Skip to content
Origin Cloud Docs

IAM / Task

Manage organization members

Updated · 4 min read

Invite people to your organization by email, list members and pending invites, remove a member's access, and cancel an invite before it applies.

On this page7 sections

A member is any principal with at least one role assignment in your organization. You add people by email with an invite, which grants them one role org-wide. To change the roles of an existing member, assign and revoke roles.

Before you begin

Invite a member

  1. Find the URN of the role the new member should get with list-roles. See Built-in roles.

  2. Send the invite:

    terminal
    origin iam invite-member --org-id <org-id> \
  --email jane@example.com \
  --role-urn urn:origin:cloud:iam::::tc/role/roles/viewer
    • Account exists: the role is granted org-wide immediately. There’s no separate step to accept.
    • No account yet: the invite is stored as pending. It’s applied the first time that address signs up and signs in to the console, or reads its own identity with origin iam current-user. If by then you can no longer assign the role yourself, the invite is dropped instead.

  3. Verify the invite. An existing account appears in the member list; a pending invite appears in the invite list.

    terminal
    origin iam list-members --org-id <org-id>
origin iam list-invites --org-id <org-id>

Invites are org-wide only. To give someone access to a single project, ask them to sign up and send you the userId that origin iam current-user shows them. Then assign a project-scoped role to user:<user-id>.

List members and invites

  • list-members shows every principal with an active role assignment, at any scope, with all of its role URNs. For users, it includes the name and email address where the platform can resolve them. Service accounts with roles appear here too.
  • principal-grants shows one principal’s role assignments, each with its project scope.
  • list-invites shows pending invites: the ID, email address, role URN, who invited them and when. An invite disappears from the list once it’s applied or canceled.

Remove a member

Removing a member revokes every role the principal holds in the organization, org-wide and in every project. To take away a single role, revoke the role instead.

  1. Find the member’s principal in the output of list-members.

  2. Remove the member.

    terminal
    origin iam remove-member --org-id <org-id> --principal user:<user-id>

  3. Run list-members again and check that the principal is gone.

Removing a principal that holds no roles succeeds and changes nothing. If the member is the organization’s last org-wide owner, the platform refuses with CONFLICT and removes nothing. See The last owner is protected. If the member holds a role you couldn’t revoke yourself, such as a billing role when you hold none, the platform refuses with FORBIDDEN and removes nothing.

Cancel a pending invite

remove-member acts only on role assignments, so it doesn’t cancel a pending invite.

  1. Find the invite’s ID with list-invites.

  2. Cancel the invite.

    terminal
    origin iam revoke-invite --org-id <org-id> --invite-id <invite-id>

  3. Run list-invites again and check that the invite is gone.

Using the API

The mutations are inviteMember, removeMember and revokeInvite; the queries are orgMembers and orgInvites, all in the iam namespace. orgRoleAssignments returns the same data as orgMembers with one entry per assignment, including its project scope and when it was created. For the full list, see the IAM reference.

GraphQL
mutation {
  iam {
    inviteMember(input: {
      orgId: "<org-id>"
      email: "jane@example.com"
      roleUrn: "urn:origin:cloud:iam::::tc/role/roles/viewer"
    })
  }
}