# Team and roles

> Invite teammates to your account, choose whether each is an admin or a member, and change or remove their access.

Source: https://docs.fortly.com/account/team

You can give other people access to the projects on your account by inviting them. Each person keeps their own Fortly account and password; joining yours adds your projects to the lists they already see. You decide what each of them may do by giving them a role.

## Roles

Your account has one owner, you, and any number of admins and members.

| | Owner | Admin | Member |
|---|---|---|---|
| See every project on the account | Yes | Yes | Yes |
| Deploy, roll back, read logs | Yes | Yes | Yes |
| Read and write data, run SQL | Yes | Yes | Yes |
| Set secrets, add domains, add schedules, upload files | Yes | Yes | Yes |
| Delete a project | Yes | Yes | No |
| Import a database | Yes | Yes | No |
| Change a table's structure with the console's structure editor (`/tables/{table}/structure`) | Yes | Yes | No |
| Turn full-text search on or off for a table | Yes | Yes | No |
| Invite, remove or change the role of teammates | Yes | No | No |

The four actions limited to owners and admins are the ones that can destroy data in one step. A member who tries one gets `403 Forbidden` with a message such as `only the account owner or an admin can delete a project`.

> **Warning:**
>
> Roles are checked on the actions in the table marked "No" for members, and nowhere else. A member can still send SQL, including `drop table`, through `/sql` and the query editor. Invite people you trust with the data.

A few things follow from how accounts work:

- **The team is always your own.** The **Team** page and the `/team` routes act on the account you are signed in as. Being an admin on someone else's account does not let you manage their team.
- **New projects go on the creator's own account.** A teammate who creates a project creates it on their own account, not yours.
- **Ownership cannot be transferred or reassigned.** The owner's role cannot be changed, and the owner cannot be removed.

## Invite a teammate

**Console**

Open **Team**, enter the person's email address under **Invite teammate**, pick **Member** or **Admin**, and choose **Invite**. They are emailed a link. If the email cannot be delivered, the console shows the link so you can send it yourself, and **Copy link** copies it.

**API**

```bash
curl -X POST https://api.fortly.com/team/invites \
  -H "Authorization: Bearer $FORTLY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "sam@example.com", "role": "member"}'
```

`role` is `admin` or `member`, and defaults to `member`; anything else is refused with `a role is either admin or member`. The reply is `201 Created` with the invitation's `id`, its `expires_at`, the invitation `secret` (it starts with `cvi_`), and `delivered`, which says whether the email went out.

An invitation is valid for 7 days. Only one can be open per address: inviting the same address again returns `409 Conflict` with the open invitation's `invite_id`, and the way forward is to resend it.

### Resend or withdraw an invitation

Resending emails a new link and stops the old one working at the same moment, so only the latest email works. You can resend the same invitation once every 60 seconds.

Withdrawing an invitation stops its link working.

- `GET /team` — Your teammates, open invitations, recent team history, and the accounts you were added to
- `POST /team/invites` — Invite someone. Takes `email` and `role`
- `POST /team/invites/{id}/resend` — Email the invitation again, with a fresh link
- `DELETE /team/invites/{id}` — Withdraw an invitation

### Invitation limits

| Limit | Value |
|---|---|
| How long an invitation lasts | 7 days |
| Invitations open at once | 50 |
| Invitations sent per day | 50, counted over the last 24 hours |
| Time between resends of one invitation | 60 seconds |
| Invitations in quick succession | 8, then one more every 5 seconds |

Going over any of these returns `429 Too Many Requests`.

## Accept an invitation

Open the link while signed in to your own Fortly account; create one first if you need to. The link opens **Settings**, where **Join an account** completes it. You can also paste the invitation there.

From the API, send the invitation secret:

```bash
curl -X POST https://api.fortly.com/invites/accept \
  -H "Authorization: Bearer $FORTLY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"secret": "cvi_..."}'
```

The reply carries the id of the account you joined, as `joined`, and your `role` there. The owner's projects then appear in your project lists, and a token you make can reach them too.

The account you accept with does not have to use the address the invitation was sent to; the link is what counts. The owner's team history records when an invitation was accepted by a different address. An invitation cannot be accepted by the account that sent it, and one that has expired, been withdrawn or already been used returns `404` with `that invitation is not valid any more`. If you are already on the team, accepting another invitation keeps the role you have.

## Change a role or remove someone

On the **Team** page, open the menu next to a person and choose **Make admin**, **Make member** or **Remove from account**. Removing someone takes away their access to every project on your account immediately.

```bash
# make someone an admin; their id is "member_id" in GET /team
curl -X PATCH https://api.fortly.com/team/members/MEMBER_ID \
  -H "Authorization: Bearer $FORTLY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"role": "admin"}'

# remove them
curl -X DELETE https://api.fortly.com/team/members/MEMBER_ID \
  -H "Authorization: Bearer $FORTLY_TOKEN"
```

- `PATCH /team/members/{id}` — Change a teammate's role to `admin` or `member`
- `DELETE /team/members/{id}` — Remove a teammate from your account
- `POST /invites/accept` — Join another account with an invitation secret

## AI agents and teammates

An AI agent connected over MCP acts for the person who approved it, within the projects that person chose, and never beyond what that person can reach. When someone is removed from your team, their agents lose access to your projects too. See [Connect an AI agent](https://docs.fortly.com/agents/mcp).