Organisations and roles

Websites, destinations, install paths, log streams, the plan and billing belong to an organisation, not to a person. People reach them through a membership with one of four roles, checked on every API request.

#Your organisations

Your first sign-in creates your own organisation, named after you, on the Free plan, with you as its owner.
Create more from the organisation switcher at the top of the dashboard’s sidebar, and switch between them there. Each organisation has its own plan.
You can own at most 5 organisations and belong to at most 20 (organisation_limit).
Someone outside an organisation learns nothing about it: its addresses answer 404. A member below the role an action needs gets 403 forbidden, with the role required.

#Roles

Can	Viewer	Member	Admin	Owner
Read dashboards, usage, members and logs; write to support	Yes	Yes	Yes	Yes
Create and edit destinations and install paths	—	Yes	Yes	Yes
Export install events and logs	—	Yes	Yes	Yes
Add, change and delete websites	—	—	Yes	Yes
Remove destinations and install paths	—	—	Yes	Yes
Invite, change and remove members; rename the organisation	—	—	Yes	Yes
Manage log streams and log retention	—	—	Yes	Yes
Manage billing and the plan	—	—	—	Yes
Delete the organisation	—	—	—	Yes

Admins manage admins, members and viewers. Only an owner grants, changes or removes the owner role, or invites someone as an owner.
There is always at least one owner: the last owner cannot leave, be removed or lose the role (last_owner). Make someone else an owner first.

#Invite people

CLItrail sends no email. Instead, an admin or owner creates an invitation and passes the link on:

#Create the invitation
In Members, enter the person’s email address and a role. CLItrail shows a link once, such as https://YOUR_SERVICE/app#invite=…. The token is in the fragment, so it never reaches a server log, and only its keyed hash is stored.
#Send the link
Send it through any channel you trust. It works once, for 7 days, and only for the address you entered. Inviting the same address again replaces the pending invitation.
#The invitee accepts
They open the link, sign in with Google or an email link, and accept. The verified email they sign in with must be the invited address, or the invitation is refused.

Pending invitations count toward the plan’s member limit: 1 on Free, 3 on Standard, 20 on Enterprise. Over it, a new invitation answers 402 plan_limit.
An organisation can create 20 invitations in any 24 hours (429, with the seconds to wait).
Admins and owners see pending invitations in Members and can revoke them. A used, revoked or expired link answers invite_used, invite_revoked or invite_expired.

#Members

Members lists everyone with their role and when they joined. Admins and owners change roles and remove people; anyone can leave an organisation, except its last owner. After a downgrade, members over the new limit stay, but nobody new can join until the organisation is under it.

#Delete an organisation

Only an owner can delete an organisation, and not their last one. Cancel a paid subscription first (subscription_active). When the organisation still has websites, the dashboard asks you to confirm with a new sign-in (Google, or a new email link), because its websites and all their data are deleted with it.

#Activity

Every change is recorded in the organisation’s activity and in Logs: organisations created, renamed and deleted; invitations created, revoked, accepted and refused; roles changed; members removed or leaving; plan changes; and every limit reached. Secret values are never recorded.