Workspace members
A workspace belongs to the people in it. Each member has a role: owner, admin or member. The role decides who can issue API keys, change guardrails, and invite or remove people.
Invite a person
A person joins a workspace only when they accept an invitation. An owner or an admin invites them by email address. The person does not need an account first.
- Open Members in an organization, or Settings in another workspace. Select Invite people.
- Enter the email address that the person signs in with.
- Choose a role. The default is Member. Only an owner of the workspace can invite an owner.
- Select Create invitation. The exchange emails the link to the address.
- If the dialog says that the email was not sent, copy the link that it shows and send it to the person.
The invitation gives no access until the person accepts it. Organizations describes how the person accepts, and how to withdraw or send an invitation again.
Two rules apply:
- To join a workspace under an organization, a person must be a member of the organization, because each member spends its balance. The exchange refuses the invitation, and its acceptance, while the person is not in the organization (
not_in_organization). Invite them to the organization first. - A new member can spend the balance of the workspace. So you must have signed in recently to invite a person, change a role or remove a member. If the console asks you to confirm your identity, confirm it and try again.
What each role can do
| Role | In short |
|---|---|
| Owner | Everything an admin can do. Also grants the owner role, and changes or removes other owners. |
| Admin | Manages API keys, presets, guardrails and members, and reads the audit log. Cannot touch owners. |
| Member | Reads the members, guardrails, presets, keys, balance and usage. Cannot change them. |
The console shows only the controls that your role allows. The server checks your role again on every change.
Roles from an organization
An owner or an admin of an organization is also an admin in each workspace under it. The list shows them with the badge Organization owner or Organization admin.
- You change their role and remove them on the members page of the organization, not here.
- An owner of the organization can change the role of a member to owner here, and change or remove an owner. An admin of the organization cannot.
- Only an owner of the workspace invites an owner.
- When a person leaves the organization, they lose the access that the organization gave them at once. Direct workspace roles follow the removal rules for an organization.
- The keys, invitations and provider changes that they made before stay, as for an admin of the workspace.
See Organizations.
Change a role, remove a person or leave
An owner or an admin can change the role of a member and remove a member. An owner or an admin can also close the workspace.
Rules for owners:
- Only an owner, or an owner of the organization above, can change a role to owner, or change or remove an owner.
- Only an owner of the workspace can invite an owner.
- An admin cannot change or remove an owner.
- A change on this page always keeps at least one owner. To remove the last owner, make another person an owner first.
Any member can leave a workspace. Select Leave on your own row in the Members card, and confirm.
- You lose access to the keys, balance and chats of the workspace.
- An owner or an admin can invite you again.
- An owner or an admin of the organization keeps access through the organization.
Set what a member can do
A member has one level for each resource. An owner or an admin opens a member's drawer with Access on the member's row.
- In a workspace, the drawer shows the role and the levels in that workspace.
- In an organization, it shows the role, the levels of the organization and the workspaces under it. See Levels in an organization.
| Resource | Levels |
|---|---|
| API keys | None, own keys, all keys |
| Guardrails | Read, write. A member always reads them. |
| Presets | None, read, write |
| Workloads | None, read, write |
Choose a named role to set all four levels at once:
- Developer creates keys and writes presets and workloads.
- Viewer reads everything and changes nothing.
- Member is the default.
Change one level, and the access becomes Custom. Reset to the default returns the member to the default access.
Owners and admins have all levels, so the drawer shows no controls for them. The server checks each change.
Levels in an organization
An organization has no API keys, presets or workloads of its own. Its levels cover what belongs to the organization. Owners and admins have all of them, and a plain member has the default level of each until an owner or an admin changes it.
| Resource | Levels | Default |
|---|---|---|
| Guardrail | Read, write. Write changes the guardrail and budget of the organization. | Read |
| Workspaces | None, create. Create puts a workspace of the person under it. | None |
| Members | Read, invite. Invite sends an invitation for the member role. | Read |
| Settings | Read, edit. Edit changes the name, description and logo. | Read |
A named role does not apply, so set each level. The exchange refuses a named role in an organization (organization_takes_no_role).
Some things have no level and stay with owners and admins: the balance and funds, verified domains, roles and access, and closing the organization.
Two levels need care:
- A workspace under an organization spends the balance of the organization. A person with the Create level can put a workspace that they own under it, so choose who gets this level. The guardrail and its budget for each workspace limit what they spend.
- A person with the Invite level can invite only the member role. To invite an admin or an owner, you must be an owner or an admin.
Workspaces in the drawer
The drawer of an organization also lists the workspaces under it, with the role of the person in each.
- Remove ends the person's access to that workspace only. They stay in the organization.
- Add puts the person in that workspace as a member at once, and the person gets a notice in the bell. Only members of the organization can be added, and there is no invitation to accept.
- A person who leaves the organization follows the removal rules above.
- To add every member of the organization at once, see Choose who can access a workspace.
- Set the access of a person to a workspace in that workspace.
Reference
Refusals
| Status | Code | Meaning |
|---|---|---|
| 403 | permission_denied |
Only owners and admins can manage members and invite people. |
| 403 | owner_required |
Only an owner can invite an owner. An owner, or an owner of the organization above, can change a role to owner, change or remove an owner, and resend or revoke an owner's invitation. |
| 409 | managed_by_organization |
An owner or admin of the organization above cannot change their own role or access in the workspace, or invite themselves. |
| 422 | not_in_parent |
Only members of the organization above a workspace can be added to it. |
| 409 | not_in_organization |
The person is not in the organization above the workspace. Invite them there. |
| 409 | access_needs_member |
Only the access of a plain member can be set. Owners and admins have full access. |
| 409 | organization_takes_no_role |
An organization takes its levels one by one, not a named role. |
| 404 | not_member |
The person is not a member of this workspace. |
| 409 | already_member |
The person is already a member. Change their role instead. |
| 409 | last_owner |
A workspace must keep at least one owner. |
| 409 | system_account |
The workspace of the exchange cannot change members. |
Each change goes to the audit log.