> ## Documentation Index > Fetch the complete documentation index at: https://arize-ax.mintlify.site/docs/llms.txt > Use this file to discover all available pages before exploring further. # Add a user to a space > Add a single existing account user to a space with a specified role. **Payload Requirements** - `user_id` is required and must be a valid user identifier (base64). - `role` is required and must be a role assignment object with a `type` discriminator: - `{ "type": "predefined", "name": "admin" }` — one of the predefined roles: `admin`, `member`, `read-only`, `annotator`. - `{ "type": "custom", "id": "" }` — a custom RBAC role, using its unique identifier. - If the user is already a member, their role is updated to the specified value (upsert). - The user must already be a member of the space's parent organization; auto-enrollment is not performed (400 if not a member). **Role constraints** - Users with an `annotator` account role can only be assigned the `annotator` predefined space role. - Users with a non-annotator account role cannot be assigned the `annotator` predefined space role. **Authorization** Requires space admin role when using a `predefined` role, or `ROLE_BINDING_CREATE` permission (RBAC) when using a `custom` role. This endpoint is in alpha, read more [here](https://arize.com/docs/ax/rest-reference#api-version-stages). ## OpenAPI ````yaml https://api.arize.com/v2/spec.yaml post /v2/spaces/{space_id}/users openapi: 3.0.3 info: title: Arize REST API version: 2.0.0 description: | API specification for the backend data server. The API is hosted globally at https://api.arize.com/v2 or in your own environment. license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0 servers: - description: Global url: https://api.arize.com - description: Regional url: https://api.{region}.arize.com variables: region: default: eu-west-1a enum: - eu-west-1a - ca-central-1a - description: Custom Host url: https://{host} variables: host: default: api.arize.com security: - bearerAuth: [] tags: - name: AI Integrations description: | AI integrations configure access to external LLM providers (e.g. OpenAI, Azure OpenAI, AWS Bedrock, Vertex AI). Integrations can be scoped to the entire account, a specific organization, or a specific space. - name: Annotation Configs description: > Annotation configs allow you to define consistent annotation schemas that can be reused across your workspace, ensuring evaluations are structured and comparable over time. - name: Annotation Queues description: > Annotation queues help you organize and manage human evaluation workflows. Use queues to assign spans or examples to annotators for review and labeling. - name: API Keys description: > API keys are used to authenticate requests to the Arize API. List your keys to view metadata; the raw secret is never returned after creation. - name: Datasets description: | Datasets are structured, version-controlled example collections you use to run, evaluate, and track LLM experiments. - name: Evaluators description: > Evaluators are reusable evaluation configurations used to assess the quality of LLM outputs. They can be template-based (using LLM judges) or code-based. - name: Experiments description: > Experiments let you systematically test prompt/model changes using datasets, tasks, and evaluators. - name: Integrations description: > Integrations configure access to external LLM providers (e.g. OpenAI, Azure OpenAI, AWS Bedrock, Vertex AI), notifications services (e.g. PagerDuty, Slack), and your own agents. Integrations can be scoped to the entire account, a specific organization, or a specific space. - name: Organizations description: > Organizations are top-level containers within an Arize AX account for grouping spaces. - name: Projects description: | Projects represent LLM applications being monitored in Arize where you can observe traces and spans. - name: Prompts description: > Prompts are reusable, versioned templates for LLM interactions. Use prompts to standardize and manage how you interact with LLMs across your application. - name: Resource Restrictions description: | Endpoints for restricting and unrestricting resources (projects, models). - name: Role Bindings description: | Role bindings assign a role to a user on a resource. REST currently supports space- and project-scoped bindings. - name: Roles description: > Roles define sets of permissions that can be assigned to users within an account. Create custom roles to tailor access control to your team's needs. - name: Spaces description: > Spaces are containers within an organization for grouping related projects, datasets, and experiments, enabling collaboration or isolated experimentation with role-based access control. - name: Spans description: | Spans represent individual operations within a trace. A span captures the timing, status, and attributes of a single operation in your application. - name: Tasks description: | Tasks are configurable units of work that tie one or more evaluators to a data source (project or dataset). Use tasks to automate evaluation of LLM outputs, with support for continuous evaluation and backfill runs. - name: Users description: > Users represent members of an account. The Users endpoints allow creating, listing, updating (display name), and removing users from the account programmatically. paths: /v2/spaces/{space_id}/users: post: tags: - Spaces summary: Add a user to a space description: > Add a single existing account user to a space with a specified role. **Payload Requirements** - `user_id` is required and must be a valid user identifier (base64). - `role` is required and must be a role assignment object with a `type` discriminator: - `{ "type": "predefined", "name": "admin" }` — one of the predefined roles: `admin`, `member`, `read-only`, `annotator`. - `{ "type": "custom", "id": "" }` — a custom RBAC role, using its unique identifier. - If the user is already a member, their role is updated to the specified value (upsert). - The user must already be a member of the space's parent organization; auto-enrollment is not performed (400 if not a member). **Role constraints** - Users with an `annotator` account role can only be assigned the `annotator` predefined space role. - Users with a non-annotator account role cannot be assigned the `annotator` predefined space role. **Authorization** Requires space admin role when using a `predefined` role, or `ROLE_BINDING_CREATE` permission (RBAC) when using a `custom` role. This endpoint is in alpha, read more [here](https://arize.com/docs/ax/rest-reference#api-version-stages). operationId: spaces_add_user parameters: - $ref: '#/components/parameters/SpaceIdPathParam' requestBody: $ref: '#/components/requestBodies/AddSpaceUserRequestBody' responses: '200': $ref: '#/components/responses/SpaceUserAdded' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/UnprocessableEntity' '429': $ref: '#/components/responses/RateLimitExceeded' components: parameters: SpaceIdPathParam: name: space_id in: path description: The unique space identifier (base64) required: true schema: $ref: '#/components/schemas/Id' example: U3BhY2U6MTIzNDU= requestBodies: AddSpaceUserRequestBody: description: Body containing the user to add to the space required: true content: application/json: schema: $ref: '#/components/schemas/SpaceMembershipInput' examples: predefined_role: summary: Adding a user with a predefined role value: user_id: VXNlcjoxMjM0NQ== role: type: predefined name: member custom_role: summary: Adding a user with a custom role value: user_id: VXNlcjoxMjM0NQ== role: type: custom id: Um9sZToxMjM0NQ== responses: SpaceUserAdded: description: User successfully added to the space content: application/json: schema: $ref: '#/components/schemas/SpaceMembership' examples: predefined_role: summary: Adding a user with a predefined role value: id: U3BhY2VNZW1iZXI6MQ== user_id: VXNlcjoxMjM0NQ== space_id: U3BhY2U6MQ== role: type: predefined name: member custom_role: summary: Adding a user with a custom role value: id: Um9sZUJpbmRpbmc6Mg== user_id: VXNlcjoxMjM0Ng== space_id: U3BhY2U6MQ== role: type: custom id: Um9sZToxMjM0NQ== name: AI Engineer BadRequest: description: Invalid request content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 400 title: Invalid request parameters detail: The 'name' field is required and must be a non-empty string. instance: /resource type: https://arize.com/docs/ax/rest-reference/errors#invalid-request Unauthorized: description: Authentication is required content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 401 title: Authentication required detail: You must be authenticated to access this resource. instance: /resource type: >- https://arize.com/docs/ax/rest-reference/errors#authentication-required Forbidden: description: Insufficient permissions to access this resource content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 403 title: Access forbidden detail: You do not have permission to access this resource. instance: /resource/12345 type: https://arize.com/docs/ax/rest-reference/errors#access-forbidden NotFound: description: Not found content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 404 title: Resource not found detail: The requested resource with ID '12345' was not found. instance: /resource/12345 type: https://arize.com/docs/ax/rest-reference/errors#resource-not-found UnprocessableEntity: description: Unprocessable entity content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 422 title: Unprocessable Entity detail: Minimum score must be less than maximum score. instance: /annotation-configs type: >- https://arize.com/docs/ax/rest-reference/errors#unprocessable-entity RateLimitExceeded: description: Rate limit exceeded headers: Retry-After: description: | When throttled (429), how long to wait before retrying. Value is either a delta-seconds integer. schema: type: integer minimum: 0 example: 42 content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: status: 429 title: Rate limit exceeded detail: >- You have exceeded the allowed number of requests. Please try again later. instance: /resource type: >- https://arize.com/docs/ax/rest-reference/errors#rate-limit-exceeded schemas: Id: type: string description: A universally unique identifier (base64-encoded opaque string). example: RW50aXR5OjEyMzQ1 SpaceMembershipInput: type: object required: - user_id - role properties: user_id: allOf: - $ref: '#/components/schemas/Id' description: The unique identifier of the user to add role: $ref: '#/components/schemas/SpaceRoleAssignment' additionalProperties: false SpaceMembership: type: object description: | A space membership record. required: - id - user_id - space_id - role properties: id: allOf: - $ref: '#/components/schemas/Id' description: Unique identifier for the membership record user_id: allOf: - $ref: '#/components/schemas/Id' description: The unique identifier of the user space_id: allOf: - $ref: '#/components/schemas/Id' description: The unique identifier of the space role: $ref: '#/components/schemas/SpaceRoleAssignment' additionalProperties: false Problem: type: object description: RFC 9457 Problem Details properties: title: type: string description: A short, human-readable summary of the problem type status: type: integer description: >- The HTTP status code generated by the origin server for this occurrence of the problem type: type: string format: uri-reference description: A URI reference that identifies the problem type detail: type: string description: >- A human-readable explanation specific to this occurrence of the problem instance: type: string format: uri-reference description: >- A URI reference that identifies the specific occurrence of the problem required: - title - status additionalProperties: false SpaceRoleAssignment: oneOf: - $ref: '#/components/schemas/PredefinedRoleAssignment' - $ref: '#/components/schemas/CustomRoleAssignment' discriminator: propertyName: type mapping: predefined: $ref: '#/components/schemas/PredefinedRoleAssignment' custom: $ref: '#/components/schemas/CustomRoleAssignment' description: > A role assignment for a space membership. Discriminated by `type`: - `predefined`: one of the predefined roles (`admin`, `member`, `read-only`, `annotator`) - `custom`: a custom RBAC role identified by its ID PredefinedRoleAssignment: type: object description: A predefined space role assignment. required: - type - name properties: type: allOf: - $ref: '#/components/schemas/SpaceRoleAssignmentType' default: predefined name: $ref: '#/components/schemas/UserSpaceRole' additionalProperties: false CustomRoleAssignment: type: object description: A custom RBAC role assignment. required: - type - id properties: type: allOf: - $ref: '#/components/schemas/SpaceRoleAssignmentType' default: custom id: allOf: - $ref: '#/components/schemas/Id' description: The unique identifier of the custom RBAC role. name: type: string readOnly: true description: | Human-readable name of the custom role. Returned in responses only; ignored on input. additionalProperties: false SpaceRoleAssignmentType: type: string enum: - predefined - custom UserSpaceRole: type: string enum: - admin - member - read-only - annotator description: | Space-level role for the user. - `admin`: Full access to the space and its resources. - `member`: Standard access to the space. - `read-only`: Read-only access to the space. - `annotator`: Limited access for annotation tasks only. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: description: > Most Arize AI endpoints require authentication. For those endpoints that require authentication, include your API key in the request header using the format ``` Authorization: Bearer ``` ````