Member Management¶

The MOI SDK /user surface manages Catalog Service users. It can create users, read lists and details, update profile data or roles, enable or disable users, and delete users. It is not the unified account center’s invitation API. Do not describe create_user or CreateUser as inviting an existing AI Studio account to a workspace.

Methods¶

Operation	Python	Go
Create a user	`create_user(request)`	`CreateUser(ctx, req)`
List users	`list_users(request)`	`ListUsers(ctx, req)`
Read user details	`get_user_detail(request)`	`GetUserDetail(ctx, req)`
Update phone, email, and description	`update_user_info(request)`	`UpdateUserInfo(ctx, req)`
Replace assigned roles	`update_user_roles(request)`	`UpdateUserRoles(ctx, req)`
Enable or disable a user	`update_user_status(request)`	`UpdateUserStatus(ctx, req)`
Reset a password	`update_user_password(request)`	`UpdateUserPassword(ctx, req)`
Delete a user	`delete_user(request)`	`DeleteUser(ctx, req)`

Python uses dictionary requests and responses. The principal Go request types are UserCreateRequest, UserListRequest, UserDetailInfoRequest, UserUpdateInfoRequest, UserUpdateRoleListRequest, UserUpdateStatusRequest, and UserDeleteUserRequest.

Create a user¶

Resolve server-issued role IDs with the role methods described in Permissions and Audit Logs. role_id_list is the complete initial role assignment.

Python

import os

from moi import RawClient

client = RawClient(
    base_url=os.environ["MOI_BASE_URL"],
    api_key=os.environ["MOI_API_KEY"],
)

created = client.create_user(
    {
        "name": "data_reader",
        "password": os.environ["MOI_NEW_USER_PASSWORD"],
        "role_id_list": [401],
        "description": "Read-only integration user",
        "email": "data-reader@example.com",
        "get_api_key": False,
    }
)
print("user id:", created["id"])

resp, err := client.CreateUser(ctx, &sdk.UserCreateRequest{
	UserName:    "data_reader",
	Password:    os.Getenv("MOI_NEW_USER_PASSWORD"),
	RoleIDList:  []sdk.RoleID{401},
	Description: "Read-only integration user",
	Email:       "data-reader@example.com",
	GetApiKey:   false,
})
if err != nil {
	return err
}
fmt.Println("user id:", resp.UserID)

Set get_api_key or GetApiKey to true only when the provisioning flow explicitly needs a key in the creation response. Move a returned key directly to a secret manager; do not write it to logs or tickets.

Paginate the user list¶

List requests support page, page_size, sorting, filters, and keyword. Python places the common paging fields under common_condition. Go embeds CommonCondition in UserListRequest:

page = client.list_users(
    {
        "keyword": "reader",
        "common_condition": {
            "page": 1,
            "page_size": 50,
            "order": "desc",
            "order_by": "created_at",
            "filters": [],
        },
    }
)

for user in page["user_list"]:
    print(user["id"], user["name"], user["status"])

The response contains total and user_list. A synchronizer should continue until the rows read cover total; do not assume an empty keyword disables other filters.

Change roles and status¶

update_user_roles and UpdateUserRoles replace the current role list; they do not append one role. Read the current details, merge the desired state, and submit the complete role_id_list:

detail = client.get_user_detail({"id": 501})
current_ids = {role["id"] for role in detail["role_list"]}
client.update_user_roles(
    {
        "id": 501,
        "role_id_list": sorted(current_ids | {402}),
    }
)

Status requests take id and action. The official integration tests cover the enable and disable actions; do not substitute a Boolean. Read the user again after the write when the final state matters.

Deletion and directory synchronization¶

Deletion uses the stable user ID and is a high-risk write. Check dependencies and audit requirements first. If the call times out, query the user before deciding whether a retry is safe.

For bulk synchronization, plan create, profile update, role replacement, enable/disable, and delete as separate changes. Keep the server-issued user ID as the update key; names and email addresses are matching hints and display data. API keys, plaintext passwords, and complete sensitive error responses must not enter normal application logs.

For the unified account and workspace member workflow in the product, see User Permissions. The target deployment defines how the two user models relate; the SDK itself does not provide a workspace invitation method.