Manage members and roles

Members are the people who run your organization with you. Each member is a Coritan account with a role that decides what they can see and change in the organization's pages, in the staff console and through the Organization API. Add a member when someone joins your team, and remove them when they leave.

• You need the Owner or Admin role to add, change or remove members. Every member can see the list; the others see the note Adding members, changing their roles and removing them needs an owner or admin.
• Decide on a role. The Roles card under the list says what each role may do, and Organization roles and permissions has the detail.

Go to Organizations, open your organization and choose Members under Team. In the sidebar, Team is in your organization's block. The list shows each Member with their email, their Role, their Storefront account, what the Staff console knows of them (when they last signed in there and whether two-factor authentication is on) and when they Joined.

A badge beside a member's name says when their Coritan account cannot be used: Invite pending until they set a password from their invitation, Suspended when Coritan has suspended the account and Account closed when it was closed. None of them can sign in until that changes.

To narrow the list, search by name or email, or choose a role. The search and the role stay in the address, so a reload or a shared link shows the same list.

Each change to a member starts from the menu at the end of their row.

1. On the Members page, select Add member….

2. Enter their Email and, if you like, their Name.

3. Choose a Role. The description under the list says what the role can do.

4. Give them a way to sign in:

   • Leave Email an invitation ticked to email them a link to set their password, or
   • enter a Temporary password of at least 8 characters and share it with them yourself.

   A person who is new to Coritan needs one of the two. For someone who already has a Coritan account, leave Temporary password empty: they sign in with the password they have.

5. Under Storefront account, choose which customer account the member uses when they buy from your storefront:

   • Their own account, by email: the customer account with their email, created the first time they sign in to the staff console.
   • An existing customer account: choose it under Customer account.
   • Create a customer account now, with their email.
   • No storefront account: they only use the staff console.

6. Select Add member.

7. When the role is Admin, confirm it is you. The dialog names who you are adding, such as To add Jo Marsh as Admin, enter your password. (Confirm it is you).

An Admin can change everything but the owner, so adding one asks you to confirm it is you, as a role change does. Adding any other role does not ask.

The dashboard confirms who was added and with which role. An invited member gets an email with a link to set their password on your storefront domain, at /staff/reset-password. Members sign in to the organization's pages on coritan.com, and to the staff console with the same email and password.

1. In the member's row menu, choose Change role….
2. Choose the new role. Each one says what it may do, and the member's role now is marked (current role).
3. Select Change role.
4. If the dashboard asks, confirm it is you (Confirm it is you).

The change applies at once, and it signs the member out of every open staff console session, so their next session carries the new role. The owner's row and your own have no Change role…: the owner changes only as Hand the organization to another member describes, and another admin or the owner changes your role.

1. In the member's row menu, choose Storefront account…. The dialog shows the account the member uses Currently.
2. Under Change it to, choose Attach an existing customer and pick the account under Customer account, or choose Create a new customer account.
3. Select Attach account or Create and attach.

To make the member console-only, select Detach account instead. The customer account itself stays as it is, with its services and invoices. On your own row, this is the only change the menu offers, and an admin sees no menu on the owner's row.

1. In the member's row menu, choose Send password reset….
2. Select Send link.
3. If the dashboard asks, confirm it is you (Confirm it is you).

We email the member a link to choose a new password, at /staff/reset-password on your storefront domain. Their current password keeps working until they choose a new one.

1. In the member's row menu, choose Sign out everywhere….
2. Select Sign out everywhere.
3. If the dashboard asks, confirm it is you.

Every staff console session the member has ends at once, and so do the storefront sessions the console opened for them. The dashboard says how many sessions ended. The member signs in again with their password.

1. In the member's row menu, choose Remove member….
2. Type the member's email address, then select Remove member.
3. If the dashboard asks, confirm it is you.

The member loses access to the organization at once, here and in the staff console, and every staff console session they have ends. Their Coritan account and their storefront customer account, if they have one, are kept. The owner cannot be removed: hand the organization to someone else first (Hand the organization to another member). Your own row has no Remove member…, so another admin or the owner removes you.

The owner can make another member the owner. Only the owner can do it, signed in to coritan.com, and the new owner must already be a member with an active Coritan account.

1. In the member's row menu, choose Make owner…. You can also start from Settings, then General: in the Danger zone card, choose the member in the Transfer ownership row, then select Transfer ownership….
2. Type the organization's slug and select Transfer ownership. When the member has two-factor sign-in off, the confirmation warns you first: a password alone would then guard the account that can delete the organization. Ask them to turn it on under Settings, then Security in their dashboard before you hand it over.
3. Confirm it is you: enter your password or, when two-factor sign-in is on, a code from your authenticator or a recovery code, and select Confirm (Confirm it is you).

The member becomes the owner at once, and you stay on the team as an admin. A note at the top of the page says you are now an admin. From then on, only the new owner can delete the organization or hand it on.

A member whose account is suspended or closed cannot take the organization: their Make owner… is greyed out with the reason, and the Transfer ownership list leaves them out. A member whose invite is pending can take it, but until they set their password nobody can sign in as the owner, and the confirmation says so.

User is already a member

That email already belongs to a member of this organization. Change their role instead.

Set a temporary password or send an invite email

The email is new to Coritan, so the member needs a way to sign in. Tick Email an invitation or enter a Temporary password.

That email belongs to a suspended or closed platform account

The Coritan account with that email cannot sign in, so it cannot become a member.

Set a password from the invite email before signing in

The member tried to sign in to the staff console before following the invitation link. Ask them to open the email, or send them a password link (Help a member sign in).

No link was sent, because the storefront has no address to link to.

The password link needs an address to point to. Set the storefront's custom domain (Set your custom domain), then send the link again.

That member's account is not active, so it cannot own the organization.

The member's Coritan account is suspended or closed. Choose another member, or ask support.

• Organization roles and permissions
• Manage the staff team and console settings
• Read the organization audit log
• Delete an organization

List the members with any member's token. Each entry has the member's id, user_id, role, email, names, joined_at, customer_link_mode, linked_customer_id and account_status: active, invited (they have not set a password from their invitation yet), suspended or closed. The list is oldest first.

curl https://api.coritan.com/api/v1/orgs/acme/members \
  -H "Authorization: Bearer $CORITAN_TOKEN"

Add a member with the Owner or Admin role. The body takes email, role (support_tier1 when you leave it out), name, password (at least 8 characters), send_invite_email (false when you leave it out), customer_link (auto, existing, create or none) and customer_id for existing.

curl -X POST https://api.coritan.com/api/v1/orgs/acme/members \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "alex@example.com", "name": "Alex Example", "role": "support_tier2", "send_invite_email": true, "customer_link": "auto"}'

The answer is 201 with the new member. role takes admin, billing, support_tier3, support_tier2, support_tier1 or readonly; owner answers 400 Use transfer-ownership to assign owner. Adding an Admin ("role": "admin") needs a step-up from the last 10 minutes, sent as X-Org-Step-Up, as a role change does: without one the answer is 403 with reauth_required, and only the role is checked before it. Each person may add 20 members an hour, here and in the staff console together; past that the answer is 429.

Change a role with PATCH /api/v1/orgs/acme/members/{member_id} and a body of {"role": "billing"}, and remove a member with DELETE /api/v1/orgs/acme/members/{member_id}. Both need a step-up from the last 10 minutes, sent as X-Org-Step-Up, as the staff console's team does.

Read a member's storefront account with GET /api/v1/orgs/acme/members/{member_id}/customer-link. Attach one with PUT on the same path and a body of {"mode": "existing", "customer_id": 812}, or {"mode": "create"} to make one with the member's email. DELETE on the path makes the member console-only.

The password link and the sign-out use the staff console's team routes, and both need a recent step-up. POST /api/v1/orgs/{org_slug}/staff/team/{member_id}/reset-password emails the link and answers link_sent. POST /api/v1/orgs/{org_slug}/staff/team/{member_id}/revoke-sessions answers how many sessions ended in revoked. Manage the staff team and console settings lists the rest of those routes.

The owner hands the organization to another member with their own access token and a step-up from the last 10 minutes, sent as X-Org-Step-Up (Confirm it is you):

curl -X POST https://api.coritan.com/api/v1/orgs/acme/transfer-ownership \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "X-Org-Step-Up: $STEP_UP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"member_id": 57, "confirm": "acme"}'

member_id is the member's id from GET /members, and confirm is the organization's slug. The answer is the organization, with your new my_role, admin.