Members
How to add people to a network, help them when they can't sign in, and take access away, plus how Arbor records the relationships between them.
Overview
A member is an Arbor Element of type Node that can sign in. It usually points at the Contact it stands for, or at any other record, through SFDC Record ID. That link is how your own pages know whose data to show.
People join a network one of three ways:
| Way | Who acts | What the person does |
|---|---|---|
| Provision, nothing sent | You, or automation | Nothing. You hand them their link. |
| Provision with a welcome email | You, or automation | Opens the link, or sets a password from the invitation. |
| Self sign-up | The person | Signs up on the Registration Form. |
Provisioning a member
The Provision Arbor Member card sits on every network's record page. It can go on any app, home or record page too, as Flourish Arbor: Provision Member in Lightning App Builder.
- Pick the Network. The card starts empty even on a network's own page.
- Pick the Auth Method. Only the network's allowed methods are listed.
- Pick the Delivery: None - return the link to me, or Send a welcome email.
- Fill in Email, Display Name, and if you like a Username (it defaults to the email).
- Tie the member to a record: put an existing record's Id in Record ID, or fill in First Name and Last Name and leave Record ID empty to create a new Contact. Duplicate rules do not stop that Contact. With neither, the member is tied to no record.
- Tick any Roles (optional) the member should hold. The list appears only when the network has roles.
- Click Provision.
The card answers Member provisioned. Status: and the member's status. For a link member with nothing sent, it also shows the Access link with a copy button.
What each method allows:
| Auth Method | None - return the link to me | Send a welcome email |
|---|---|---|
| Magic Link, One-Time Magic Link | The link appears on the card for you to pass on. | Arbor emails the link. |
| Password | Refused. The member has to choose a password, which only the invitation lets them do. | Arbor emails a setup invitation to the network's Registration Site URL, where the member chooses a password. |
| Email Code, Username | The member can sign in on the Login Form at once. | The same. There is nothing to deliver, so no email is sent. |
| Authenticator App (TOTP) | Refused: TOTP cannot be provisioned as a primary method yet. Enroll it after sign-in, or use it as a second factor. | Refused, the same. |
- A welcome email needs an Email.
- Link methods need the network's Auth Site URL. The card warns This network needs an Auth Site URL before a magic link can be issued. and will not submit.
- A one-time link from provisioning lasts seven days. A Flow or Apex can set a different lifetime.
One member per person
Within a network, no two members share a username, and no two share an email address. Case does not matter, and suspended members count. Provisioning someone who is already a member is refused before anything is created, with a message naming what matched and the member's status, for example This network already has a member with this email address (Active). Open their record to help them sign in. A suspended member's message says to reactivate them instead. The card adds a View member link to their record.
The same rule holds however a member is saved, including editing the record or loading data. A clash fails with Another member of this network already has this username. or Another member of this network already has this email address. To get an existing member back in, use Member Access.
From a Flow
Add an Action element and choose Provision Arbor Member, in the Arbor category. It provisions one member each time it runs, under the same rules as the card, and works in record-triggered and scheduled Flows.
| Input | Required | What it takes |
|---|---|---|
| Network ID | Yes | The network's Id. |
| Auth Method (e.g. LINK, LINK_ONCE) | Yes | LINK, LINK_ONCE, PASSWORD, EMAIL_CODE or USERNAME. Must be allowed on the network. |
| Delivery (NONE or WELCOME_EMAIL) | No | NONE, the default, returns the link; WELCOME_EMAIL sends it. |
| Record ID (bind an existing record) | No | The record to tie the member to, for example {!$Record.Id}. |
| Email, Username, Display Name | No | As on the card. |
| First Name (creates a Contact), Last Name (creates a Contact) | No | Create a Contact when there is no Record ID. |
| One-Time Link TTL (seconds) | No | How long a LINK_ONCE link lasts. Defaults to seven days. |
| Roles (separated by semicolons) | No | For example Staff;Volunteer. Each must be one of the network's roles, in any case. A multi-select picklist value can be passed in as it is. An unknown role refuses the request before anything is created. |
| Output | What it tells you |
|---|---|
| Success | Whether the member was created. |
| Element ID | The new member's Id. |
| Record ID | The record the member is tied to, including a Contact the action created. |
| Auth Status | Provisioned or Invited. |
| Login URL (when delivery = NONE) | The link, for a link member with nothing sent. |
| Error Message | Why it failed, when Success is false. |
| Existing Member ID (when already a member) | The member who already holds this username or email, when that is why it failed. |
Running it for someone who is already a member does no harm. Success comes back false with Existing Member ID set, so the Flow can branch on it: skip them, or reactivate a suspended member. Even so, on a record-triggered Flow, choose to run only when a record is updated to meet the condition requirements, so ordinary edits don't call it. Keep batches small: every member is its own record inserts and, often, an email.
Status
Auth Status on the member record tracks where they are:
| Auth Status | Meaning |
|---|---|
| Provisioned | Created with nothing sent. |
| Invited | Sent a welcome email or invitation, or signed up by link, and has not used it yet. |
| Active | Has used a link, finished setting up a password, signed up with a password, or been reactivated. |
| Suspended | Access switched off. See Suspending a member. |
Status only moves on those events, so an Email Code or Username member keeps the status they were provisioned with after they start signing in.
Roles
A role says what a member is in their network: Staff, Volunteer, Board Member, whatever the network lists in its Roles field. Arbor only records them. Apps built on the network use them to decide what a member can reach, as a Flourish Core portal does.
A member is given roles in any of three places:
- When they are provisioned, on the card or from the Flow action.
- In Member Access, under Roles.
- On the record itself, in the member's Roles field, with roles separated by semicolons:
Staff;Volunteer. Data loads and your own Flows can set it the same way.
However a role arrives, Arbor checks it against the network's list on save and spells it the way the network does. Anything else is refused:
| Problem | Message |
|---|---|
| A role the network doesn't list | Not a role in this network: Coach. Its roles are: Staff, Volunteer. |
| The network lists no roles at all | This network has no roles yet. Add them to the network's Roles field first. |
| The record is a relationship, or has no network | Only a member (a Node in a network) can hold roles. |
Someone in two networks is two members, so they hold roles in each separately.
A member who cannot sign in holds no roles as far as an app is concerned: a suspended member, a password member who has not set up their account, and every member of an Inactive network. Their roles stay on the record and count again once they can sign in.
The Members tab
The Members tab on a network lists everyone who can sign in, with their Username, Name, Email and Status, in alphabetical order by username. Once anyone in the network holds a role, a Roles column joins them. Click a username to open the member.
- Show filters by status: Active (the default), Pending (Provisioned and Invited), Suspended or All.
- The search box matches any part of a username, email address, name or role as you type. It searches within the status chosen under Show; when nobody matches there but someone does in another status, it offers Search all members.
The Elements tab beside it lists every element in the network, relationships included.
Member Access
Every member's record page has a Member Access panel. The top shows their name, username, status, Sign-in method and MFA, and their Roles when the network has any. Below that, each action appears only when it applies to this member.
Sign in as this member
Log in as member opens a new tab signed in as the member, to see what they see or reproduce a problem. It works whatever their sign-in method, even for a suspended member, and skips any second factor. Nothing about the member changes: their password, links and authenticator stay as they were, and the browser is not remembered for them.
The link behind it works once and expires in 5 minutes. If the browser blocks the new tab, the link appears in the panel to open yourself. The button needs the network to have an Auth Site URL and not to be Inactive.
No record is kept of who signed in as whom.
Help this member sign in
| Shown for | Button | What it does |
|---|---|---|
| Link members | Email sign-in link | Emails a fresh link. The old one stops working. |
| Link members | Generate link to share | Shows a fresh link with copy and open buttons, and emails nothing, for you to pass on another way. The old one stops working. |
| Password members who have set a password, on a network that allows Password | Email password reset code | Emails the member a reset code that works for 10 minutes. On the Reset Password page they enter their username or email and choose I already have a code. |
| Password members still to set one | Resend setup invitation | Sends the setup invitation again. |
| Suspended members | Reactivate member | Restores access. A link member then needs a fresh link. |
When nothing applies, the panel says so and suggests checking the network's allowed methods and Auth Site URL.
Multi-factor authentication
| Button | What it does |
|---|---|
| Require authenticator | Makes the authenticator app this member's second factor. They must have set one up already. |
| Require email code | Makes an emailed code their second factor. They must have an email on file. Not offered to members who sign in by link or emailed code, since a second email to the same inbox adds nothing. |
| Remove MFA | Removes their own second factor. |
| Reset authenticator | Shown when they have an app set up. Clears it so they can set up a new one, and if it was their second factor, removes that too. Refused when the app is how they sign in, since that would lock them out. |
These set the member's own second factor. The network's MFA Policy still applies on top, and the stricter of the two wins. A link member with a second factor is asked for their authenticator code after opening the link.
Roles
When the network lists roles, the Roles section shows them as checkboxes. Tick the ones this member holds and click Save roles. Clearing every box and saving removes them all.
If the member still carries a role the network has since dropped, the section names it under Also stored. It grants nothing, and saving removes it.
Signed-in devices
On a network that keeps members signed in, the panel lists the browsers the member stays signed in on, with when each was last used. Sign out one with its icon, or all of them with Sign out all devices.
Suspending a member
Suspending switches a member off: they cannot sign in, their status becomes Suspended, any link they hold stops working, and they are signed out everywhere, including a page they have open, the next time it checks their session. Their record and its history are kept.
In Member Access, Suspend member sits under Member status and asks you to confirm first. Reactivate with Reactivate member, which appears in its place; a link member then needs a fresh link. Automation can do either from Apex: see the Developer Guide.
Elements and relationships
Every record in a network is an Arbor Element, and its Type is one of two:
| Type | What it is |
|---|---|
| Node | A person or entity. Every member is a node. |
| Edge | A relationship from one element to another: Source Element to Target Element, with the relationship in Display Name, for example mentors. What the direction means is up to you. |
Two rules are checked on save. An edge needs both ends: An Edge must connect two elements. Set both Source Element and Target Element. A node can have neither: A Node cannot have a Source or Target Element (those define an Edge). Clear the endpoints, or set Type to Edge. Nothing else is restricted, so an edge may join elements in different networks, or an element to itself.
To add a relationship, open the network's Elements tab, click New, choose Edge, and set the two elements and a Display Name.
On an element's record page, the Connected Elements tab lists the edges that start or end at it. Reference ID (REF-00000000) is the record's system name; Display Name is the one people read.