Members API

8 endpoints.

Method	Path	Summary
`POST`	`/api/members/{communityId}/join-request`	Request to join a public community
`GET`	`/api/members/{communityId}/member-requests`	Get pending member requests (admin/moderator only)
`DELETE`	`/api/members/{communityId}/members/{memberId}`	Remove member from community (soft delete)
`POST`	`/api/members/{communityId}/members/{memberId}/ban`	Ban or unban a member
`PUT`	`/api/members/{communityId}/members/{memberId}/permissions`	Update member permissions (admin only)
`PUT`	`/api/members/{communityId}/members/{memberId}/role`	Update member role (admin only)
`DELETE`	`/api/members/{communityId}/members/bulk`	Bulk remove members from community
`GET`	`/api/members/{communityId}/users/{userId}/permissions`	Get user permissions in community

Request to join a public community

POST /api/members/{communityId}/join-request

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`communityId`	path	yes	string (uuid)	—

Responses

Status	Description	Body
`200`	Join request submitted	—

Get pending member requests (admin/moderator only)

GET /api/members/{communityId}/member-requests

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`communityId`	path	yes	string (uuid)	—
`page`	query	no	integer	—
`limit`	query	no	integer	—

Responses

Status	Description	Body
`200`	Paginated list of member requests	—
`403`	Permission denied	—

Remove member from community (soft delete)

DELETE /api/members/{communityId}/members/{memberId}

Soft-deletes a community member by setting their status to LEFT. Supports both self-removal (user leaving) and admin/moderator-initiated removal.

Behavior:

Cascade cleanup: removes group memberships, event attendance, and likes
Last admin protection: cannot remove the only COMMUNITY_ADMIN
Role hierarchy: moderators cannot remove admins or other moderators
Audit trail: stores removal metadata (who, when, reason) in member permissions
Real-time: emits member:removed socket event to invalidate active sessions
Email: sends removal notification email (admin-initiated removals only)

Authorization:

Self-removal: any authenticated member can remove themselves
Admin removal: requires users:manage or users:moderate permission

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`communityId`	path	yes	string (uuid)	UUID of the community
`memberId`	path	yes	string (uuid)	UUID of the community member to remove

Request body — application/json

Field	Type	Required	Description
`reason`	string	no	Optional reason for removal (admin-initiated only, sanitized)

Responses

Status	Description	Body
`200`	Member removed successfully	object
`400`	Bad request - invalid UUID, member already left, member is banned, or last admin	object
`401`	Authentication required	—
`403`	Permission denied - insufficient role or cannot remove higher-ranked member	object
`404`	Member not found	—
`500`	Internal server error	—

Ban or unban a member

POST /api/members/{communityId}/members/{memberId}/ban

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`communityId`	path	yes	string (uuid)	—
`memberId`	path	yes	string (uuid)	—

Responses

Status	Description	Body
`200`	Ban status toggled successfully	—
`403`	Permission denied	—

Update member permissions (admin only)

PUT /api/members/{communityId}/members/{memberId}/permissions

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`communityId`	path	yes	string (uuid)	—
`memberId`	path	yes	string (uuid)	—

Request body (required) — application/json

Field	Type	Required	Description
`permissions`	object	no	—

Responses

Status	Description	Body
`200`	Permissions updated successfully	—
`403`	Permission denied	—

Update member role (admin only)

PUT /api/members/{communityId}/members/{memberId}/role

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`communityId`	path	yes	string (uuid)	—
`memberId`	path	yes	string (uuid)	—

Request body (required) — application/json

Field	Type	Required	Description
`role`	enum: `ADMIN`, `MODERATOR`, `MEMBER`	yes	—

Responses

Status	Description	Body
`200`	Role updated successfully	—
`403`	Permission denied	—

Bulk remove members from community

DELETE /api/members/{communityId}/members/bulk

Removes multiple community members in a single request (soft delete, status set to LEFT). Processes removals sequentially to prevent race conditions on memberCount. Returns partial success results — some members may fail while others succeed.

Constraints:

Maximum 50 members per request
Rate limited: 5 requests per 15 minutes per IP
Cannot include your own memberId (self-removal blocked)
Last admin protection: cannot remove the only COMMUNITY_ADMIN
Role hierarchy: moderators cannot remove admins or other moderators
Reason is required (min 3 chars, max 500 chars, sanitized)

Side effects per member:

Cascade cleanup: removes group memberships, event attendance, likes
Real-time: emits member:removed socket event
Email: sends removal notification

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`communityId`	path	yes	string (uuid)	UUID of the community

Request body (required) — application/json

Field	Type	Required	Description
`memberIds`	string (uuid)[]	yes	Array of community member UUIDs to remove
`reason`	string	yes	Reason for removal (required, sanitized, min 3 chars)

Responses

Status	Description	Body
`200`	Bulk removal completed (may include partial failures)	object
`400`	Bad request - invalid input, self-removal attempt, or reason too short	object
`401`	Authentication required	—
`403`	Permission denied - requires users:manage or users:moderate	—
`429`	Rate limit exceeded (5 requests per 15 minutes)	object
`500`	Internal server error	—

Get user permissions in community

GET /api/members/{communityId}/users/{userId}/permissions

Auth: Bearer JWT required.

Parameters

Name	In	Required	Type	Description
`communityId`	path	yes	string (uuid)	—
`userId`	path	yes	string (uuid)	—

Responses

Status	Description	Body
`200`	User permissions	—
`401`	Authentication required	—