# Team members

> Invite people to your organization with a role and an optional client scope, change their role and remove their access.

Members are the people with access to an organization. Each one has a [role](https://developers.openwaf.dev/fundamentals/organizations-and-roles/#roles)
and can be limited to the domains of one [client](https://developers.openwaf.dev/fundamentals/agencies-and-clients/). Admins manage members; only
owners can give or take away the owner role.

## Invite a member

1. Open **Members › Invite member**.
2. Enter the person's email, choose the role and the scope (**Whole organization** or one client). Members limited to
   a client can only be **Tech** or **Read only**.
3. Select **Send invitation**. The dashboard shows a one-time **invitation code** (`owi_…`). Copy it now and send it
   to the person through a channel you trust: anyone who has the code can use it, and it is not shown again.
4. The invitation is valid for 7 days. Open invitations are listed under **Open invitations**; revoke one to
   invalidate its code.


The person accepts the invitation with the code:

```sh
curl -X POST "https://dash.openwaf.dev/v1/invitations/accept" \
  -H "Content-Type: application/json" \
  -d '{"secret": "owi_…", "name": "Alex Doe"}'
```

Accepting makes them a member with the invited role and scope, and returns their first API token (valid for 90 days).
From then on they sign in at [dash.openwaf.dev](https://dash.openwaf.dev/signin) with the invited email address.

Admins can also add a member directly, without an invitation, through the API:

```sh
curl -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/members" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "alex@example.com", "name": "Alex Doe", "role": "tech"}'
```

Add `"client_id"` to limit the member to a client.

## Change a role

In **Members**, choose the new role in the member's row. The change takes effect immediately, including for the API
tokens the member created (their [effective role](https://developers.openwaf.dev/fundamentals/organizations-and-roles/#effective-role) follows).

```sh
curl -X PATCH "https://dash.openwaf.dev/v1/orgs/$ORG/members/$USER_ID" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"role": "readonly"}'
```

- Admins can change members up to `admin`; only owners can make someone an owner or change an owner's role.
- The last owner cannot be demoted (`409 conflict`): make someone else owner first.

## Remove a member

In **Members**, select **Remove** in the member's row, or call `DELETE /v1/orgs/{org}/members/{user}`. The person
loses access immediately and **all their API tokens are revoked**: adding the person again later does not bring old
tokens back.

Admins can remove themselves with **Leave the organization** in their own row (the last owner cannot leave). Other
members ask an admin to remove them, or [delete their account](https://developers.openwaf.dev/fundamentals/create-account/#delete-account).

## Who can see members

Every member of the whole organization, including `readonly`, can see the member list. Members limited to a client
cannot. Only admins see open invitations and the full list of API tokens.