Hello. I'm provisioning new users using the Send C...
# permit-saas
j
Hello. I'm provisioning new users using the Send Consistent Updates (Read-Your-Own-Writes) approach documented here: docs.permit.io/how-to/manage-data/local-facts-uploader. I haven't figured out how to assign the user to a tenant using this approach. Is there a way to do it, or is this only possible via Cloud API?
a
Hi @jonathon.adler, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
The Local Facts API supports the Tenants endpoint (
POST /facts/tenants
) but tenant-user association endpoints aren't listed among the supported synced APIs (1) . The supported list is:
Copy code
# Users
POST /facts/users
PUT /facts/users/{user_id}
PATCH /facts/users/{user_id}

# Tenants
POST /facts/tenants

# Role Assignments
POST /facts/users/{user_id}/roles
POST /facts/role_assignments

# Resource Instances
POST /facts/resource_instances
PATCH /facts/resource_instances/{instance_id}

# Relationship Tuples
POST /facts/relationship_tuples
Tenant assignment isn't in this list, but role assignments are — and role assignments include a tenant. You can assign a user to a tenant via a role assignment call:
Copy code
POST /facts/users/{user_id}/roles
or
Copy code
POST /facts/role_assignments
Also note: "When using the User APIs (
POST /facts/users
,
PUT /facts/users/{user_id}
,
PATCH /facts/users/{user_id}
) , the
role_assignments
attribute will not be awaited in the request. To ensure role assignments are properly synchronized, we recommend using a separate Role Assignment API request after creating or updating the user." APIs not listed in the supported set are still forwarded through the PDP to the Permit API, but without waiting for synchronization . So a direct tenant-user association call (like the one shown in the Tenants API) is not one of the synced operations, meaning it won't block for read-your-own-writes consistency the way the listed endpoints do (1) (2) . To troubleshoot this further with our engineering team, could you share: 1. Which Workspace / Project / Env you're using 2. The exact SDK code or CURL calls you're performing 3. Which PDP version you're running 4. Any relevant PDP logs
To learn more, see the sources I considered: [[1] Send Consistent Updates (Read-Your-Own-Writes)](https://docs.permit.io/how-to/manage-data/local-facts-uploader) [[2] POST /v2/facts/{proj_id}/{env_id}/tenants/{tenant_id}/users](https://api.permit.io/v2/redoc#tag/Tenants/operation/add_user_to_tenant)
o
The AI pretty much nailed it (“You can assign a user to a tenant via a role assignment call”) Let us know if you have follow questions
j
Thanks. What if I wasn't ready to assign roles yet, but only wanted to associate the tenant? Is there a way to do that via PDP?
o
That feature is unavailable (we can add it to the roadmap --note: @david) As a workaround, I’d use a dummy role (with no permissions) - e.g. “tenant-member”
👍 1
👀 1
j
ok, makes sense. thanks!
💜 1