Member

A person in the organisation, by email address, with their role. Applying a Member for someone who is not yet in the organisation sends them an invitation, the same one the members page sends; the object then reports phase Pending, with the invitation’s expiry, until they sign in and accept it. A role change on a member takes effect at once; on a pending invitation it replaces the invitation. Deleting the document revokes an outstanding invitation, or removes the member: their account is deactivated and kept for the audit trail, and they lose access to the organisation. Applying needs an owner or admin. An apply that would leave the organisation without an owner, or remove the person applying, is refused.

apiVersion	vulnetix.com/v1
kind	Member
Group	Org
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token that lists Member in its kinds and has the owner role. An admin or member token cannot carry this kind.
Terraform resource	vulnetix_member, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/Member.schema.json
Newest schema	latest/Member.schema.json
First released in	v1.5.0
Print the built-in copy	vulnetix config schema Member

Minimal

Only the fields the kind requires. From examples/Member/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/Member.schema.json
apiVersion: vulnetix.com/v1
kind: Member
metadata:
  name: alice
spec:
  email: alice@acme.com

HCL (resource vulnetix_member)

# Only the arguments the kind requires. From config-schemas examples/Member/minimal.yaml.

resource "vulnetix_member" "alice" {
  name  = "alice"
  email = "alice@acme.com"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/Member.schema.json
apiVersion: vulnetix.com/v1
kind: Member
metadata:
  name: alice
spec:
  email: alice@acme.com
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/Member/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/Member.schema.json
apiVersion: vulnetix.com/v1
kind: Member
metadata:
  name: alice
  labels:
    team: security
  annotations:
    ticket: https://tracker.example.com/ACCESS-42
spec:
  email: alice@acme.com
  role: owner
---
apiVersion: vulnetix.com/v1
kind: Member
metadata:
  name: bob
spec:
  email: bob@acme.com
  role: member

HCL (resource vulnetix_member)

# Every argument the kind supports. From config-schemas examples/Member/advanced.yaml.

resource "vulnetix_member" "alice" {
  name  = "alice"
  email = "alice@acme.com"
  role  = "owner"
  labels = {
    team = "security"
  }
  annotations = {
    ticket = "https://tracker.example.com/ACCESS-42"
  }
}

resource "vulnetix_member" "bob" {
  name  = "bob"
  email = "bob@acme.com"
  role  = "member"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/Member.schema.json
apiVersion: vulnetix.com/v1
kind: Member
metadata:
  name: alice
  labels:
    team: security
  annotations:
    ticket: https://tracker.example.com/ACCESS-42
spec:
  email: alice@acme.com
  role: owner
---
apiVersion: vulnetix.com/v1
kind: Member
metadata:
  name: bob
spec:
  email: bob@acme.com
  role: member
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly Member	Always Member.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.email	string	yes		pattern ^[^A-Z\s]+@[^A-Z\s]+$; format email; length 0 to 254	The person’s email address, in lower case. It identifies the member and cannot change: to replace one person with another, delete this document and declare a new one. A document for someone who is already a member, or already invited, takes them over under this name.
spec.role	string	no	member	owner, admin, member	owner or member. Only an owner may grant owner. admin is the retired role: a member who already holds it keeps it while the document says admin, but no apply grants it.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Phase Pending, with invitationExpires, until the invitation is accepted; then principalUuid. The phases the engine reports are explained under status phases.

How apply treats it

• Applies the members page’s writers and its role rules (internal/orgroles). A new member is an invitation: the status phase is Pending with invitationExpires until it is accepted. A role change on an invitation revokes and re-invites.
• The member’s email is the object’s identity. An undeclared member exports under a name derived from the email, and a document for an existing email adopts that person (plan warns).
• Plan blocks: a caller below admin, granting owner as an admin, granting admin, an email change, two documents for one email, and any plan that leaves no owner. Apply refuses removing the person applying.
• Every Authentik write registers its undo for an apply that does not commit.
• Delete revokes the invitation, or deactivates the principal (kept for the access log) and strips its groups.

Terraform and OpenTofu

The resource is vulnetix_member in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_member.

Import an object that already exists by its name:

# Import an existing Member by its name (metadata.name).
terraform import vulnetix_member.alice alice

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.