通过REST API（PowerShell）邀请用户加入Azure DevOps项目失败求助

已成功通过PowerShell脚本获取Azure DevOps项目ID，但调用User Entitlements API邀请用户并分配项目权限时失败。成功获取Project ID的脚本如下：

$OrganizationName = "ExampleOrg"
$projectName = "ExampleProject"

$AzureDevOpsAuthenicationHeader = @{Authorization = 'Basic ' + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$($env:AZ_Dev)")) }

$UriOrga = "https://$($OrganizationName).visualstudio.com/" 
$uriAccount = $UriOrga + "_apis/projects?api-version=6.0"
$response = Invoke-RestMethod -Uri $uriAccount -Method get -Headers $AzureDevOpsAuthenicationHeader 

$Project = $response.value | Where-Object { $_.Name -eq $projectName }
$ProjectID = $Project.id
Write-Output $ProjectID

失败原因分析 #

调用邀请接口的脚本存在3个关键错误，导致操作失败：

• extensions和projectEntitlements应为数组类型，原脚本写成了单个对象，不符合API请求格式要求
• 项目权限组参数错误：应使用groupName而非groupType指定权限组名称
• ConvertTo-Json未指定足够的深度，嵌套结构会被截断

修复后的完整脚本 #

$OrganizationName = "ExampleOrg"
$projectName = "ExampleProject"
$targetUserEmail = "example@gmail.com"

# 1. 获取项目ID（复用原有逻辑）
$AzureDevOpsAuthenicationHeader = @{Authorization = 'Basic ' + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$($env:AZ_Dev)")) }
$UriOrga = "https://$($OrganizationName).visualstudio.com/" 
$uriAccount = $UriOrga + "_apis/projects?api-version=6.0"
$response = Invoke-RestMethod -Uri $uriAccount -Method Get -Headers $AzureDevOpsAuthenicationHeader 
$Project = $response.value | Where-Object { $_.Name -eq $projectName }
$ProjectID = $Project.id
Write-Output "获取到的项目ID：$ProjectID"

# 2. 修复后的用户邀请脚本
$AZurl = "https://vsaex.dev.azure.com/$OrganizationName/_apis/userentitlements?api-version=7.0"

$AZbody = @{
  accessLevel = @{
    accountLicenseType = "Stakeholder"
  }
  # 改为数组格式，支持多个扩展
  extensions = @(
    @{
      id = "ms.feed"
    }
  )
  user = @{
    principalName = $targetUserEmail
    subjectKind = "user"
  }
  # 改为数组格式，支持多个项目权限分配
  projectEntitlements = @(
    @{
      group = @{
        groupName = "Contributors"  # 修正为groupName参数
      }
      projectRef = @{
        id = $ProjectID
      }
    }
  )
} | ConvertTo-Json -Depth 10  # 指定足够深度避免嵌套结构截断

try {
  $AZresponse = Invoke-RestMethod -Uri $AZurl -Method Post -ContentType "application/json" -Body $AZbody -Headers $AzureDevOpsAuthenicationHeader
  Write-Output "用户邀请成功，返回信息："
  $AZresponse | Format-List
}
catch {
  Write-Error "请求失败：$($_.Exception.Message)"
  # 输出详细错误响应
  if ($_.ErrorDetails.Message) {
    Write-Output "API错误详情：$($_.ErrorDetails.Message)"
  }
}

补充说明 #

• 若需要分配多个项目权限，可在projectEntitlements数组中添加更多对象
• 若不需要扩展权限，可移除extensions字段或设为空数组@()
• 确保使用的PAT（个人访问令牌）拥有User Management (Read & Write)和Project Collection Administrator权限

内容的提问来源于stack exchange，提问作者Shez Bhagwandin