> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omnara.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Members & access

> Manage organizations, projects, members, roles, and invitations

An **organization** is the top-level account. **Projects** contain agents and configs, and control which shared resources they can use through grants. Each person has one organization role and, optionally, a role in individual projects.

## Roles

**Org roles** — held by every member:

| Role     | Can                                                                                        |
| -------- | ------------------------------------------------------------------------------------------ |
| `owner`  | Everything, including deleting the org                                                     |
| `admin`  | Manage the org: members, projects, secrets, machines, models — everything but org deletion |
| `member` | See the org; project access comes only from explicit project roles                         |

**Project roles** — granted per member, per project:

| Role        | Read | Operate agents | Manage project | Manage access |
| ----------- | ---- | -------------- | -------------- | ------------- |
| `admin`     | ✓    | ✓              | ✓              | ✓             |
| `developer` | ✓    | ✓              | ✓              | —             |
| `operator`  | ✓    | ✓              | —              | —             |
| `viewer`    | ✓    | —              | —              | —             |

**Operate agents** means launching agents, sending [inputs](/events/sending-input), resolving [interactions](/events/interactions), and stopping work. **Manage project** means creating and changing project resources, such as configs, profiles, and project-owned secrets. **Manage access** means assigning project roles and managing grants for shared resources such as models, machines, and pools.

Organization owners and admins automatically have full access to every project, so they do not need separate project roles.

## Organizations

Your first org is created during onboarding. Creation atomically sets up the org, a default project, and your `owner` membership.

<Tabs>
  <Tab title="API">
    The examples assume the client, `$ORG`/`orgID`, and `$PROJ`/`projectID` setup from the [quickstart](/quickstart).

    <CodeGroup>
      ```bash CLI theme={null}
      npx omnara orgs create --name "Acme Research" --json
      ```

      ```bash REST theme={null}
      curl "$OMNARA_API/orgs" \
        -H "Authorization: Bearer $OMNARA_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{"name": "Acme Research"}'
      ```

      ```typescript SDK theme={null}
      const created = await sdk.createOrganization({
        client,
        body: { name: 'Acme Research' },
      })
      ```
    </CodeGroup>

    ```json theme={null}
    {
      "org": { "id": "org_k7mv4qtrwz3jehcyd5n6a2bfgi", "name": "Acme Research" },
      "project": { "id": "proj_7mv4qtrwz3jehcyd5n6a2bfgik", "name": "Default" },
      "membership": { "role": "owner" }
    }
    ```

    `omnara whoami` and [`GET /me`](/api/authentication) (`getCurrentUser` in the SDK) list the organizations you belong to, and `omnara config select` switches the CLI's default organization and project. Deleting an organization (`omnara orgs delete {org-id}`, `DELETE /orgs/{orgID}`, `deleteOrganization`) is owner-only and removes everything in it.
  </Tab>

  <Tab title="Dashboard">
    Click the organization name at the top of the sidebar and choose **New organization**. Use the same menu to switch organizations.
  </Tab>
</Tabs>

## Projects

<Tabs>
  <Tab title="API">
    <CodeGroup>
      ```bash CLI theme={null}
      npx omnara projects create --name release-automation --json
      ```

      ```bash REST theme={null}
      curl "$OMNARA_API/orgs/$ORG/projects" \
        -H "Authorization: Bearer $OMNARA_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{"name": "release-automation"}'
      ```

      ```typescript SDK theme={null}
      const project = await sdk.createProject({
        client,
        path: { orgID },
        body: { name: 'release-automation' },
      })
      ```
    </CodeGroup>

    ```json theme={null}
    { "id": "proj_7mv4qtrwz3jehcyd5n6a2bfgik", "name": "release-automation", "...": "..." }
    ```
  </Tab>

  <Tab title="Dashboard">
    Under **Projects** in the sidebar, click **New project** and give it a name.
  </Tab>
</Tabs>

Project lists include only projects you can access. Each project includes `access.can_read`, `can_operate`, `can_manage`, and `can_manage_access`, so clients do not need to recreate the role matrix.

## Invite people

Invitations are org-scoped and email-addressed. Invite as `admin` or `member` (`owner` is never grantable — ownership is established at org creation).

<Tabs>
  <Tab title="API">
    <CodeGroup>
      ```bash CLI theme={null}
      npx omnara members invites create --email priya@acme.dev --role member --json
      ```

      ```bash REST theme={null}
      curl "$OMNARA_API/orgs/$ORG/invitations" \
        -H "Authorization: Bearer $OMNARA_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{"email": "priya@acme.dev", "role": "member"}'
      ```

      ```typescript SDK theme={null}
      const invitation = await sdk.createOrgInvitation({
        client,
        path: { orgID },
        body: { email: 'priya@acme.dev', role: 'member' },
      })
      ```
    </CodeGroup>

    ```json theme={null}
    {
      "id": "oinv_qtrwz3jehcyd5n6a2bfgik7mv4",
      "email": "priya@acme.dev",
      "org_role": "member"
    }
    ```

    Organization admins can list pending invitations with `omnara members invites list` or `GET /orgs/$ORG/invitations` (`listOrgInvitations`), and revoke one with `omnara members invites delete {invitation-id}` or `DELETE /orgs/$ORG/invitations/{invitationID}` (`deleteOrgInvitation`).

    The invitee can list and accept invitations through their own account:

    <CodeGroup>
      ```bash CLI theme={null}
      npx omnara members invites pending
      npx omnara members invites accept oinv_qtrwz3jehcyd5n6a2bfgik7mv4
      ```

      ```bash REST theme={null}
      curl "$OMNARA_API/invitations" -H "Authorization: Bearer $PRIYA_TOKEN"
      curl -X POST "$OMNARA_API/invitations/oinv_qtrwz3jehcyd5n6a2bfgik7mv4/accept" -H "Authorization: Bearer $PRIYA_TOKEN"
      ```

      ```typescript SDK theme={null}
      await sdk.listPendingInvitations({ client })
      await sdk.acceptInvitation({
        client,
        path: { invitationID: 'oinv_qtrwz3jehcyd5n6a2bfgik7mv4' },
      })
      ```
    </CodeGroup>

    Accepting creates the organization membership. The invitation is then removed from the pending list.
  </Tab>

  <Tab title="Dashboard">
    Open **Members** in the sidebar and click **Invite user**: email plus role. Pending invitees appear in the list until accepted; **Revoke invitation** withdraws one. The invitee accepts from their own account when they sign in.
  </Tab>
</Tabs>

## Manage members

<Tabs>
  <Tab title="API">
    <CodeGroup>
      ```bash CLI theme={null}
      npx omnara members list
      ```

      ```bash REST theme={null}
      curl "$OMNARA_API/orgs/$ORG/members" -H "Authorization: Bearer $OMNARA_TOKEN"
      ```

      ```typescript SDK theme={null}
      const members = await sdk.listOrgMembers({ client, path: { orgID } })
      ```
    </CodeGroup>

    The response includes each member's user ID, email, display name, and organization role. Use the user ID to change their role or remove them:

    <CodeGroup>
      ```bash CLI theme={null}
      npx omnara members update usr_trwz3jehcyd5n6a2bfgik7mv4q --role admin
      npx omnara members remove usr_trwz3jehcyd5n6a2bfgik7mv4q
      ```

      ```bash REST theme={null}
      curl -X PATCH "$OMNARA_API/orgs/$ORG/members/usr_trwz3jehcyd5n6a2bfgik7mv4q" \
        -H "Authorization: Bearer $OMNARA_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{"role": "admin"}'

      curl -X DELETE "$OMNARA_API/orgs/$ORG/members/usr_trwz3jehcyd5n6a2bfgik7mv4q" \
        -H "Authorization: Bearer $OMNARA_TOKEN"
      ```

      ```typescript SDK theme={null}
      await sdk.updateOrgMember({
        client,
        path: { orgID, userID: 'usr_trwz3jehcyd5n6a2bfgik7mv4q' },
        body: { role: 'admin' },
      })

      await sdk.removeOrgMember({
        client,
        path: { orgID, userID: 'usr_trwz3jehcyd5n6a2bfgik7mv4q' },
      })
      ```
    </CodeGroup>
  </Tab>

  <Tab title="Dashboard">
    The **Members** page lists everyone with their org role. Expand a member to change their **Org role** (admin/member toggle) or **Remove from organization**.
  </Tab>
</Tabs>

<Warning>
  The last owner cannot be demoted or removed. Removing another member permanently deletes the secrets and skills they own in this organization. Removal fails if one of their secrets is still used by another resource.
</Warning>

## Give members project access

Organization members need a project role to access a project. Owners and admins already have access to every project.

Use `operator` for teammates who should run agents and handle approvals without changing configs, profiles, or project-owned secrets.

<Tabs>
  <Tab title="API">
    There is no CLI command for project roles yet. `PUT` creates or changes the member's role:

    <CodeGroup>
      ```bash REST theme={null}
      curl -X PUT "$OMNARA_API/orgs/$ORG/members/usr_trwz3jehcyd5n6a2bfgik7mv4q/projects/$PROJ" \
        -H "Authorization: Bearer $OMNARA_TOKEN" \
        -H "Content-Type: application/json" \
        -d '{"role": "operator"}'
      ```

      ```typescript SDK theme={null}
      await sdk.setMemberProjectAccess({
        client,
        path: { orgID, userID: 'usr_trwz3jehcyd5n6a2bfgik7mv4q', projectID },
        body: { role: 'operator' },
      })
      ```
    </CodeGroup>

    `GET …/projects` (`listMemberProjectAccess`) lists the member's explicit project roles. `DELETE` on the same project path (`removeMemberProjectAccess`) removes one.
  </Tab>

  <Tab title="Dashboard">
    1. Open **Members** and expand the member.
    2. Under **Project access**, choose a project and role.
    3. Click **Add**.

    Use the role menu to change access or **Remove** to revoke it.
  </Tab>
</Tabs>

<Info>
  Full schema and playground: [Organizations and Projects](/api-reference/endpoints/organizations-and-projects/create-organization) · [Members](/api-reference/endpoints/organizations-and-projects/list-organization-members) · [Invitations](/api-reference/endpoints/organizations-and-projects/create-org-invitation).
</Info>