How to programatically remove a user from an org that I invited via email?

[andrewaustin]

Select Topic Area

Question

Body

Hello,

I've building building an integration with github that takes an email and sends an invite to that user for my organization. I'm using the Node.js based @octokit/rest library, so my call is pretty simple:

const inviteResponse = await octokit.rest.orgs.createInvitation({
      org: ORG_NAME,
      email,
      role: 'direct_member'
});

This works great and a successful response looks like:

data: {
    id: 40469002,
    node_id: 'OI_kwDOB2GaAs4CaYIK',
    login: null,
    email: <TEST_EMAIL>,
    role: 'direct_member',
    created_at: '2023-01-28T19:25:20.000-05:00',
    failed_at: null,
    failed_reason: null,
    inviter: {
      login: 'andrewaustin',
      id: 166746,
      node_id: 'MDQ6VXNlcjE2Njc0Ng==',
      avatar_url: 'https://avatars.githubusercontent.com/u/166746?v=4',
      gravatar_id: '',
      url: 'https://api.github.com/users/andrewaustin',
      html_url: 'https://github.com/andrewaustin',
      followers_url: 'https://api.github.com/users/andrewaustin/followers',
      following_url: 'https://api.github.com/users/andrewaustin/following{/other_user}',
      gists_url: 'https://api.github.com/users/andrewaustin/gists{/gist_id}',
      starred_url: 'https://api.github.com/users/andrewaustin/starred{/owner}{/repo}',
      subscriptions_url: 'https://api.github.com/users/andrewaustin/subscriptions',
      organizations_url: 'https://api.github.com/users/andrewaustin/orgs',
      repos_url: 'https://api.github.com/users/andrewaustin/repos',
      events_url: 'https://api.github.com/users/andrewaustin/events{/privacy}',
      received_events_url: 'https://api.github.com/users/andrewaustin/received_events',
      type: 'User',
      site_admin: false
    },
    team_count: 0,
    invitation_teams_url: 'https://api.github.com/organizations/123836930/invitations/40469002/teams',
    invitation_source: 'member'
  }

So far so good. The problem arises when I want to programmatically remove a user using the email address from the org that I added via email. How can I do this? The API to remove a user from only supports removal via username, but I don't know the user's username, just their email.

Another wrinkle is that the invite goes out via email, but the the user can accept the invite for any account which can use any email and username. Is there a way to tie an invite to a username?

I thought maybe the organization's webhooks member_added action might give me some data to tie an invite to a user (if I persist the invite id and the original email, for example). This looks like:

{
    "action": "member_added",
    "membership": {
        "url": "https://api.github.com/orgs/WebhookTestOrg/memberships/LiterallyATestAccount",
        "state": "active",
        "role": "member",
        "organization_url": "https://api.github.com/orgs/WebhookTestOrg",
        "user": {
            "login": "LiterallyATestAccount",
            "id": 123845592,
            "node_id": "U_kgDOB2G72A",
            "avatar_url": "https://avatars.githubusercontent.com/u/123845592?v=4",
            "gravatar_id": "",
            "url": "https://api.github.com/users/LiterallyATestAccount",
            "html_url": "https://github.com/LiterallyATestAccount",
            "followers_url": "https://api.github.com/users/LiterallyATestAccount/followers",
            "following_url": "https://api.github.com/users/LiterallyATestAccount/following{/other_user}",
            "gists_url": "https://api.github.com/users/LiterallyATestAccount/gists{/gist_id}",
            "starred_url": "https://api.github.com/users/LiterallyATestAccount/starred{/owner}{/repo}",
            "subscriptions_url": "https://api.github.com/users/LiterallyATestAccount/subscriptions",
            "organizations_url": "https://api.github.com/users/LiterallyATestAccount/orgs",
            "repos_url": "https://api.github.com/users/LiterallyATestAccount/repos",
            "events_url": "https://api.github.com/users/LiterallyATestAccount/events{/privacy}",
            "received_events_url": "https://api.github.com/users/LiterallyATestAccount/received_events",
            "type": "User",
            "site_admin": false
        }
    },
    "organization": {
        "login": "WebhookTestOrg",
        "id": 123836930,
        "node_id": "O_kgDOB2GaAg",
        "url": "https://api.github.com/orgs/WebhookTestOrg",
        "repos_url": "https://api.github.com/orgs/WebhookTestOrg/repos",
        "events_url": "https://api.github.com/orgs/WebhookTestOrg/events",
        "hooks_url": "https://api.github.com/orgs/WebhookTestOrg/hooks",
        "issues_url": "https://api.github.com/orgs/WebhookTestOrg/issues",
        "members_url": "https://api.github.com/orgs/WebhookTestOrg/members{/member}",
        "public_members_url": "https://api.github.com/orgs/WebhookTestOrg/public_members{/member}",
        "avatar_url": "https://avatars.githubusercontent.com/u/123836930?v=4",
        "description": null
    },
    "sender": {
        "login": "andrewaustin",
        "id": 166746,
        "node_id": "MDQ6VXNlcjE2Njc0Ng==",
        "avatar_url": "https://avatars.githubusercontent.com/u/166746?v=4",
        "gravatar_id": "",
        "url": "https://api.github.com/users/andrewaustin",
        "html_url": "https://github.com/andrewaustin",
        "followers_url": "https://api.github.com/users/andrewaustin/followers",
        "following_url": "https://api.github.com/users/andrewaustin/following{/other_user}",
        "gists_url": "https://api.github.com/users/andrewaustin/gists{/gist_id}",
        "starred_url": "https://api.github.com/users/andrewaustin/starred{/owner}{/repo}",
        "subscriptions_url": "https://api.github.com/users/andrewaustin/subscriptions",
        "organizations_url": "https://api.github.com/users/andrewaustin/orgs",
        "repos_url": "https://api.github.com/users/andrewaustin/repos",
        "events_url": "https://api.github.com/users/andrewaustin/events{/privacy}",
        "received_events_url": "https://api.github.com/users/andrewaustin/received_events",
        "type": "User",
        "site_admin": false
    }
}

Looking at the response, there doesn't seem to be a relationship between the invite and the member_added event, or even the original user's email. Am I missing something? Is there really no way to remove a user via their email, or more importantly via their invite email?

[jge162]

Hello and good day to you @andrewaustin It looks like you're trying to remove a user from your GitHub organization by their email address, but the API you're using (@octokit/rest) only supports removal by username.

a way to work around this issue would be to store the invite_id and original email when you send the invite, then use the organization's webhooks member_added action to match the email to the username. Webhook documentation

pseudocode ->

try {
const inviteResponse = await octokit.rest.orgs.createInvitation({
org: ORG_NAME,
email,
role: 'direct_member'
});
console.log(inviteResponse);
} catch (err) {
console.error(err);
}

[andrewaustin]

@jge162 Thanks for the quick response. I can store the inviteid and the invite email no problem, but the member_added webhook does not include either the invite id or the user's email. (Again, user's email is less useful here because they can accept the invite with any account which could have a different email.)

Have I overlooked something?

[jge162]

That is correct. My original thinking was When a user accepts the invite, the member_added webhook will fire and contain information about the user, including their username. You can use this information to match the email you stored earlier to the username, and then use that username to remove the user from the organization.

[andrewaustin]

When a user accepts the invite the organization's member_added event will certainly fire, but there is no way to tie that event firing to the invite sent out, so there is no way to map it to the email I have. In my original post I include all the data from the webhook in the data: {} block. You can see the invite's id there, however, the user can accept that invite with an account associated with any email. When you accept the invite, the webhook sends you the data in the third block of code. There is no relationship between the two.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[tnsholding]

Having the exact same issue as @andrewaustin - any updates to this problem since last year? - how can you find a link between an email/invitation and the username that ends up accepting the invitation?