Teams & invites

Invite collaborators from the dashboard Team page. Each member has a role: a built-in viewer, developer, or admin, or a custom IAM role.

Built-in roles

viewer — read services, deploys, env metadata, and team membership
developer — deploy and manage services, env, secrets, domains, datastores, and GitHub installs
admin — full workspace control including team invites, API keys, IAM roles, and workspace settings

Enforcement

Routes check permissions (not only role rank). Session users inherit permissions from their membership role; workspace API keys inherit the role assigned at key creation. The static operator token ISOWARD_API_TOKEN authenticates as the seeded default admin on wks-default — it does not bypass RBAC.

Last-admin guard

A workspace must always keep at least one built-in admin. Demoting or removing the last admin is rejected until another member is promoted. Migrations also promote the oldest member in any admin-less workspace.

Operator break-glass

If a workspace has no admin left (for example after a bad DB edit), use the CLI on the host:

bash

node scripts/set-team-role.mjs --list
node scripts/set-team-role.mjs --email [email protected] --role admin
node scripts/set-team-role.mjs --email [email protected] --role viewer --force

API

http

GET /v1/team-members
PATCH /v1/team-members/:id
DELETE /v1/team-members/:id

GET /v1/team-invites
POST /v1/team-invites
POST /v1/team-invites/accept
DELETE /v1/team-invites/:id

Changing a member role or managing invites requires team.manage. See the API overview for authentication details.