tenant-user role for read-only portal access or tenant-admin for full management access.
Inviting a user who already has a Cognito account (from another tenant) adds them to your tenant without creating a duplicate account. The response action field indicates whether the user was created or updated_existing.