---
title: Add a member to the workspace
description: "Owners and admins create operational headcount (stylists, cleaners, contractors) without going through an invite flow — the row exists immediately with linked_user_id: null and linked_at: null."
api_method: POST
api_path: "/v1/workspaces/{workspaceId}/members"
canonical_url: https://wiblo.app/docs/developers/api/members/create-workspace-member
last_updated: 2026-08-03T21:24:33+02:00
md_url: https://wiblo.app/docs/developers/api/members/create-workspace-member.md
---

# Add a member to the workspace

`POST /v1/workspaces/{workspaceId}/members`

Owners and admins create operational headcount (stylists, cleaners, contractors) without going through an invite flow — the row exists immediately with `linked_user_id: null` and `linked_at: null`. Linking happens later when the person signs in (deferred to the `member_invites` tranche). The Zod schema excludes `'owner'` from the role union; an admin attempting to grant `owner` is rejected before the INSERT with `INVALID_PARAMS` 422 (RPC/RLS not reached). Member callers receive `ADMIN_REQUIRED` 403; cross-tenant probes collapse onto the resolver's `WORKSPACE_NOT_FOUND` 404. RLS WITH CHECK is the DB-level defence in depth against an admin bypassing the contract. Per-user rate-limited at 60/60s.

## Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspaceId` | `string` | Yes |  |

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | `string` | Yes |  |
| `email` | `string` | No |  |
| `role` | `"admin" \| "member"` | Yes |  |
| `avatar_url` | `string` | No |  |
| `accent_hue` | `"red" \| "coral" \| "orange" \| "green" \| "teal" \| "blue" \| ...` | No |  |

## Request

**curl**

```bash
curl https://api.wiblo.app/v1/workspaces/{workspaceId}/members \
  -X POST \
  -H "Authorization: Bearer $WIBLO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "...",
  "role": "admin"
}'
```

**TypeScript**

```ts
import { createSdk, createWorkspaceMember } from "@workspace/sdk"

const sdk = createSdk({ baseUrl: "https://api.wiblo.app" })

const { data, error } = await createWorkspaceMember({
  client: sdk,
  path: { workspaceId: "..." },
  body: {
    "name": "...",
    "role": "admin"
  },
})
```

## Responses

**`201`** — Member created. Returns `MemberResponse`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | `string` | Yes |  |
| `role` | `"owner" \| "admin" \| "member"` | Yes |  |
| `name` | `string` | Yes |  |
| `email` | `string \| null` | Yes |  |
| `avatar_url` | `string \| null` | Yes |  |
| `accent_hue` | `"red" \| "coral" \| "orange" \| "green" \| "teal" \| "blue" \| ...` | Yes | The member's stored monogram key; `null` means the tile derives its colour from the hash. Distinct from the user profile's accent_hue, which only seeds this at workspace creation. |
| `linked_user_id` | `string \| null` | Yes |  |
| `linked_at` | `string \| null` | Yes |  |
| `archived_at` | `string \| null` | Yes |  |
| `created_at` | `string` | Yes |  |
| `updated_at` | `string` | Yes |  |

**`401`** — No valid Supabase session cookie was present. Returns `ApiErrorEnvelope`.

**`403`** — Caller is a member of the workspace but is not an owner or admin (`ADMIN_REQUIRED`). Returns `ApiErrorEnvelope`.

**`404`** — Caller has no active membership in the workspace, or the workspace does not exist (`WORKSPACE_NOT_FOUND`). Both cases share the envelope to avoid leaking existence. Returns `ApiErrorEnvelope`.

**`409`** — Workspace is archived (`WORKSPACE_ARCHIVED`). Owners can still see the workspace via `GET /v1/workspaces?include=archived` but must unarchive before adding members. Returns `ApiErrorEnvelope`.

**`422`** — Path param failed UUID validation, body failed Zod validation, or admin attempted to grant `owner` (all `INVALID_PARAMS`). Returns `ApiErrorEnvelope`.

**`429`** — Rate limit exceeded. The body's `error.code` is `RATE_LIMITED` and `error.details.retry_after` is the same number of seconds as the `Retry-After` header. Returns `ApiErrorEnvelope`.