[Gabefire]

SDK half of PLT-4662. The API and MCP half shipped in Labelbox/intelligence#31630.

Airbnb runs vendor access through one group of ~490 people attached to ~230 projects, and could not tell who removed people from it. This lets them manage members from a script and read who changed what.

Added

• UserGroup.add_members(members, notify_members=False): adds people with their group roles, without touching other members or projects (unlike update(), which replaces the whole group). Drives continueAddUsersToGroupBatch to completion for large additions. Uses addUsersToGroupsV2.
• UserGroup.remove_members(users, notify_users=True, reason=None, notification_reason=None): uses removeUsersFromGroupV2.
• UserGroup.list_members(): reads current members with their group roles, without overwriting unsaved fields the way get() does.
• UserGroup.audit_events(...) for one group and UserGroup.get_audit_events(client, ...) across every group the caller can manage. Filters: member, actor, actor kind (person or automation), event types, project, time range. Return a PaginatedCollection of UserGroupAuditEvent. Uses userGroupAuditEvents.
• UserGroupAuditEvent, UserGroupAuditEventType, UserGroupAuditActorKind, UserGroupAuditChannel, exported from labelbox, with a docs page. Unknown enum values from the server are kept as strings, as in LabelVersion.

Changes made through these methods are recorded in the audit log as channel=API, for the API key's owner.

Testing

• New unit tests in tests/unit/schema/test_user_group_members_audit.py. All 303 tests in tests/unit/schema pass locally.
• ruff (repo rules), ruff format and mypy pass on the changed files.
• Not yet run against staging. Worth an integration check of add_members and audit_events before release.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes affect access-control workflows (group membership and project access) via new GraphQL mutations; behavior is gated on server APIs and batch-job completion loops, with solid unit coverage but staging integration not yet run per PR notes.

Overview
Adds incremental user group membership APIs and a queryable audit log to the Python SDK, so scripts can add/remove/list members without replacing the whole group via update(), and investigate who changed membership or project attachments.

UserGroup gains add_members (via addUsersToGroupsV2, with automatic continueAddUsersToGroupBatch polling for large adds), remove_members (removeUsersFromGroupV2, with notify/reason options), and list_members (server read that does not overwrite other unsaved fields like get()). UserGroup.audit_events and UserGroup.get_audit_events expose filtered, paginated userGroupAuditEvents (member, actor, type, project, time range).

New module user_group_audit defines UserGroupAuditEvent plus enums for event type, actor kind, and channel; unknown server enum values stay as strings. Types are exported from labelbox and documented in user-group-audit.rst. Unit tests cover mutations, batch continuation, audit filtering/parsing, and validation.

^{Reviewed by Cursor Bugbot for commit 2a47bfa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 2a47bfa. Configure here.}

[cursor]

add_members crashes on missing resources

Medium Severity

add_members indexes the execute result immediately without raise_return_resource_not_found=True. A GraphQL RESOURCE_NOT_FOUND for a missing group or expired batch job returns None, so the subscript raises TypeError instead of ResourceNotFoundError. remove_members already passes the flag, and list_members treats None as missing.

Additional Locations (1)

• libs/labelbox/src/labelbox/schema/user_group.py#L516-L526

 

^{Triggered by learned rule: execute returns None on RESOURCE_NOT_FOUND}

^{Reviewed by Cursor Bugbot for commit 2a47bfa. Configure here.}