# Create SSO Teammate ## API Overview The Single Sign-On APIs allow you to manage your SAML 2.0 SSO configurations. You can also work with your SSO integrations using the [SSO section of the Twilio SendGrid App](https://app.sendgrid.com/settings/sso). The Single Sign-On Teammates API allows you to add and modify SSO Teammates. SSO Teammates are the individual user accounts who will access your Twilio SendGrid account with SSO credentials. To [retrieve](/docs/sendgrid/api-reference/teammates/retrieve-specific-teammate) or [delete](/docs/sendgrid/api-reference/teammates/delete-teammate) an SSO Teammate, you will use the [Teammates API](/docs/sendgrid/api-reference/teammates). For more information about managing SSO Teammates, see the [Twilio SendGrid SSO documentation](/docs/sendgrid/ui/account-and-settings/sso/#manage-users). ## Operation overview ```json {"path":"https://api.sendgrid.com/v3/sso/teammates","method":"post","servers":[{"url":"https://api.sendgrid.com","description":"for global users and subusers"},{"url":"https://api.eu.sendgrid.com","description":"for EU regional subusers"}]} ``` **This endpoint allows you to create an SSO Teammate.** The email address provided for the Teammate will also function as the Teammate's username. Once created, the Teammate's email address cannot be changed. ### Scopes When creating a Teammate, you will assign it permissions or scopes. These scopes determine which actions the Teammate can perform and which features they can access. Scopes are provided with one of three properties passed to this endpoint: `is_admin`, `scopes`, and `persona`. You can make a Teammate an administrator by setting `is_admin` to `true`. Administrators will have all scopes assigned to them. Alternatively, you can assign a `persona` to the teammate, which will assign them a block of permissions commonly required for that type of user. See the "Persona scopes" section of [**Teammate Permissions**](/docs/sendgrid/ui/account-and-settings/teammate-permissions#persona-scopes) for a list of permsissions granted by persona. Lastly, you can assign individual permissions with the `scopes` property. See [**Teammate Permissions**](/docs/sendgrid/ui/account-and-settings/teammate-permissions) for a full list of scopes that can be assigned to a Teammate. ### Subuser access SendGrid Teammates may be assigned access to one or more Subusers. Subusers function like SendGrid sub-accounts with their own resources. See [**Subusers**](/docs/sendgrid/ui/account-and-settings/subusers) for more information. When assigning Subuser access to a Teammate, you may set the `has_restricted_subuser_access` property to `true` to constrain the Teammate so that they can operate only on behalf of the Subusers to which they are assigned. You may further set the level of access the Teammate has to each Subuser with the `subuser_access` property. ## Operation details ### Authentication API Key ### Headers ```json [{"in":"header","name":"Authorization","required":true,"default":"Bearer <>","schema":{"type":"string"}}] ``` ### Request body ```json {"schema":{"title":"Single Sign-On Teammate Create Request Body","summary":"The request body accepted by the POST endpoint that creates a new webhook.","example":{"email":"jane_doe@example.com","first_name":"Jane","last_name":"Doe","is_admin":false,"has_restricted_subuser_access":true,"subuser_access":[{"id":12345,"permission_type":"restricted","scopes":["alerts.read","asm.groups.read","billing.read","ips.warmup.read","ips.pools.read","ips.pools.ips.read","ips.assigned.read","ips.read","mail_settings.read","mail_settings.bcc.read","mail_settings.address_whitelist.read","mail_settings.footer.read","mail_settings.forward_spam.read","mail_settings.plain_content.read","mail_settings.spam_check.read","mail_settings.bounce_purge.update","mail_settings.forward_bounce.read","partner_settings.read","partner_settings.new_relic.read","partner_settings.sendwithus.read","tracking_settings.read","tracking_settings.click.read","tracking_settings.subscription.read","tracking_settings.open.read","tracking_settings.google_analytics.read","user.webhooks.event.settings.read","user.webhooks.event.test.read","user.webhooks.parse.settings.read","stats.read","stats.global.read","categories.stats.read","categories.stats.sums.read","devices.stats.read","clients.stats.read","clients.phone.stats.read","clients.tablet.stats.read","clients.webmail.stats.read","clients.desktop.stats.read","geo.stats.read","mailbox_providers.stats.read","browsers.stats.read","subusers.stats.read","subusers.stats.sums.read","subusers.stats.monthly.read","user.webhooks.parse.stats.read","subusers.read","subusers.monitor.read","subusers.credits.read","subusers.credits.remaining.read","subusers.reputations.read","subusers.summary.read","templates.read","templates.versions.read","user.account.read","user.credits.read","user.email.read","user.profile.read","user.profile.update","user.timezone.read","user.username.read","user.settings.enforced_tls.read","api_keys.read","categories.read","mail_settings.template.read","mail.batch.read","user.scheduled_sends.read","access_settings.whitelist.read","access_settings.activity.read","suppression.read","messages.read","email_testing.read","sender_verification_eligible","sender_verification_legacy","2fa_exempt","2fa_required"]}]},"type":"object","required":["email","first_name","last_name"],"refName":"PostSsoTeammatesRequest","modelName":"PostSsoTeammatesRequest","properties":{"email":{"type":"string","format":"email","description":"Set this property to the Teammate's email address. This email address will also function as the Teammate's username and must match the address assigned to the user in your IdP. This address cannot be changed after the Teammate is created."},"first_name":{"type":"string","description":"Set this property to the Teammate's first name."},"last_name":{"type":"string","description":"Set this property to the Teammate's last name."},"is_admin":{"type":"boolean","description":"Set this property to `true` if the Teammate has admin permissions. You should not include the `scopes` or `persona` properties when setting the `is_admin` property to `true`—an admin will be allocated all scopes. See [**Teammate Permissions**](/docs/sendgrid/ui/account-and-settings/teammate-permissions) for a complete list of scopes."},"persona":{"type":"string","description":"A persona represents a group of permissions often required by a type of Teammate such as a developer or marketer. Assigning a persona allows you to allocate a group of pre-defined permissions rather than assigning each scope individually. See [**Teammate Permissions**](/docs/sendgrid/ui/account-and-settings/teammate-permissions) for a full list of the scopes assigned to each persona.","enum":["accountant","developer","marketer","observer"],"refName":"Persona","modelName":"Persona"},"scopes":{"type":"array","description":"Add or remove permissions from a Teammate using this `scopes` property. See [**Teammate Permissions**](/docs/sendgrid/ui/account-and-settings/teammate-permissions) for a complete list of available scopes. You should not include this propety in the request when using the `persona` property or when setting the `is_admin` property to `true`—assigning a `persona` or setting `is_admin` to `true` will allocate a group of permissions to the Teammate.","items":{"type":"string"}},"has_restricted_subuser_access":{"type":"boolean","description":"Set this property to `true` to give the Teammate permissions to operate only on behalf of a Subuser. This property value must be `true` if the `subuser_access` property is not empty. The `subuser_access` property determines which Subusers the Teammate may act on behalf of. If this property is set to `true`, you cannot specify individual `scopes`, assign a `persona`, or set `is_admin` to `true`—a Teammate cannot specify scopes for the parent account and have restricted Subuser access."},"subuser_access":{"type":"array","description":"Specify which Subusers the Teammate may access and act on behalf of with this property. If this property is populated, you must set the `has_restricted_subuser_access` property to `true`.","items":{"type":"object","description":"An array of Subusers to which the Teammate should have access.","required":["id","permission_type"],"properties":{"id":{"type":"integer","description":"Set this property to the ID of a Subuser to which the Teammate should have access. You can retrieve Subuser IDs from the [Subusers API](/docs/sendgrid/api-reference/subusers-api/)."},"permission_type":{"type":"string","description":"Grant the level of access the Teammate should have to the specified Subuser with this property. This property value may be either `admin` or `restricted`. When set to `restricted`, the Teammate has only the permissions assigned in the `scopes` property.","enum":["admin","restricted"],"refName":"PermissionType","modelName":"PermissionType"},"scopes":{"type":"array","description":"Add or remove permissions that the Teammate can access on behalf of the Subuser. See [**Teammate Permissions**](/docs/sendgrid/ui/account-and-settings/teammate-permissions) for a complete list of available scopes. You should not include this property in the request when the `permission_type` property is set to `admin`—administrators have full access to the specified Subuser.","items":{"type":"string"}}}}}}},"examples":{"Create Teammate with Subuser Access":{"value":{"first_name":"Jane","last_name":"Doe","email":"jane_doe@example.com","has_restricted_subuser_access":true,"subuser_access":[{"id":12345,"permission_type":"admin"}]}},"Create Admin Teammate":{"value":{"first_name":"Jane","last_name":"Doe","email":"jane_doe@example.com","is_admin":true,"has_restricted_subuser_access":false}}},"encodingType":"application/json"} ``` ### Responses ```json [{"responseCode":"201","schema":{"description":"","content":{"application/json":{"schema":{"title":"Single Sign-On Teammates POST Response.","description":"Successful SSO Teammates POST Response.","type":"object","refName":"PostSsoTeammates201","modelName":"PostSsoTeammates201","properties":{"first_name":{"type":"string","description":"The Teammate's first name."},"last_name":{"type":"string","description":"The Teammate's last name."},"email":{"type":"string","format":"email","description":"Teammate's email address. This email address also functions as the Teammate's username and must match the address assigned to the user in your IdP. This address cannot be changed after the Teammate is created."},"is_admin":{"type":"boolean","description":"Indicates if the Teammate has administrator permissions. When set to `true`, the Teammate is an admin."},"is_sso":{"type":"boolean","description":"Indicates how the Teammate authenticates with SendGrid. When set to `true`, the Teammate will access SendGrid via SSO and their IdP. When set to `false`, the Teammate will authenticate directly with SendGrid via a username and password."},"scopes":{"type":"array","description":"The permissions or scopes currently assigned to the Teammate. See [**Teammate Permissions**](/docs/sendgrid/ui/account-and-settings/teammate-permissions) for a complete list of available scopes.","items":{"type":"string"}},"has_restricted_subuser_access":{"type":"boolean","description":"When this property is set to `true`, the Teammate has permissions to operate only on behalf of a Subuser. This property value is `true` when the `subuser_access` property is not empty. The `subuser_access` property determines which Subusers the Teammate may act on behalf of."},"subuser_access":{"type":"array","description":"Specifies which Subusers the Teammate may access and act on behalf of. If this property is populated, the `has_restricted_subuser_access` property will be `true`.","items":{"type":"object","description":"An array of Subusers to which the Teammate has access.","properties":{"id":{"type":"integer","description":"The ID of a Subuser to which the Teammate has access. You can retrieve Subuser IDs from the [Subusers API](/docs/sendgrid/api-reference/subusers-api/)."},"username":{"type":"string","description":"The username of a Subuser to which the Teammate has access."},"email":{"type":"string","description":"The email address of a Subuser to which the Teammate has access."},"disabled":{"type":"boolean","description":"Indicates if the Subuser is active for the SendGrid account."},"permission_type":{"type":"string","description":"The level of access the Teammate has to the specified Subuser. This property value may be either `admin` or `restricted`. When is property is set to `restricted`, the Teammate has only the permissions assigned in the `scopes` property.","enum":["admin","restricted"],"refName":"PermissionType1","modelName":"PermissionType1"},"scopes":{"type":"array","description":"The permissions or scopes that the Teammate can access on behalf of the Subuser. See [**Teammate Permissions**](/docs/sendgrid/ui/account-and-settings/teammate-permissions) for a complete list of available scopes.","items":{"type":"string"}}}}}}},"examples":{"response":{"value":{"first_name":"Jane","last_name":"Doe","email":"jane_doe@example.com","is_admin":true,"is_sso":true,"scopes":["alerts.create","alerts.read","alerts.update","alerts.delete","asm.groups.create","asm.groups.read","asm.groups.update","asm.groups.delete","asm.groups.suppressions.create","asm.groups.suppressions.read","asm.groups.suppressions.update","asm.groups.suppressions.delete","asm.suppressions.global.create","asm.suppressions.global.read","asm.suppressions.global.update","asm.suppressions.global.delete","billing.create","billing.read","billing.update","billing.delete","ui.confirm_email","signup.trigger_confirmation","ui.provision","ips.warmup.create","ips.warmup.read","ips.warmup.update","ips.warmup.delete","ips.pools.create","ips.pools.read","ips.pools.update","ips.pools.delete","ips.pools.ips.create","ips.pools.ips.read","ips.pools.ips.update","ips.pools.ips.delete","ips.assigned.read","ips.create","ips.read","ips.update","ips.delete","mail.send","mail_settings.read","mail_settings.bcc.create","mail_settings.bcc.read","mail_settings.bcc.update","mail_settings.bcc.delete","mail_settings.address_whitelist.create","mail_settings.address_whitelist.read","mail_settings.address_whitelist.update","mail_settings.address_whitelist.delete","mail_settings.footer.create","mail_settings.footer.read","mail_settings.footer.update","mail_settings.footer.delete","mail_settings.forward_spam.create","mail_settings.forward_spam.read","mail_settings.forward_spam.update","mail_settings.forward_spam.delete","mail_settings.plain_content.create","mail_settings.plain_content.read","mail_settings.plain_content.update","mail_settings.plain_content.delete","mail_settings.spam_check.create","mail_settings.spam_check.read","mail_settings.spam_check.update","mail_settings.spam_check.delete","mail_settings.bounce_purge.create","mail_settings.bounce_purge.read","mail_settings.bounce_purge.update","mail_settings.bounce_purge.delete","mail_settings.forward_bounce.create","mail_settings.forward_bounce.read","mail_settings.forward_bounce.update","mail_settings.forward_bounce.delete","partner_settings.read","partner_settings.new_relic.create","partner_settings.new_relic.read","partner_settings.new_relic.update","partner_settings.new_relic.delete","partner_settings.sendwithus.create","partner_settings.sendwithus.read","partner_settings.sendwithus.update","partner_settings.sendwithus.delete","tracking_settings.read","tracking_settings.click.create","tracking_settings.click.read","tracking_settings.click.update","tracking_settings.click.delete","tracking_settings.subscription.create","tracking_settings.subscription.read","tracking_settings.subscription.update","tracking_settings.subscription.delete","tracking_settings.open.create","tracking_settings.open.read","tracking_settings.open.update","tracking_settings.open.delete","tracking_settings.google_analytics.create","tracking_settings.google_analytics.read","tracking_settings.google_analytics.update","tracking_settings.google_analytics.delete","user.webhooks.event.settings.create","user.webhooks.event.settings.read","user.webhooks.event.settings.update","user.webhooks.event.settings.delete","user.webhooks.event.test.create","user.webhooks.event.test.read","user.webhooks.event.test.update","user.webhooks.event.test.delete","user.webhooks.parse.settings.create","user.webhooks.parse.settings.read","user.webhooks.parse.settings.update","user.webhooks.parse.settings.delete","stats.read","stats.global.read","categories.stats.read","categories.stats.sums.read","devices.stats.read","clients.stats.read","clients.phone.stats.read","clients.tablet.stats.read","clients.webmail.stats.read","clients.desktop.stats.read","geo.stats.read","mailbox_providers.stats.read","browsers.stats.read","subusers.stats.read","subusers.stats.sums.read","subusers.stats.monthly.read","user.webhooks.parse.stats.read","subusers.create","subusers.read","subusers.update","subusers.delete","subusers.monitor.create","subusers.monitor.read","subusers.monitor.update","subusers.monitor.delete","subusers.credits.create","subusers.credits.read","subusers.credits.update","subusers.credits.delete","subusers.credits.remaining.create","subusers.credits.remaining.read","subusers.credits.remaining.update","subusers.credits.remaining.delete","subusers.reputations.read","subusers.summary.read","suppression.bounces.create","suppression.bounces.read","suppression.bounces.update","suppression.bounces.delete","suppression.blocks.create","suppression.blocks.read","suppression.blocks.update","suppression.blocks.delete","suppression.invalid_emails.create","suppression.invalid_emails.read","suppression.invalid_emails.update","suppression.invalid_emails.delete","suppression.spam_reports.create","suppression.spam_reports.read","suppression.spam_reports.update","suppression.spam_reports.delete","suppression.unsubscribes.create","suppression.unsubscribes.read","suppression.unsubscribes.update","suppression.unsubscribes.delete","templates.create","templates.read","templates.update","templates.delete","templates.versions.create","templates.versions.read","templates.versions.update","templates.versions.delete","templates.versions.activate.create","templates.versions.activate.read","templates.versions.activate.update","templates.versions.activate.delete","user.account.read","user.credits.read","user.email.create","user.email.read","user.email.update","user.email.delete","user.profile.create","user.profile.read","user.profile.update","user.profile.delete","user.password.create","user.password.read","user.password.update","user.password.delete","user.timezone.create","user.timezone.read","user.timezone.update","user.timezone.delete","user.username.create","user.username.read","user.username.update","user.username.delete","user.settings.enforced_tls.read","user.settings.enforced_tls.update","api_keys.create","api_keys.read","api_keys.update","api_keys.delete","credentials.create","credentials.read","credentials.update","credentials.delete","categories.create","categories.read","categories.update","categories.delete","mail_settings.template.create","mail_settings.template.read","mail_settings.template.update","mail_settings.template.delete","user.multifactor_authentication.create","user.multifactor_authentication.read","user.multifactor_authentication.update","user.multifactor_authentication.delete","newsletter.create","newsletter.read","newsletter.update","newsletter.delete","marketing_campaigns.create","marketing_campaigns.read","marketing_campaigns.update","marketing_campaigns.delete","ui.signup_complete","mail.batch.create","mail.batch.read","mail.batch.update","mail.batch.delete","user.scheduled_sends.create","user.scheduled_sends.read","user.scheduled_sends.update","user.scheduled_sends.delete","access_settings.whitelist.create","access_settings.whitelist.read","access_settings.whitelist.update","access_settings.whitelist.delete","access_settings.activity.read","whitelabel.create","whitelabel.read","whitelabel.update","whitelabel.delete","suppression.create","suppression.read","suppression.update","suppression.delete","teammates.create","teammates.read","teammates.update","teammates.delete","messages.read","validations.email.read","validations.email.create","marketing.read","marketing.automation.read","design_library.read","design_library.create","design_library.update","design_library.delete","email_testing.read","email_testing.write","sender_verification_eligible","sso.settings.create","sso.settings.read","sso.settings.update","sso.settings.delete","sender_verification_legacy","sso.teammates.create","sso.teammates.update","2fa_required","di.bounce_block_classification.read"],"has_restricted_subuser_access":false}}}}}}},{"responseCode":"400","schema":{"description":"","content":{"application/json":{"schema":{"title":"SSO Error Response","type":"array","refName":"SsoErrorResponse","modelName":"SsoErrorResponse","items":{"type":"object","properties":{"message":{"type":"string"},"field":{"nullable":true,"type":"string"},"error_id":{"type":"string"}}}}}},"refName":"#/components/responses/Sso400","modelName":"__components_responses_Sso400"}},{"responseCode":"401","schema":{"description":"","content":{"application/json":{"schema":{"title":"SSO Error Response","type":"array","refName":"SsoErrorResponse","modelName":"SsoErrorResponse","items":{"type":"object","properties":{"message":{"type":"string"},"field":{"nullable":true,"type":"string"},"error_id":{"type":"string"}}}}}},"refName":"#/components/responses/Sso401","modelName":"__components_responses_Sso401"}},{"responseCode":"403","schema":{"description":"","content":{"application/json":{"schema":{"title":"SSO Error Response","type":"array","refName":"SsoErrorResponse","modelName":"SsoErrorResponse","items":{"type":"object","properties":{"message":{"type":"string"},"field":{"nullable":true,"type":"string"},"error_id":{"type":"string"}}}}}},"refName":"#/components/responses/Sso403","modelName":"__components_responses_Sso403"}},{"responseCode":"429","schema":{"description":"","content":{"application/json":{"schema":{"title":"SSO Error Response","type":"array","refName":"SsoErrorResponse","modelName":"SsoErrorResponse","items":{"type":"object","properties":{"message":{"type":"string"},"field":{"nullable":true,"type":"string"},"error_id":{"type":"string"}}}}}},"refName":"#/components/responses/Sso429","modelName":"__components_responses_Sso429"}},{"responseCode":"500","schema":{"description":"","content":{"application/json":{"schema":{"title":"SSO Error Response","type":"array","refName":"SsoErrorResponse","modelName":"SsoErrorResponse","items":{"type":"object","properties":{"message":{"type":"string"},"field":{"nullable":true,"type":"string"},"error_id":{"type":"string"}}}}}},"refName":"#/components/responses/Sso500","modelName":"__components_responses_Sso500"}}] ``` Create SSO Teammate ```js const client = require("@sendgrid/client"); client.setApiKey(process.env.SENDGRID_API_KEY); const data = { first_name: "Jane", last_name: "Doe", email: "jane_doe@example.com", is_admin: true, has_restricted_subuser_access: false, }; const request = { url: `/v3/sso/teammates`, method: "POST", body: data, }; client .request(request) .then(([response, body]) => { console.log(response.statusCode); console.log(response.body); }) .catch((error) => { console.error(error); }); ``` ```python import os from sendgrid import SendGridAPIClient sg = SendGridAPIClient(os.environ.get("SENDGRID_API_KEY")) data = { "first_name": "Jane", "last_name": "Doe", "email": "jane_doe@example.com", "is_admin": True, "has_restricted_subuser_access": False, } response = sg.client.sso.teammates.post(request_body=data) print(response.status_code) print(response.body) print(response.headers) ``` ```csharp using System; using System.Collections.Generic; using System.Threading.Tasks; using SendGrid; public class Program { public static async Task Main() { string apiKey = Environment.GetEnvironmentVariable("SENDGRID_API_KEY"); var client = new SendGridClient(apiKey); var data = @"{ ""first_name"": ""Jane"", ""last_name"": ""Doe"", ""email"": ""jane_doe@example.com"", ""is_admin"": true, ""has_restricted_subuser_access"": false }"; var response = await client.RequestAsync( method: SendGridClient.Method.POST, urlPath: "sso/teammates", requestBody: data); Console.WriteLine(response.StatusCode); Console.WriteLine(response.Body.ReadAsStringAsync().Result); Console.WriteLine(response.Headers.ToString()); } } ``` ```java import com.sendgrid.*; import java.io.IOException; import org.json.JSONObject; import java.util.HashMap; public class Example { public static void main(String[] args) throws IOException { try { SendGrid sg = new SendGrid(System.getenv("SENDGRID_API_KEY")); Request request = new Request(); request.setMethod(Method.POST); request.setEndpoint("/sso/teammates"); request.setBody(new JSONObject(new HashMap() { { put("first_name", "Jane"); put("last_name", "Doe"); put("email", "jane_doe@example.com"); put("is_admin", true); put("has_restricted_subuser_access", false); } }).toString()); Response response = sg.api(request); System.out.println(response.getStatusCode()); System.out.println(response.getBody()); System.out.println(response.getHeaders()); } catch (IOException ex) { throw ex; } } } ``` ```go package main import ( "fmt" "github.com/sendgrid/sendgrid-go" "os" ) func main() { apiKey := os.Getenv("SENDGRID_API_KEY") host := "https://api.sendgrid.com" request := sendgrid.GetRequest(apiKey, "/v3/sso/teammates", host) request.Method = "POST" request.Body = []byte(`{ "first_name": "Jane", "last_name": "Doe", "email": "jane_doe@example.com", "is_admin": true, "has_restricted_subuser_access": false }`) response, err := sendgrid.API(request) if err != nil { fmt.Println(err.Error()) os.Exit(1) } else { fmt.Println(response.StatusCode) fmt.Println(response.Body) fmt.Println(response.Headers) } } ``` ```php /sendgrid-php.php'; $apiKey = getenv("SENDGRID_API_KEY"); $sg = new \SendGrid($apiKey); $request_body = json_decode('{ "first_name": "Jane", "last_name": "Doe", "email": "jane_doe@example.com", "is_admin": true, "has_restricted_subuser_access": false }'); try { $response = $sg->client ->sso() ->teammates() ->post($request_body); print $response->statusCode() . "\n"; print_r($response->headers()); print $response->body() . "\n"; } catch (Exception $ex) { echo "Caught exception: " . $ex->getMessage(); } ``` ```ruby require 'sendgrid-ruby' include SendGrid sg = SendGrid::API.new(api_key: ENV['SENDGRID_API_KEY']) data = JSON.parse('{ "first_name": "Jane", "last_name": "Doe", "email": "jane_doe@example.com", "is_admin": true, "has_restricted_subuser_access": false }') response = sg.client.sso.teammates.post(request_body: data) puts response.status_code puts response.headers puts response.body ``` ```bash curl -X POST "https://api.sendgrid.com/v3/sso/teammates" \ --header "Authorization: Bearer $SENDGRID_API_KEY" \ --header "Content-Type: application/json" \ --data '{"first_name": "Jane", "last_name": "Doe", "email": "jane_doe@example.com", "is_admin": true, "has_restricted_subuser_access": false}' ```