Organizations & the Team page
Manage members of your Cloud Control organization from the Team page: list members, add users with a role, change roles, and remove users — with the owner protected.
An organization is your tenant, and the Team page (/users) is where you manage its members. Any member can view the roster; only admins with the manage_users_sso capability can change it.
View the roster
`GET /api/org/users` lists every member with their role, whether MFA is enabled, and whether they are the owner. Reads are open to all members so everyone can see who is on the team.
Add a member
An Org Admin adds a member with `POST /api/org/users`, supplying a name, email, initial password (at least 8 characters) and a role from the assignable set: Viewer, Deployer, SRE · Cloud Admin, Org Admin. Adding a member is audited as org.user_added.
Change a role or remove a member
`PATCH /api/org/users/{id}` changes a member's role; `DELETE /api/org/users/{id}` removes them, cascading their sessions, MFA, reset tokens and API tokens. Both are audited (org.role_changed, org.user_removed).
You cannot change the owner's role, remove the owner, or demote yourself out of ownership through these endpoints — the API answers 400. To move ownership, use Transferring organization ownership. Cross-organization user ids return 404.
Roadmap
Self-service invites (members join via an emailed invitation rather than admin-created accounts) are on the roadmap; today members are created by an admin. Multi-organization membership and an org switcher are also planned.