Members API

الأعضاء — roles, permissions, titles, supervisors, profiles and removal.

Who may act on whom:

• role and permissions need users:manage, which only admins hold (it cannot be delegated). No one assigns a role above their own, and nothing may leave a community without an admin (409 LAST_ADMIN).
• The community's founder is protected: only the founder (or a platform super-admin) can change the founder's role or permissions (403 OWNER_PROTECTED).
• title, supervisor and profile-as-admin need users:manage or users:moderate (a moderator default), and the target may not rank ABOVE the caller (403 MEMBER_OUTRANKS_ACTOR) — a moderator cannot edit an admin; peers may edit each other.
• ban and remove need the caller to rank strictly ABOVE the target.
• memberId is the CommunityMember.id, always resolved inside the URL's community — an id from another community is a 404.

14 endpoints.

POST /api/communities/{communityId}/groups/members/batch

Auth: Bearer JWT required.

Parameters

Request body (required) — application/json

Responses

POST /api/communities/{communityId}/join-request

Auth: Bearer JWT required.

Parameters

Responses

GET /api/communities/{communityId}/member-requests

Auth: Bearer JWT required.

Parameters

Responses

DELETE /api/communities/{communityId}/members/{memberId}

Soft-deletes a community member by setting their status to LEFT. Supports both self-removal (user leaving) and admin/moderator-initiated removal.

Behavior:

• Cascade cleanup: removes group memberships, event attendance, and likes
• Last admin protection: cannot remove the only COMMUNITY_ADMIN
• Role hierarchy: moderators cannot remove admins or other moderators
• Audit trail: stores removal metadata (who, when, reason) in member permissions
• Real-time: emits member:removed socket event to invalidate active sessions
• Email: sends removal notification email (admin-initiated removals only)

Authorization:

• Self-removal: any authenticated member can remove themselves
• Admin removal: requires users:manage or users:moderate permission

Auth: Bearer JWT required.

Parameters

Request body — application/json

Responses

POST /api/communities/{communityId}/members/{memberId}/ban

Auth: Bearer JWT required.

Parameters

Responses

PUT /api/communities/{communityId}/members/{memberId}/permissions

Sets the member's role AND legacy can* flags in one write. role is required (it used to default to MEMBER, silently demoting the target). Refused when it would leave the community with no admin.

Auth: Bearer JWT required.

Parameters

Request body (required) — application/json

Responses

PUT /api/communities/{communityId}/members/{memberId}/profile

Same fields as me/profile. Refused for a target ranked above the caller. Auth: Bearer JWT required.

Parameters

Responses

PUT /api/communities/{communityId}/members/{memberId}/role

Auth: Bearer JWT required.

Parameters

Request body (required) — application/json

Responses

PUT /api/communities/{communityId}/members/{memberId}/supervisor

Auth: Bearer JWT required.

Parameters

Request body (required) — application/json

Responses

PUT /api/communities/{communityId}/members/{memberId}/title

Auth: Bearer JWT required.

Parameters

Request body (required) — application/json

Responses

DELETE /api/communities/{communityId}/members/bulk

Removes multiple community members in a single request (soft delete, status set to LEFT). Processes removals sequentially to prevent race conditions on memberCount. Returns partial success results — some members may fail while others succeed.

Constraints:

• Maximum 50 members per request
• Rate limited: 5 requests per 15 minutes per IP
• Cannot include your own memberId (self-removal blocked)
• Last admin protection: cannot remove the only COMMUNITY_ADMIN
• Role hierarchy: moderators cannot remove admins or other moderators
• Reason is required (min 3 chars, max 500 chars, sanitized)

Side effects per member:

• Cascade cleanup: removes group memberships, event attendance, likes
• Real-time: emits member:removed socket event
• Email: sends removal notification

Auth: Bearer JWT required.

Parameters

Request body (required) — application/json

Responses

PUT /api/communities/{communityId}/members/me/profile

Name, phone, bio, city, job and socials are per-community (MemberProfile). multipart/form-data; files avatar, coverImage. Avatars are outside the community storage quota by design. Auth: Bearer JWT required.

Parameters

Responses

POST /api/communities/{communityId}/members/supervisors/resolve-by-email

Auth: Bearer JWT required.

Parameters

Request body (required) — application/json

Responses

GET /api/communities/{communityId}/users/{userId}/permissions

Auth: Bearer JWT required.

Parameters

Responses