Restore a deactivated user: re-enable their sign-in and give them access to the organizations in the request body. That access is the set they end up with, not an addition to whatever they held before deactivation. The user keeps the group-level role they held before deactivation; supply organizationGroupRole only to change it on the way back in. Reactivating an active user simply applies the access in the body.