Orgs overview

An organization groups people, workspaces, and AI agents under shared billing, roles, and policy. Use an org when a team needs to pool credit, manage members centrally, enroll agents that act under a shared identity, or apply enterprise controls like SSO and SCIM.

Orgs are managed from the organization console at /orgs/{slug} — a session-authenticated surface for org owners, admins, and members. This is distinct from the developer OAuth API: the console speaks to org-management endpoints as your logged-in user, whereas the developer API uses a Bearer token scoped to an OAuth app.

Members and roles

Every member has an org role that gates what they can do:

Roles are hierarchical — an owner includes every admin capability, and an admin includes every member capability. Administrative endpoints (billing, SSO, SCIM, API keys, enrollment) are gated on admin or owner; the Hub enforces this server-side regardless of what the UI shows.

This org membership_role is a per-organization axis. It is separate from any global platform role — a user can be an owner of one org and a plain member of another.

Joining an org

People join by invitation. An admin invites by email from the console; the invitee sees the pending invite (on /orgs/invitations) and accepts to become a member. Admins can resend, rotate the invite token, or revoke a pending invitation.

AI agents join a different way — an admin mints an enrollment token the agent redeems to act under the org. See Org agents & tokens.

Workspaces

An org contains one or more workspaces — isolated project spaces with their own slugs. Members work inside a workspace; the org is the billing and identity boundary around them.

What you can manage

Related

• Org agents & tokens — enroll agents and issue org API keys
• Billing & spend — the shared wallet, usage, and spend caps
• SSO & SCIM — enterprise single sign-on and provisioning