiry read expired) | 登录会话 |
| POST | /v1/tenant/member-invitations | Email a one-time invitation link (72 hours) to become a read-only sub-account | 登录会话 |
| POST | /v1/tenant/member-invitations/{invitation_id}/revoke | Withdraw a pending invitation | 登录会话 |
| GET | /v1/tenant/members | List the members of the caller's tenant scope | 登录会话 |
| POST | /v1/tenant/members | Add a sub-account to the caller's tenant scope (tenant_viewer role; grant more with /v1/custom-rbac) | 登录会话 |
| DELETE | /v1/tenant/members/{user_id} | Delete a sub-account of the caller's tenant scope | 登录会话 |
| PUT | /v1/tenant/members/{user_id}/password-change | Require (or withdraw) a password change at the member's next sign-in | 登录会话 |
| POST | /v1/tenant/members/{user_id}/password-reset | Give a sub-account a generated password, returned once (revokes its sessions) | 登录会话 |
| POST | /v1/tenant/members/{user_id}/resume | Resume a suspended member | 登录会话 |
| POST | /v1/tenant/members/{user_id}/suspend | Suspend a member (revokes its sessions; its sites stop serving, see account_suspension) | 登录会话 |
契约文件：api/openapi/v1/control.yaml