1. Docs
  2. API Reference
  3. Add an identity to an Environment (create EnvironmentMembership)

Add an identity to an Environment (create EnvironmentMembership)

POST/portal/v1/accounts/{accountSlug}/identities/{id}/environment-memberships

Creates an active EnvironmentMembership attaching the Account-level identity to the named Environment, granting it sign-in access there. The Environment must belong to the same Account as the identity (404). Returns 409 when the identity is already an active member, 404 when the identity is unknown, and writes an env-tier audit row.

Authentication

Bearer TokenAuthorization

JWT access token. Never send alongside X-API-Key: a request carrying both is refused.

Requires capability identities.manageIdentities

Manage end-user identities across the account. Granted through an administrator role in the Admin Workspace; a valid token without it is refused with 403.

Path Parameters

idstring Required

Request body

application/json

environment_idstring Required

The Environment ID the identity should be attached to. Must belong to the same Account as the identity.

Responses

application/json

  • dataEnvMembershipResponseDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Errors

When the request can't be completed, the response body includes a stable error code you can branch on.

403account.capability_requiredForbidden
When it happens

The signed-in user's administrator roles do not grant the capability this endpoint requires.

Remediation

Ask an account administrator to grant a role carrying the capability named in the Authentication section, then retry.

Returned object

EnvMembershipResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/portal/v1/accounts/{accountSlug}/identities/value/environment-memberships" \
  -H "Authorization: Bearer $CANOPY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "environment_id": "string"
  }'
Response
{
  "data": {
    "id": "string",
    "identity_id": "string",
    "environment_id": "string",
    "status": "invited",
    "invited_at": "2026-04-20T12:00:00.000Z",
    "activated_at": "2026-04-20T12:00:00.000Z",
    "deactivated_at": "2026-04-20T12:00:00.000Z",
    "created_at": "2026-04-20T12:00:00.000Z"
  }
}
 Related endpoints
GETList identities in Account
POSTCreate an Account identity
POSTBulk-create Account identities
GETGet directory counts for the Account
GETGet an Account identity
PATCHUpdate an Account identity profile
PATCHSet Account-wide is_active flag
POSTErase an identity (GDPR/CCPA right to be forgotten)
POSTAdmin-trigger a password reset email
POSTRe-send email verification
POSTRevoke all active sessions for an identity
GETList audit events for an Account identity
POSTBulk-attach EnvironmentMemberships for the Add-from-directory picker
DELETERemove an identity from an Environment (revoke EnvironmentMembership)
 Was this page helpful?

Tell us how we can improve this guide.

Canopy