Organization roles and permissions

Every member of an organization has one role. The roles form a ladder: each role can do everything the roles below it can, and more. The owner is the Coritan account that created the organization, or the member it was handed to; Manage members and roles explains how to give a member a role.

From the highest to the lowest:

A member added without a role gets support_tier1. The older role name support is read as support_tier3. Billing sits above the support tiers on the ladder, but live conversations and the Discord staff links are for the owner, admins and the support tiers only.

These are the tabs on coritan.com and the API paths behind them. "Any member" includes readonly.

A page your role cannot open is not in the organization's menu, and its address takes you to the overview. A call below the role it needs answers 403 with Admin access required, Billing access required, Support access required or Tier 2 support access required. A Coritan account that is not a member gets 403 Not a member of this organization.

On coritan.com, the actions that move money, end something or hand the organization over ask you to confirm it is you before they go through. They include handing the organization to another member and deleting it; changing a member's role, removing a member, signing them out everywhere and emailing them a password link; marking an invoice paid; adding credit to a customer's wallet; and, in Commerce, refunding or cancelling a store order, settling a return (its refund, an exchange's new items or a claim's replacement), and sending or scheduling an email campaign. An API key is never asked: what its scopes allow is what holds it.

The dialog Confirm it is you asks for your password or, when two-factor sign-in is on for your account, a code from your authenticator or one of your recovery codes, since the password alone is not enough then. Select Confirm and the action goes through. The dashboard does not ask again for 10 minutes in that organization, unless you reload the page. The audit log records every try, right or wrong, and after ten tries in five minutes you have to wait before trying again.

Through the API, send your password, or while two-factor sign-in is on a code (the current one from your authenticator, or one of your recovery codes, which is then used up):

curl -X POST https://api.coritan.com/api/v1/orgs/acme/step-up \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"code": "123456"}'

The answer has token, expires_at and max_age_seconds. Send the token as the X-Org-Step-Up header on that organization's requests until it expires. Without it, a route that asks first answers 403 with reauth_required.

The staff console uses the same roles. The lowest role that can use each area:

Within an area, some actions need a higher role than reading it does. The actions that move money, end things or open a customer's account also need a recent step-up: you confirm your password or a code from your authenticator, and the confirmation lasts 10 minutes. They include adding credit, refunding or charging an invoice, marking it paid, cancelling an unpaid one, deciding a refund request, closing a customer's account, acting as a customer, terminating a service, restoring or deleting a backup or snapshot, and changing a teammate's role or customer account, removing them or ending their sessions. Sign in to the staff console explains the check.

An organization API key has no role. It carries scopes instead, and it works on the Commerce API only.

• Manage members and roles
• How organizations work