Approve or reject someone who signed up

An admin approves a pending account into a role and crew, or rejects it — and can only ever act on people inside their own company.

What it is

Accounts that reach the app without a completed invite sit in a pending state. Approving stamps approved status plus the chosen role and crew onto the account; rejecting marks it rejected. Both actions are admin-gated, audited, and hard-scoped to the caller's tenant.

Also called: pending user · approve access · someone requested access

See it
Approve or reject someone who signed up
Area
Platform & Admin
Group
Team & access
System
Team & Access
Solves
2 named problems
01POST /api/users/approve with userId, role and crewId; role falls back to worker if the supplied value is not a known role.
02The route compares the target's tenant to the caller's and refuses when they differ, logging the attempt.
03Platform owners bypass the tenant check because they intentionally act across tenants.
Not a tab of its own — show the pending badge on a member row plus the audit entry it writes. Sample data — no customer information appears here.
How it works
  1. 1POST /api/users/approve with userId, role and crewId; role falls back to worker if the supplied value is not a known role.
  2. 2The route compares the target's tenant to the caller's and refuses when they differ, logging the attempt.
  3. 3Platform owners bypass the tenant check because they intentionally act across tenants.
  4. 4The change merges over existing metadata so unrelated fields survive, and is written to the audit log.
Why we built it

The tenant-scope guard carries its own bug note: without it 'an admin in Tenant A could approve (and promote to any role) a pending user in Tenant B just by passing their Clerk userId — the route only checked caller is admin, never target is in caller's tenant.'

The problem
  • Approval checked that the caller was an admin but not that the target belonged to them.
  • Role assignment on approval had no fallback for a bad value.
Sound familiar?
What you get
Access grants are scoped to one company and recorded.
A bad role value degrades to the least-privileged role instead of failing open.

See it on your own jobs

Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.

or keep browsing features →