identity.end-user.assign-group

Assign an end-user to a single access group within an app

Assign an end-user to a single access group within an app.

Inputs:

• actor: Cognito sub or user UUID (required)
• organization_uuid: owning organization — tenant check (required)
• identity_app_uuid: the app's identity tenant (required)
• end_user_uuid: the target end-user (the wire identity) (required)
• group_slug: the access group to assign — must be a defined group (required)
• force: accepted and ignored. Kept so callers written against the old last-owner guard keep working; there is no longer anything to force.

Outputs (terminal state_data):

• end_user_uuid, previous_group, new_group, updated_at

Overview

Property	Value
Workflow type	Atomic
Library	App-identity
Version	1.0

Input Schema

Field	Type	Required	Default	Description
actor	string	Yes	—	—
organization_uuid	uuid	Yes	—	—
identity_app_uuid	uuid	Yes	—	—
end_user_uuid	uuid	Yes	—	—
group_slug	string	Yes	—	—
force	boolean	No	—	—

Output Schema

Field	Type	Required	Default	Description
end_user_uuid	string	Yes	—	—
previous_group	string	No	—	—
new_group	string	Yes	—	—
updated_at	string	No	—	—
organization_uuid	uuid	No	—	—
identity_app_uuid	uuid	No	—	—
group_slug	string	No	—	—
actor	string	No	—	—
force	boolean	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
reason	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "identity.end-user.assign-group",
  "initial_data": {
    "actor": "value",
    "organization_uuid": "value",
    "identity_app_uuid": "value",
    "end_user_uuid": "value"
  }
}