Owners and Admins manage the people in an organization under Settings › Users. One account can belong to several organizations, with a role in each.
Each role can do everything the roles below it can.
| Role | What it adds |
|---|---|
| Read | Browse the graph, chat with the assistant, see the AI settings, and create personal API keys that can only read. |
| Write | Upload scans, from the CLI or with an API key. |
| Admin | Invite, remove, and manage users up to Admin; connect AI providers and see usage; create organization API keys and revoke any key; manage SSO domains; change a repository’s primary branch or remove it. |
| Owner | Rename and delete the organization; give and manage the Owner role; connect the single sign-on identity provider. |
An organization always keeps at least one Owner: the last Owner cannot be removed or given another role.
Server Owners
Section titled “Server Owners”A self-hosted server also has server owners, apart from the roles in each organization. They manage the server’s settings, and can see and join every organization on the server. The person who sets up the server is its first server owner.
Invite Users
Section titled “Invite Users”- Go to Settings › Users and click Invite User.
- Enter the person’s email and choose their role (Write by default).
- Share the Invitation Link. If the server sends email, the link is emailed to them too.
An invitation link works once, for 7 days.
When your organization requires single sign-on, there are no invitations: people join by logging in through your identity provider.
Manage Users
Section titled “Manage Users”Each user’s menu has:
- Change Role — give the user another role. Only Owners can give or change the Owner role.
- Reset Password — create a one-time link, valid for 7 days, for the user to set a new password. With email, it is sent to them.
- Remove — remove the user from the organization. Their personal API keys stop working.
You cannot change your own role or remove yourself.
Removed Users
Section titled “Removed Users”When single sign-on is required, removed users are listed under Removed Users, so they cannot simply log in through the identity provider again. Allow Back lets one return.
Passwords
Section titled “Passwords”People log in with their email and password, or through single sign-on. If the server sends email, Forgot password? on the login page sends a reset link. Otherwise, ask an Owner or Admin for one.