IBM Cloud User Management API - Invite users - Forbidden - ibm-cloud

Question

i'm getting an error while trying to invite a user to an ibm cloud account by REST API.
The error says that the IMS account is not valid.
Does anyone know whats an IMS Account?
here is my request:
curl -X POST \
https://user-management.cloud.ibm.com/v2/accounts/&MYACCOUNT/users \
-H 'Authorization: Bearer $TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"users": [
{
"email": "myuser#ibm.com",
"account_role": "Member"
}],
"iam_policy": [
{
"roles": [
{
"id": "crn:v1:bluemix:public:iam::::role:Viewer"
}]
}]
}'
And the respsonse:
{
"trace": "558156745",
"errors": [
{
"code": 9999,
"message": "Not Authenticated.",
"more_info": "IMS account id from token is incorrect."
}
]
}
Any ideas how to handle this ?

Answer 1

API keys on IBM Cloud are tied to either a user or can be for a service ID, a specific service and more. The API keys for user IDs and service IDs can be used to generate an IAM (authentication) token.
When you call into a REST API and use a token, it is checked that the token is not expired, belongs to a valid user and if the required privileges are held to execute that desired function.
If you want to invite a user to an account and want to grant privileges as part of that invitation process, you would need to use a user ID with the privilege to invite to that specific account. It can be different for any account in an enterprise hierarchy, including the enterprise account. On top of that, the privileges to grant the desired roles or resource access is needed. If one is missing, it gives an error message (not always the best).