---
title: Organisations and members
description: What an organisation holds, the four member roles, inviting teammates, changing roles and removing members, and where to see your organisation's activity.
section: Account
order: 2
---

An organisation owns projects, API keys, registry credentials and a billing plan. Every new account gets its own organisation on the Free plan, and everything you create belongs to it.

## What can each role do?

| Role | Can |
| --- | --- |
| Viewer | See projects, services, deployments, logs and usage |
| Developer | Everything a viewer can, and create, deploy, change and delete services, variables, domains and registry credentials |
| Admin | Everything a developer can, and invite and remove members, change their roles, manage API keys and billing, and delete environments and projects |
| Owner | Everything an admin can, and invite owners, change an owner's role and remove owners |

A person outside an organisation gets 404 for its projects, so its existence isn't revealed, and a member without the right role gets 403 with the role it needs in `details.required_role`.

## Invite a teammate

Open **Settings**, then **Organisation**. Under **Invite people**, enter the email address they'll sign in with, choose a role and choose **Send invitation**. Only owners can invite someone as an owner, and an admin who tries gets 403 `owner_required`.

Dekka emails them a link that works once and expires after seven days. Open invitations are listed under the form until they're accepted, and you can choose **Revoke** to cancel one. An invitation that has expired stays listed until you revoke it or invite the same address again, which replaces it. An address that already has an open invitation gets 409 `invitation_exists`, so revoke that one first if you want to send a new link, and inviting someone who is already a member gets 409 `already_member`.

Inviting, changing roles and removing members all need you to be signed in to the dashboard, so an API key gets 403 `session_required` for them.

## How many people can join?

Each plan includes a number of team members, and Dekka counts open invitations as well as members when you invite someone.

| Plan | Team members |
| --- | --- |
| Free | 1 |
| Starter | 1 |
| Growth | 3 |

An invitation that would go past the limit is refused with 403 `entitlement_exceeded` and `details.entitlement` set to `team_members`. Revoking an open invitation frees its place, and an expired one no longer counts.

## Accept an invitation

The link opens a page that says who invited you, to which organisation and with which role. Sign in or create an account with the address the invitation was sent to, then choose **Accept invitation**. Dekka checks that your verified email address matches the invited one, and a different address gets 403 `invitation_email_mismatch`, so sign out and sign in with the right one. A link that has expired, was revoked or was already used gets 400 `invalid_invitation`, and whoever invited you can send a new one. If you're already a member, accepting keeps the role you have.

## Change someone's role

Choose a new role from the menu next to their name in **Members**. Admins can change the role of developers, viewers and other admins. Only owners can make someone an owner or change an owner's role.

Every organisation needs at least one owner, so changing the role of its only owner gets 409 `last_owner`. Make someone else an owner first.

## Remove a member

Choose **Remove** next to their name. Admins can remove developers, viewers and other admins, and only owners can remove an owner. Removing the only owner gets 409 `last_owner`.

The person loses access straight away, and every API key and [project token](/docs/project-tokens) they created in the organisation is revoked, so check that your CI isn't using one of theirs.

## See what changed

**Activity** records every change to services, connections, variables, domains, keys and billing, with who made it and when. Invitations, role changes and removed members are recorded too, as are revealing a secret and running a database query.