Organization User
OrganizationUser
Represents an individual user within the Infrastream platform.
Serves as the primary identity record for a person, capturing their legal identity, primary email, and links to external accounts (e.g., GitHub). Used to provision centralized identities and manage access configurations structurally.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as an OrganizationUser so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant OrganizationUser. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, organization) are read by the engine to resolve this manifest's identity and its parent Organization in the dependency graph. |
| spec | Spec | Desired user configuration. The authoritative, user-authored specification for this OrganizationUser. See Spec. |
Spec
Desired user configuration.
The authoritative, user-authored specification for this person: their legal name, the Google account they sign in with, links to accounts in external systems, and any additional email addresses.
| Property | Type | Description |
|---|---|---|
| identity | Identity | Legal name of the user. Identity components used to provision a centralized identity in the organization's identity provider. The email address is not derived from these — it is declared explicitly in primaryEmail. See Identity. |
| externalAccounts | list of UserExternalAccount | Accounts in external systems. The user's accounts in external systems such as GitHub. These are resolved during computation to map the user onto GitHub team and repository access; they do not directly provision GCP IAM bindings. |
| emailAliases | list of string | Additional email addresses. Secondary, fully-qualified addresses (e.g. ashley.m@pvotal.tech) associated with the user alongside primaryEmail. Under GoogleWorkspace federation these are provisioned as directory aliases. Under InfrastreamManaged they are recognised when resolving an already-authenticated caller, but are not registered with Google — the user still signs in as primaryEmail. |
| primaryEmail | string | The user's Google account. Required. The address of a Google account the user already owns — a consumer account, a Workspace account, or any email registered as a Google identity. Infrastream does not create this account: under InfrastreamManaged federation it allowlists the address in the organization's identity platform and binds it as an IAM principal, so an address that does not name a real Google identity will neither sign in nor receive access. Under GoogleWorkspace federation, where Infrastream provisions the account itself, this is the address it creates. |
Identity
Legal name components of the user.
The user's first, middle, and last names. The first and last names are combined to form the display name of the provisioned identity.
| Property | Type | Description |
|---|---|---|
| firstName | string | Legal first name. The user's given name. Used to build the display name of the provisioned identity. |
| middleName | string | Legal middle name. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it); the display name is built from the first and last names only. Intended for future use as an optional identity component. |
| lastName | string | Legal last name. The user's family name. Used to build the display name of the provisioned identity. |
UserExternalAccount
Maps a platform user to an external identity system.
Facilitates adding users to GitHub Orgs/Teams and maintaining synchronicity between internal user definition and external SSO representations.
| Property | Type | Description |
|---|---|---|
| sourceType | string | External identity system type. The kind of external system hosting the account. Currently only GITHUB is supported. |
| sourceName | string | Connection manifest for the account. The name of the GithubConnection manifest that this external account belongs to, identifying the org/instance the username is resolved against. |
| username | string | External login name. The user's login or username in the external system, used to add them to the corresponding GitHub org/team. |