Members are the people with access to an organization. Each one has a role and can be limited to the domains of one client. Admins manage members; only owners can give or take away the owner role.
Invite a member
- Open Members › Invite member.
- Enter the person's email, choose the role and the scope (Whole organization or one client). Members limited to a client can only be Tech or Read only.
- Select Send invitation. The dashboard shows a one-time invitation code (
owi_…). Copy it now and send it to the person through a channel you trust: anyone who has the code can use it, and it is not shown again. - The invitation is valid for 7 days. Open invitations are listed under Open invitations; revoke one to invalidate its code.
The person accepts the invitation with the code:
curl -X POST "https://dash.openwaf.dev/v1/invitations/accept" \
-H "Content-Type: application/json" \
-d '{"secret": "owi_…", "name": "Alex Doe"}'Accepting makes them a member with the invited role and scope, and returns their first API token (valid for 90 days). From then on they sign in at dash.openwaf.dev (external link) with the invited email address.
Admins can also add a member directly, without an invitation, through the API:
curl -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/members" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "Content-Type: application/json" \
-d '{"email": "[email protected]", "name": "Alex Doe", "role": "tech"}'Add "client_id" to limit the member to a client.
Change a role
In Members, choose the new role in the member's row. The change takes effect immediately, including for the API tokens the member created (their effective role follows).
curl -X PATCH "https://dash.openwaf.dev/v1/orgs/$ORG/members/$USER_ID" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "Content-Type: application/json" \
-d '{"role": "readonly"}'- Admins can change members up to
admin; only owners can make someone an owner or change an owner's role. - The last owner cannot be demoted (
409 conflict): make someone else owner first.
Remove a member
In Members, select Remove in the member's row, or call DELETE /v1/orgs/{org}/members/{user}. The person loses access immediately and all their API tokens are revoked: adding the person again later does not bring old tokens back.
Admins can remove themselves with Leave the organization in their own row (the last owner cannot leave). Other members ask an admin to remove them, or delete their account.
Who can see members
Every member of the whole organization, including readonly, can see the member list. Members limited to a client cannot. Only admins see open invitations and the full list of API tokens.