# Organisations and roles

Websites, destinations, install paths, log streams, the plan and billing belong to an organisation, not to a person. People reach them through a membership with one of four roles, checked on every API request.

## Your organisations

- Your first sign-in creates your own organisation, named after you, on the Free plan, with you as its owner.
- Create more from the organisation switcher at the top of the dashboard’s sidebar, and switch between them there. Each organisation has its own plan.
- You can own at most 5 organisations and belong to at most 20 (`organisation_limit`).
- Someone outside an organisation learns nothing about it: its addresses answer `404`. A member below the role an action needs gets `403` `forbidden`, with the role required.

## Roles

| Can | Viewer | Member | Admin | Owner |
| --- | --- | --- | --- | --- |
| Read dashboards, usage, members and logs; write to support | Yes | Yes | Yes | Yes |
| Create and edit destinations and install paths | — | Yes | Yes | Yes |
| Export install events and logs | — | Yes | Yes | Yes |
| Add, change and delete websites | — | — | Yes | Yes |
| Remove destinations and install paths | — | — | Yes | Yes |
| Invite, change and remove members; rename the organisation | — | — | Yes | Yes |
| Manage log streams and log retention | — | — | Yes | Yes |
| Manage billing and the plan | — | — | — | Yes |
| Delete the organisation | — | — | — | Yes |

- Admins manage admins, members and viewers. Only an owner grants, changes or removes the owner role, or invites someone as an owner.
- There is always at least one owner: the last owner cannot leave, be removed or lose the role (`last_owner`). Make someone else an owner first.

## Invite people

CLItrail sends no email. Instead, an admin or owner creates an invitation and passes the link on:

1. Create the invitation
  In **Members**, enter the person’s email address and a role. CLItrail shows a link once, such as `https://YOUR_SERVICE/app#invite=…`. The token is in the fragment, so it never reaches a server log, and only its keyed hash is stored.
2. Send the link
  Send it through any channel you trust. It works once, for 7 days, and only for the address you entered. Inviting the same address again replaces the pending invitation.
3. The invitee accepts
  They open the link, sign in with Google or an email link, and accept. The **verified** email they sign in with must be the invited address, or the invitation is refused.

- Pending invitations count toward the plan’s member limit: 1 on Free, 3 on Standard, 20 on Enterprise. Over it, a new invitation answers `402` `plan_limit`.
- An organisation can create 20 invitations in any 24 hours (`429`, with the seconds to wait).
- Admins and owners see pending invitations in **Members** and can revoke them. A used, revoked or expired link answers `invite_used`, `invite_revoked` or `invite_expired`.

## Members

**Members** lists everyone with their role and when they joined. Admins and owners change roles and remove people; anyone can leave an organisation, except its last owner. After a downgrade, members over the new limit stay, but nobody new can join until the organisation is under it.

## Delete an organisation

Only an owner can delete an organisation, and not their last one. Cancel a paid subscription first (`subscription_active`). When the organisation still has websites, the dashboard asks you to confirm with a new sign-in (Google, or a new email link), because its websites and all their data are deleted with it.

## Activity

Every change is recorded in the organisation’s activity and in [Logs](https://clitrail.com/docs/logs): organisations created, renamed and deleted; invitations created, revoked, accepted and refused; roles changed; members removed or leaving; plan changes; and every limit reached. Secret values are never recorded.