persons

📄️Create a person below the caller scope

Requires `Idempotency-Key`. The person is a leaf below `parentPath` (default: the caller scope path); a parent outside the caller scope, or a parent that is itself a person, is refused. `givenName`, `familyName` and `email` are personal data: stored encrypted under the person's own key, never logged, and absent from the reply once the person is erased. An address another person already has (compared without regard to case) is refused with 409 and code `person.email_taken`. `invitation` says where the invitation stands.

📄️Read one person

A person that does not exist and one outside the caller scope get the same 404. After erasure the reply has `erased: true` and no personal field.

📄️Invite a person to the staff realm again

Requires `Idempotency-Key`; takes no body. Sends a fresh invitation to the address on file, for an invitation that expired, failed or was never asked for. An invitation still in progress is answered as it stands and nothing new is sent. Takes the `person.create` permission. An erased person, and one with no address on file (the root account), are refused with 409 `state`.