Organizations and members
Understand organization membership, invitations, and product sharing.
An organization holds your products, team, role definitions, security policy, and billing identity. Organization membership alone does not give a member access to a product; that requires a product grant.
For a first-time walkthrough, use Set up your team.
Create and select an organization
Your first-product screen can create the organization and make you its owner. You can also create one explicitly with organization_create, supplying a name of 1–100 characters. Accepting an invitation joins the existing organization without creating another one.
organization_list lists your organizations. organization_select sets the active organization and resolves its active product. Selecting a product also aligns the active organization. Organization routes use this selection; there is no organization slug in the URL.
Invite or add a person
Owners and admins can invite people with organization_member_invite. It takes organizationId, email, and an organization role of owner, admin, or member.
Email status | Outcome |
|---|---|
Already registered | The person is added directly. The result is added; no email or token is created. |
Not registered | A pending invitation is emailed. The result is invited; its token is valid for seven days. |
Optional productShares grant selected products during the same operation. Each entry names a productId and exactly one access description: preset role, custom roleId, or permissions with allow and deny. An optional expiresAt time-bounds the share.
A role definition’s permissions are copied when the invitation is created. Editing or deleting the definition later does not change an existing grant or invalidate a pending invitation.
Acceptance and invitation management
The invited person opens the link and accepts. organization_member_accept-invite takes its token. On acceptance, a member receives the invitation’s product shares; owners and admins receive access to every product in the organization.
Operation | Tool |
|---|---|
List invitations | |
Revoke a pending invitation | |
List members and their grants | |
Inspect one member’s product access |
The product-access management view includes expired grants and their expiresAt, so a listed record does not necessarily mean access is still active. It also reports effective allow and deny permissions and the source role definition, if one was used.
Change or remove access
Action | Effect |
|---|---|
Change organization role | Owner-only. organization_member_set-role accepts admin or member. It is not an ownership-transfer call. |
Share a product | organization_member_share-product grants an existing member one product, using a role, role definition, or permission object and optional expiry. |
Unshare a product | organization_member_unshare-product removes its explicit grant, but not access derived from owner/admin membership. |
Remove a member | organization_member_remove removes organization membership and the member’s product grants there. |
Promoting a member to admin creates access to the organization’s products. Demoting to member removes role-derived grants while keeping explicit shares.
Transfer ownership
In the web app, open the organization profile and use its ownership-transfer dialog. Only the current owner can transfer ownership, and the recipient must already be a member of the organization.
UI-only: Ownership transfer is available in the web app; there is no MCP tool for it.
Organization controls and lifecycle
Only the owner can rename the organization, change its two-factor policy, read its billing summary, or delete it. Owners and admins manage invitations, product shares, and custom role definitions; changing a member’s organization role is owner-only.
The organization holds the billing email, payer identity, and optional product limit. Product usage is attributed within that organization.
An organization may have no products and is not automatically removed when empty. Archiving and blocking are separate states that cascade to its products. Deleting archives the organization and its products; restoration and permanent erasure are not self-service organization operations.