[gricha]

Service accounts can't invite, edit, remove or provision members. They can still list members. Drops the four member files from the request.user allowlist (5 → 1).

• Member detail endpoints (OrganizationMemberEndpoint: member details, member teams, invite request details, SCIM member details) set requires_user. They already returned 404 to API keys; a service account now gets 403 user-required, also when reading a single member (it used to get 200).
• SCIM (SCIMEndpoint: users, teams, schemas) sets requires_user. A service account with member:write could provision members through SCIM on an SCIM-enabled org; it now gets 403. SCIM's real caller is the SCIM token's proxy user, which is unaffected.
• Invites and invite requests (POST members/, POST invite-requests/) call require_user() first and record the inviter from it.
  • A service account gets 403. Before, it got a role validation 400 for invites, or reached the write and failed on its ServiceAccountId.
  • A legacy API key never had an org role to invite with (every role was a 400); it now gets 401. Integration tokens still work, since their caller is the integration's proxy user. Production had no invite or invite request without a user in the last 30 days (0 of 5,760 sampled invites).

The new service-account tests fail without this change:

test_service_account_cannot_read_member          assert 200 == 403
test_service_account_cannot_invite               assert 400 == 403   (role validation)
test_service_account_cannot_request_invite       assert 400 == 403   (role validation)
test_service_account_cannot_provision_users      assert 201 == 403   (SCIM created the member)

(test_service_account_cannot_remove_member already got 403 before, from the ServiceAccountId guard.)

With it, the member index, details, team-details, invite-request and SCIM suites pass, and the endpoint parity matrix moves the member and SCIM rows to user-required (318 passed). The two API-key tests from #129538 now expect 401, and still check that nothing is created.

[github-actions]

decision-model-linter

api

src/sentry/core/endpoints/organization_member_index.py

• warn readsRequestBodyOutsideSerializer = TRUE (0.91): Request body values should be read from a serializer's validated_data. This file reads a value directly from request.data or request.POST.

_{decision-model-linter: 18 calls on 6 files, 37,935 input tokens, $0.0016, model typesafe/jev-1.13-20260917}

[sentry]

Sentry Snapshot Testing

Name	Added	Removed	Changed	Renamed	Unchanged	Skipped	Status
sentry-frontend sentry-frontend	0	0	0	0	780	0	✅ Unchanged

⚙️ sentry-frontend Snapshot Settings