> ## Documentation Index
> Fetch the complete documentation index at: https://docs.member.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Transfer Ownership



## OpenAPI

````yaml /openapi/mio-openapi.json post /api/v1/admin/teams/{team_id}/hubs/{hub_id}/ownership-transfer
openapi: 3.1.0
info:
  description: >-
    Production API reference for Membership.io. Use the authored guides for
    workflows and the generated endpoint pages for exact parameters and schemas.
  title: Membership.io API
  version: 0.1.0
servers:
  - description: Production
    url: https://api.member.dev
security:
  - bearerAuth: []
paths:
  /api/v1/admin/teams/{team_id}/hubs/{hub_id}/ownership-transfer:
    post:
      tags:
        - hub-memberships-admin
      summary: Transfer Ownership
      operationId: >-
        hub_memberships_admin.post_hub_memberships_admin_post_admin_teams_by_team_id_hubs_by_hub_id_ownership_transfer
      parameters:
        - in: path
          name: team_id
          required: true
          schema:
            title: Team Id
            type: string
        - in: path
          name: hub_id
          required: true
          schema:
            title: Hub Id
            type: string
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              $ref: '#/components/schemas/HubOwnershipTransferRequest'
        required: true
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiResponse_HubMembershipAttributes_'
          description: Successful Response
        '404':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiErrorResponse'
          description: >-
            Not found. errors[0].code is always "ownership_transfer_not_found" —
            covers both: the hub does not resolve under this team, OR
            new_owner_contact_id has no hub_memberships row on this hub at all.
        '409':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiErrorResponse'
          description: >-
            Conflict. errors[0].code distinguishes the reason clients must
            branch on: "no_current_owner" / "multiple_owners" (corrupted
            precondition — the hub has zero or 2+ role='owner' rows);
            "current_owner_not_eligible" (the outgoing owner is
            banned/soft_banned/left/soft-deleted and force was not set);
            "owner_changed_concurrently" (a concurrent write changed ownership
            between this request's read and its write — retry);
            "recipient_not_eligible" (the incoming member is
            banned/soft_banned/left, or their contact is soft-deleted — force
            never overrides this one).
        '422':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/JsonApiErrorResponse'
          description: >-
            Validation error. errors[0].code is "invalid_ownership_transfer" —
            covers an out-of-range demote_to (also enforced by the request
            schema's Literal) and new_owner_contact_id equal to the current
            owner when it is NOT eligible for the idempotent no-op path.
      security:
        - HTTPBearer: []
components:
  schemas:
    HubOwnershipTransferRequest:
      additionalProperties: false
      properties:
        data:
          $ref: '#/components/schemas/HubOwnershipTransferData'
      required:
        - data
      title: HubOwnershipTransferRequest
      type: object
    JsonApiResponse_HubMembershipAttributes_:
      properties:
        data:
          $ref: '#/components/schemas/JsonApiResource_HubMembershipAttributes_'
        included:
          anyOf:
            - items: {}
              type: array
            - type: 'null'
          title: Included
        links:
          anyOf:
            - $ref: '#/components/schemas/JsonApiLinks'
            - type: 'null'
        meta:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Meta
      required:
        - data
      title: JsonApiResponse[HubMembershipAttributes]
      type: object
    JsonApiErrorResponse:
      description: Error JSON:API response.
      properties:
        errors:
          items:
            $ref: '#/components/schemas/JsonApiError'
          title: Errors
          type: array
        meta:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Meta
      required:
        - errors
      title: JsonApiErrorResponse
      type: object
    HubOwnershipTransferData:
      additionalProperties: false
      properties:
        attributes:
          $ref: '#/components/schemas/HubOwnershipTransferAttributes'
        type:
          const: hub_memberships
          title: Type
          type: string
      required:
        - type
        - attributes
      title: HubOwnershipTransferData
      type: object
    JsonApiResource_HubMembershipAttributes_:
      properties:
        attributes:
          $ref: '#/components/schemas/HubMembershipAttributes'
        id:
          title: Id
          type: string
        links:
          anyOf:
            - $ref: '#/components/schemas/JsonApiLinks'
            - type: 'null'
        meta:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Meta
        relationships:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Relationships
        type:
          title: Type
          type: string
      required:
        - id
        - type
        - attributes
      title: JsonApiResource[HubMembershipAttributes]
      type: object
    JsonApiLinks:
      properties:
        self:
          anyOf:
            - type: string
            - type: 'null'
          title: Self
      title: JsonApiLinks
      type: object
    JsonApiError:
      properties:
        code:
          anyOf:
            - type: string
            - type: 'null'
          title: Code
        detail:
          anyOf:
            - type: string
            - type: 'null'
          title: Detail
        id:
          anyOf:
            - type: string
            - type: 'null'
          title: Id
        meta:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Meta
        source:
          anyOf:
            - additionalProperties:
                type: string
              type: object
            - type: 'null'
          title: Source
        status:
          title: Status
          type: string
        title:
          title: Title
          type: string
      required:
        - status
        - title
      title: JsonApiError
      type: object
    HubOwnershipTransferAttributes:
      additionalProperties: false
      description: >-
        Request body for POST .../ownership-transfer.


        ``new_owner_contact_id`` must already hold a hub_memberships row (no

        fresh enrolment happens here). ``force`` widens the current-owner

        eligibility check (banned/soft_banned/left/soft-deleted-contact) — it

        never bypasses the recipient-eligibility check or the "must actually be

        the current owner" re-verification under lock.


        ``demote_to`` is only honored when ``force=false``; when ``force=true``

        the old owner is ALWAYS stripped to a regular member (``role=None``),

        regardless of this field's value — a demoted-but-still-"admin" owner

        would otherwise keep delegated-moderation ban-immunity and pin/lock/move

        power, defeating the point of a forced (compromised-owner) transfer.


        ``demote_to`` is REQUIRED — deliberately no default (dual-review F3).

        ``"admin"`` sits in ``PROTECTED_TARGET_ROLES``,
        ``MODERATION_CONSOLE_ROLES``,

        ``ELEVATED_PIN_ROLES``, ``DISCUSSION_LOCK_ROLES``,
        ``DISCUSSION_MOVE_ROLES``,

        and ``CONTENT_REMOVE_ROLES`` — 6 of 8 elevated-power sets in this
        codebase

        — so a silent "admin" default would mean the NEW owner cannot ban the

        person they just replaced (403 "cannot ban a protected hub member")

        without the caller ever having chosen that outcome. The caller must

        state intent explicitly: pass ``"admin"``, ``"moderator"``, or ``null``.
      properties:
        demote_to:
          anyOf:
            - enum:
                - admin
                - moderator
              type: string
            - type: 'null'
          title: Demote To
        force:
          default: false
          title: Force
          type: boolean
        new_owner_contact_id:
          title: New Owner Contact Id
          type: string
      required:
        - new_owner_contact_id
        - demote_to
      title: HubOwnershipTransferAttributes
      type: object
    HubMembershipAttributes:
      description: |-
        Attributes for a hub_memberships resource object.

        Per JSON:API spec §"Resource Objects": id and type are excluded.
        hub_id and contact_id are lifecycle context, NOT access state.
      properties:
        ban_reason:
          anyOf:
            - type: string
            - type: 'null'
          title: Ban Reason
        banned_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          title: Banned At
        contact_id:
          title: Contact Id
          type: string
        created_at:
          format: date-time
          title: Created At
          type: string
        hub_id:
          title: Hub Id
          type: string
        last_seen_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          title: Last Seen At
        notification_prefs:
          additionalProperties: true
          title: Notification Prefs
          type: object
        onboarded_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          title: Onboarded At
        role:
          anyOf:
            - type: string
            - type: 'null'
          title: Role
        status:
          default: active
          title: Status
          type: string
        team_id:
          title: Team Id
          type: string
        tos_acceptance_required:
          default: false
          title: Tos Acceptance Required
          type: boolean
        tos_accepted_at:
          anyOf:
            - format: date-time
              type: string
            - type: 'null'
          title: Tos Accepted At
        tos_accepted_version:
          anyOf:
            - type: string
            - type: 'null'
          title: Tos Accepted Version
        updated_at:
          format: date-time
          title: Updated At
          type: string
        welcome_email_sent:
          default: false
          title: Welcome Email Sent
          type: boolean
      required:
        - hub_id
        - contact_id
        - team_id
        - notification_prefs
        - created_at
        - updated_at
      title: HubMembershipAttributes
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT or mio_sk API key
      description: >-
        Send platform JWTs, contact JWTs, or team API keys as `Authorization:
        Bearer <token>`.
      scheme: bearer
      type: http
    HTTPBearer:
      scheme: bearer
      type: http

````