create
POST /groups/{group}/users/{user}

• validate that user is not yet in group