Team and roles

You can give other people access to the projects on your account by inviting them. Each person keeps their own Fortly account and password; joining yours adds your projects to the lists they already see. You decide what each of them may do by giving them a role.

Roles

Your account has one owner, you, and any number of admins and members.

	Owner	Admin	Member
See every project on the account	Yes	Yes	Yes
Deploy, roll back, read logs	Yes	Yes	Yes
Read and write data, run SQL	Yes	Yes	Yes
Set secrets, add domains, add schedules, upload files	Yes	Yes	Yes
Delete a project	Yes	Yes	No
Import a database	Yes	Yes	No
Change a table's structure with the console's structure editor (`/tables/{table}/structure`)	Yes	Yes	No
Turn full-text search on or off for a table	Yes	Yes	No
Invite, remove or change the role of teammates	Yes	No	No

The four actions limited to owners and admins are the ones that can destroy data in one step. A member who tries one gets 403 Forbidden with a message such as only the account owner or an admin can delete a project.

Roles are checked on the actions in the table marked "No" for members, and nowhere else. A member can still send SQL, including drop table, through /sql and the query editor. Invite people you trust with the data.

A few things follow from how accounts work:

The team is always your own. The Team page and the /team routes act on the account you are signed in as. Being an admin on someone else's account does not let you manage their team.
New projects go on the creator's own account. A teammate who creates a project creates it on their own account, not yours.
Ownership cannot be transferred or reassigned. The owner's role cannot be changed, and the owner cannot be removed.

Invite a teammate

Open Team, enter the person's email address under Invite teammate, pick Member or Admin, and choose Invite. They are emailed a link. If the email cannot be delivered, the console shows the link so you can send it yourself, and Copy link copies it.

Terminal

curl -X POST https://api.fortly.com/team/invites \
  -H "Authorization: Bearer $FORTLY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "sam@example.com", "role": "member"}'

role is admin or member, and defaults to member; anything else is refused with a role is either admin or member. The reply is 201 Created with the invitation's id, its expires_at, the invitation secret (it starts with cvi_), and delivered, which says whether the email went out.

An invitation is valid for 7 days. Only one can be open per address: inviting the same address again returns 409 Conflict with the open invitation's invite_id, and the way forward is to resend it.

Resend or withdraw an invitation

Resending emails a new link and stops the old one working at the same moment, so only the latest email works. You can resend the same invitation once every 60 seconds.

Withdrawing an invitation stops its link working.

GET/teamYour teammates, open invitations, recent team history, and the accounts you were added to

POST/team/invitesInvite someone. Takes email and role

POST/team/invites/{id}/resendEmail the invitation again, with a fresh link

DELETE/team/invites/{id}Withdraw an invitation

Invitation limits

Limit	Value
How long an invitation lasts	7 days
Invitations open at once	50
Invitations sent per day	50, counted over the last 24 hours
Time between resends of one invitation	60 seconds
Invitations in quick succession	8, then one more every 5 seconds

Going over any of these returns 429 Too Many Requests.

Accept an invitation

Open the link while signed in to your own Fortly account; create one first if you need to. The link opens Settings, where Join an account completes it. You can also paste the invitation there.

From the API, send the invitation secret:

Terminal

curl -X POST https://api.fortly.com/invites/accept \
  -H "Authorization: Bearer $FORTLY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"secret": "cvi_..."}'

The reply carries the id of the account you joined, as joined, and your role there. The owner's projects then appear in your project lists, and a token you make can reach them too.

The account you accept with does not have to use the address the invitation was sent to; the link is what counts. The owner's team history records when an invitation was accepted by a different address. An invitation cannot be accepted by the account that sent it, and one that has expired, been withdrawn or already been used returns 404 with that invitation is not valid any more. If you are already on the team, accepting another invitation keeps the role you have.

Change a role or remove someone

On the Team page, open the menu next to a person and choose Make admin, Make member or Remove from account. Removing someone takes away their access to every project on your account immediately.

Terminal

# make someone an admin; their id is "member_id" in GET /team
curl -X PATCH https://api.fortly.com/team/members/MEMBER_ID \
  -H "Authorization: Bearer $FORTLY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"role": "admin"}'

# remove them
curl -X DELETE https://api.fortly.com/team/members/MEMBER_ID \
  -H "Authorization: Bearer $FORTLY_TOKEN"

PATCH/team/members/{id}Change a teammate's role to admin or member

DELETE/team/members/{id}Remove a teammate from your account

POST/invites/acceptJoin another account with an invitation secret

AI agents and teammates

An AI agent connected over MCP acts for the person who approved it, within the projects that person chose, and never beyond what that person can reach. When someone is removed from your team, their agents lose access to your projects too. See Connect an AI agent.