Replace a team's membership

Replace the team membership set wholesale.

team_members carries no tenant_id and no row-level policy: reaching it only through a team the caller's workspace owns is the whole of its isolation (FR-85). assert_visible_team establishes that, and both statements below re-state it as a join rather than trusting the assertion to still hold, so the check and the write are then one fact instead of two that can drift when a later reader moves one of them.

Tenancy: the request is scoped to one workspace, and the credential presented is what selects it. A caller with no membership in that workspace is refused with 404, which is indistinguishable from a workspace that does not exist.

Authorisation: editor, admin or owner. A viewer receives 403 insufficient_role.

Access: Authorization: Bearer carrying either a realm access token or an API key. A key must hold the helpdesk-ops:write scope, and the workspace role of the person who owns it must meet the floor above.

Path Parameters

Response Body

curl -X PUT "https://example.com/v1/teams/497f6eca-6276-4993-bfeb-53cbbbba6f08/members" \  -H "Content-Type: application/json" \  -d '{}'

{}