53 "notes": "Members V1 login email in the create-member request body."
54 }
55 ],
56 "fallbacks": [
57 {
58 "classification": "crm",
59 "when": "Use Contacts for person records that do not need login identity."
60 },
61 {
62 "classification": "cms",
63 "when": "Use for author profiles or member metadata not represented by Members APIs."
64 }
65 ],
66 "reliability": {
67 "status": "unreliable",
68 "flags": [
69 "IMPORT_UNRELIABLE"
70 ]
71 },
72 "pitfalls": [
73 {
74 "code": "safe-mode-email-domain-rejected",
75 "severity": "blocker",
76 "summary": "VERIFIED LIVE 2026-08-16: safe mode cannot import members at all today. `mockEmailForEntity` (rp-target-wix/lib/wix-writers.js) mints `replatform+<type>_<id>@wix.com`, and POST /members/v1/members rejects that domain with 400 INVALID_EMAIL_DOMAIN — so a safe-mode member import fails wholesale on the first record. The bug hid because Contacts V5 ACCEPTS @wix.com (existing test contacts use it), so only the Members surface trips it. A reserved-TLD address (RFC 2606 `.invalid`) was accepted by other surfaces in the same probe session and is the obvious candidate, but changing the safe-mode address format alters what gets written to a customer's site on every entity, not just members — it needs an explicit decision, not a silent lib patch. Until then: treat safe mode + member import as unsupported and say so in the plan rather than discovering it mid-run."
77 },
78 {
79 "code": "passwords-never-imported",
80 "severity": "warning",
81 "summary": "Passwords are NOT imported — project decision (2026-08-03), not just an API gap. Members keep account/profile/contact linkage; they set a new password via reset. Never propose hash import."
82 },
83 {
84 "code": "activation-via-forgot-password",
85 "severity": "warning",
86 "summary": "Activation (decided 2026-08-03): passwordless members complete the standard forgot-password flow (confirmed). Delivery = post-import automation (label-added trigger, owner-branded email, label applied in API waves). Never mass-send Send Set Password Email — its link dies in 3h."
87 },
88 {
89 "code": "serial-create-only",
90 "severity": "warning",
91 "summary": "No bulk member create; documented >=1s spacing per Create Member call (10k members ~ 3h serial floor). Plan throughput and resume via loginEmail crosswalk."
92 },
93 {
94 "code": "chronology-server-controlled",
95 "severity": "warning",
96 "summary": "Original createdDate and lastLoginDate are not writable as native member chronology."
97 }
98 ],
99 "mappingGuidance": [
100 "Split author, customer, contact, and login-member roles before selecting targets.",
101 "Create Member sends no email and does not fire the signup automations trigger (source-confirmed) — silent import is the default; the only member-facing email is the explicit Send Set Password Email call, which is per-member, interactive-mode, owner-approved only."
102 ],
103 "setupRequirements": [
104 "Activation is decided end-to-end: no credential import; post-import the owner creates ONE dashboard automation (label-added trigger → branded email directing members to Log in → Forgot password), then the importer applies the label in API waves for rate control and re-targeting. Enable the automation only after the import window (AUTO-02 pause choreography)."