Organisations and members

An organisation brings together people, projects and billing. This page explains the ranks and what each one allows, how to invite someone, change a role or remove a member, what agencies managing several clients see, and how one account moves between organisations.

Concepts

• Organisation: the container for your projects. It is created with your account when you open it (see Your account), and you are its Owner. Seats are not billed: invite as many people as you need.
• Member: an account holding at least one role in the organisation or on one of its projects.
• Role assignment: a role placed on a scope. The scope is either the whole organisation or a single project. An assignment on a project can carry an end date; an assignment on the whole organisation cannot.
• Service account: a token for a machine, holding a rank on projects only. It is managed on the same screen but has its own page: Service accounts.

Ranks

Five ranks form a ladder: each one includes every right of the rank below. Two cross-cutting roles, Security and Billing, are added on top of a rank without being part of the ladder. The console shows the French names given in brackets.

The exact rank of each operation is in its reference page ("Rang minimal" row), for example member.manage.

Three rules complete the table:

• The most specific rank wins. An organisation Administrator brought down to Reader on one project is a Reader there.
• A second factor is required for roles that write SQL or manage keys. Maintainer, Administrator and Owner can only be given to an account holding a confirmed second factor, whatever the organisation. Otherwise the platform refuses with second_factor_required and nothing is written. See Security.
• Nobody gives more than their own rank. You cannot grant, change or remove a role above your own: an Administrator neither makes nor unmakes an Owner.

Invite someone

An invitation is personal: an address, a role and a scope, all three mandatory. It expires seven days after it is sent and can be revoked until it is accepted. Only one invitation can be pending per person and per scope.

From the console:

1. Open Membres (Members), then + Inviter (Invite).
2. Enter the address, pick the role (Administrator, Developer or Reader) and the place: the whole organisation or one project.
3. Send. The invitation shows in the "Invitations en attente" (pending invitations) card with its expiry; the button on its row revokes it.

The person receives an email with a link to /rejoindre. Without an account, they choose a password there: the account opens and the role assignment is created in one step. With an account, they sign in first and accept under their session; the account's address must be the invited one.

Note. A role that requires a second factor (Maintainer and above) can only be accepted once a factor is enrolled. The account still opens; the invitation stays valid, and the person accepts it after adding a second factor on the Compte (Account) screen.

From the command line or the API, an invitation accepts every role, including Maintainer, Owner, Security and Billing:

bastide organization invitation create --organization-id org_01JQ8ZK4M7NP2RSTVWXYZ34567 \
  --email camille@example.com --role developer --project-id prj_01JQ8ZK4M7NP2RSTVWXYZ34567

curl -X POST https://api.bastide.app/v1/organizations/org_01JQ8ZK4M7NP2RSTVWXYZ34567/invitations \
  -H "Authorization: Bearer $BASTIDE_TOKEN" -H "Content-Type: application/json" \
  -d '{ "email": "camille@example.com", "role": "reader" }'

Invitations are not available through the MCP server: an agent never brings anyone into your organisation. References: organization.invitation.create, organization.invitation.list, organization.invitation.revoke, account.invitation.accept.

Change or remove a role

The Membres screen lists every member with their role assignments, the state of their second factor and when they were last seen. It requires the Administrator rank, because it shows email addresses. Pick a member: the "Rôle d'un membre" (member's role) card opens on what they hold.

• A ladder role replaces the one the member holds in the same place.
• Security and Billing are added.
• "Retirer ce qu'il y tient" (remove what they hold there) removes everything the member holds in that place.
• "Jusqu'au" (until) dates an assignment, on a project only.

The card only acts on an existing member: an outside account comes in by invitation. If an agent changed a member's roles, the row says so.

An agent can change a role with the member_manage tool, within the rank of the person who authorised it. The operation is class E: a person approves the call before it is sent. The list is read with member_list.

{
  "organizationId": "org_01JQ8ZK4M7NP2RSTVWXYZ34567",
  "accountId": "acc_01JQ8ZK4M7NP2RSTVWXYZ34567",
  "role": "developer",
  "projectId": "prj_01JQ8ZK4M7NP2RSTVWXYZ34567",
  "expiresAt": "2026-12-31T23:59:59Z"
}

A role of null removes the assignment. A role change closes all of the member's console sessions: they sign in again with their new rights.

Transfer ownership, leave the organisation

The organisation always keeps at least one Owner. Any action that would remove the last one is refused with dernier_proprietaire.

To transfer ownership:

1. Make sure the person taking over is a member and holds a second factor.
2. Give them the Owner role on the whole organisation (only an Owner can).
3. They, or you, then remove your Owner role or bring it down to the rank you want.

There is no "Leave" button. Removing a role requires the Administrator rank: a member below that rank asks an Administrator to remove it. A whole organisation cannot be deleted yet (organization.delete is declared but not served); a project can: see Leaving Bastide.

Organisation settings

The organisation's Réglages (Settings) screen gathers what applies to the whole organisation:

• Organisation: the name, the short identifier, the org_… identifier and your roles. The name cannot be changed yet: no operation renames an organisation.
• Second facteur (second factor): the obligation and the service-account exemptions (see Security).
• GitHub: the GitHub accounts connected through Glowsoft's application, for private repositories (see Git).
• Agents: decide whether a project created by an agent is born claimed by the account that authorised it (see Agent safety).

Several organisations per account

One account can hold roles in several organisations, through invitations. At sign-in, if it has only one, the console enters it; if it has several, it offers them by name, the last one chosen on this device first. The header of every screen lets you switch. An account with no role at all has nothing to open: an administrator must invite it.

From the API or the command line, bastide account organization list returns the account's organisations, with their identifier, short identifier and your roles (account.organization.list).

Agencies and clients

An agency managing several clients gets invited into each client's organisation. The Clients screen then gathers every organisation of the account: their projects, and what needs attention (a failed last deployment, a suspended project, a project being deleted). It only reads operational data, never application data, and what it shows of each client depends on the role that client gave you.

The price list includes a volume discount (20 % from 5 to 99 active projects, 25 % from 100 on quotation) and a white-label option; see Billing. The console can display a reseller's name when it is served on that reseller's domain, but no screen or operation yet lets you set up that branding yourself. Usage per client is not shown yet.

Common errors

See also: Single sign-on, Security, Audit log, Service accounts, Billing.

Report a mistake on this page