[{"data":1,"prerenderedAt":1583},["ShallowReactive",2],{"navigation":3,"page:\u002Fconcepts\u002Faccounts-and-roles":1019,"surround:\u002Fconcepts\u002Faccounts-and-roles":1574},[4,21,82,133,154,1010],[5,6,7,8],"Getting started","\u002Fgetting-started","i-lucide-rocket",[9,12,15,18],[10,6,11,11],"What Kaabist is",0,[13,14,11,11],"API keys and modes","keys-and-modes",[16,17,11,11],"Your first job","first-job",[19,20,11,11],"Understanding the envelope","envelope",[22,23,24,25],"Concepts","\u002Fconcepts","i-lucide-book-open",[26,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79],[27,23,11,11],"Overview",[29,30,11,11],"Programs and versions","programs-and-versions",[32,33,11,11],"Tiers and escalation","tiers-and-escalation",[35,36,11,11],"The http tier","http-tier",[38,39,11,11],"The browser tier","browser-tier",[41,42,11,11],"Sessions","sessions",[44,45,11,11],"Human in the loop","human-in-the-loop",[47,48,11,11],"How healing works","self-healing",[50,51,11,11],"Obstacles and captchas","obstacles",[53,54,11,11],"Validation and warnings","validation-and-warnings",[56,57,11,11],"Credits and billing","credits-and-billing",[59,60,11,11],"Limits","limits",[62,63,11,11],"Locators","locators",[65,66,11,11],"Snapshots","snapshots",[68,69,11,11],"Egress and proxies","egress-and-proxies",[71,72,11,11],"Queueing and fairness","queueing",[74,75,11,11],"Accounts, organisations and roles","accounts-and-roles",[77,78,11,11],"Data retention","data-retention",[80,81,11,11],"Documents and PDFs","documents-and-pdfs",[83,84,85,86],"Guides","\u002Fguides","i-lucide-map",[87,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130],[27,84,11,11],[89,90,11,11],"Authenticated flows","authenticated-flows",[92,93,11,11],"Hosted resolve pages","hosted-resolve",[95,96,11,11],"Lists and pagination","lists-and-pagination",[98,99,11,11],"JSON and network locators","json-and-network-locators",[101,102,11,11],"Schedules and change detection","schedules-and-change-detection",[104,105,11,11],"Webhooks","webhooks",[107,108,11,11],"Bring your own providers","byo-providers",[110,111,11,11],"Testing: replay, dry-run and test mode","testing",[113,114,11,11],"Side-effect safety","side-effect-safety",[116,117,11,11],"Security & data handling","security-and-data",[119,120,11,11],"Migrating from other tools","migrating",[122,123,11,11],"Drift detection and canaries","drift-and-canaries",[125,126,11,11],"SDKs","sdks",[128,129,11,11],"The kaab CLI","cli",[131,132,11,11],"Coding agents (MCP)","mcp",[134,135,136,137],"Panel","\u002Fpanel","i-lucide-layout-dashboard",[138,139,142,145,148,151],[27,135,11,11],[140,141,11,11],"The program builder","builder",[143,144,11,11],"Picking and recording","picking-and-recording",[146,147,11,11],"Taking over a job","takeover",[149,150,11,11],"Getting help","support",[152,153,11,11],"Referrals","referrals",[155,156,157,158],"Reference","\u002Freference","i-lucide-library",[159,160,520,834,837,840,1006,1007],[27,156,11,11],[161,162,11,163],"API","api",[164,166,169,212,222,274,297,316,347,376,389,396,403,410,426,447,454],[27,165,11,11],"\u002Freference\u002Fapi",[167,168,11,11],"Interactive reference","explorer",[170,171,11,172],"Jobs","jobs",[173,176,179,182,185,188,191,194,197,200,203,206,209],[174,175,11,11],"Create job","create-job",[177,178,11,11],"List jobs","list-jobs",[180,181,11,11],"Create job batch","create-job-batch",[183,184,11,11],"Estimate job","estimate-job",[186,187,11,11],"Get job","get-job",[189,190,11,11],"List job steps","list-job-steps",[192,193,11,11],"Get job snapshot","get-job-snapshot",[195,196,11,11],"Get job screenshot","get-job-screenshot",[198,199,11,11],"Get job artifact","get-job-artifact",[201,202,11,11],"Submit job input","submit-job-input",[204,205,11,11],"Resume job","resume-job",[207,208,11,11],"Takeover job","takeover-job",[210,211,11,11],"Cancel job","cancel-job",[213,214,11,215],"Batches","batches",[216,219],[217,218,11,11],"Get batch","get-batch",[220,221,11,11],"List batch jobs","list-batch-jobs",[223,224,11,225],"Programs","programs",[226,229,232,235,238,241,244,247,250,253,256,259,262,265,268,271],[227,228,11,11],"Create program","create-program",[230,231,11,11],"List programs","list-programs",[233,234,11,11],"Lint program","lint-program",[236,237,11,11],"Get program","get-program",[239,240,11,11],"Update program","update-program",[242,243,11,11],"Delete program","delete-program",[245,246,11,11],"List program versions","list-program-versions",[248,249,11,11],"Create program version","create-program-version",[251,252,11,11],"Update program version","update-program-version",[254,255,11,11],"Delete program version","delete-program-version",[257,258,11,11],"Get program version","get-program-version",[260,261,11,11],"Publish program version","publish-program-version",[263,264,11,11],"Diff program version","diff-program-version",[266,267,11,11],"Replay program version","replay-program-version",[269,270,11,11],"Set program alias","set-program-alias",[272,273,11,11],"Delete program alias","delete-program-alias",[41,42,11,275],[276,279,282,285,288,291,294],[277,278,11,11],"Create session","create-session",[280,281,11,11],"List sessions","list-sessions",[283,284,11,11],"Get session","get-session",[286,287,11,11],"Update session","update-session",[289,290,11,11],"Delete session","delete-session",[292,293,11,11],"Verify session","verify-session",[295,296,11,11],"Refresh session","refresh-session",[298,299,11,300],"Proposals","proposals",[301,304,307,310,313],[302,303,11,11],"List proposals","list-proposals",[305,306,11,11],"Get proposal","get-proposal",[308,309,11,11],"Approve proposal","approve-proposal",[311,312,11,11],"Reject proposal","reject-proposal",[314,315,11,11],"Edit proposal","edit-proposal",[317,318,11,319],"Schedules","schedules",[320,323,326,329,332,335,338,341,344],[321,322,11,11],"Create schedule","create-schedule",[324,325,11,11],"List schedules","list-schedules",[327,328,11,11],"Get schedule","get-schedule",[330,331,11,11],"Update schedule","update-schedule",[333,334,11,11],"Delete schedule","delete-schedule",[336,337,11,11],"Pause schedule","pause-schedule",[339,340,11,11],"Resume schedule","resume-schedule",[342,343,11,11],"List schedule runs","list-schedule-runs",[345,346,11,11],"Get schedule run diff","get-schedule-run-diff",[104,105,11,348],[349,352,355,358,361,364,367,370,373],[350,351,11,11],"Create webhook","create-webhook",[353,354,11,11],"List webhooks","list-webhooks",[356,357,11,11],"Get webhook","get-webhook",[359,360,11,11],"Update webhook","update-webhook",[362,363,11,11],"Delete webhook","delete-webhook",[365,366,11,11],"Rotate webhook secret","rotate-webhook-secret",[368,369,11,11],"List webhook deliveries","list-webhook-deliveries",[371,372,11,11],"Resend webhook delivery","resend-webhook-delivery",[374,375,11,11],"Test webhook","test-webhook",[377,378,11,379],"Organisation","org",[380,383,386],[381,382,11,11],"Rotate org webhook secret","rotate-org-webhook-secret",[384,385,11,11],"Get org","get-org",[387,388,11,11],"Request data deletion","request-data-deletion",[390,391,11,392],"Credits","credits",[393],[394,395,11,11],"Get credits","get-credits",[397,398,11,399],"Ledger","ledger",[400],[401,402,11,11],"List ledger entries","list-ledger-entries",[404,405,11,406],"Usage","usage",[407],[408,409,11,11],"Get usage","get-usage",[411,412,11,413],"API keys","api-keys",[414,417,420,423],[415,416,11,11],"List API keys","list-api-keys",[418,419,11,11],"Create API key","create-api-key",[421,422,11,11],"Rotate API key","rotate-api-key",[424,425,11,11],"Revoke API key","revoke-api-key",[427,108,11,428],"BYO providers",[429,432,435,438,441,444],[430,431,11,11],"List BYO providers","list-byo-providers",[433,434,11,11],"Create BYO provider","create-byo-provider",[436,437,11,11],"Get BYO provider","get-byo-provider",[439,440,11,11],"Update BYO provider","update-byo-provider",[442,443,11,11],"Delete BYO provider","delete-byo-provider",[445,446,11,11],"Test BYO provider","test-byo-provider",[448,449,11,450],"Sites","sites",[451],[452,453,11,11],"Get site profile","get-site-profile",[455,456,11,457],"Objects","schemas",[458,460,463,466,469,470,473,476,479,482,485,487,490,493,496,499,502,505,508,511,514,517],[27,459,11,11],"\u002Freference\u002Fapi\u002Fschemas",[461,462,11,11],"ApiKey","api-key",[464,465,11,11],"Batch","batch",[467,468,11,11],"ByoProvider","byo-provider",[390,391,11,11],[471,472,11,11],"ErrorResponse","error-response",[474,475,11,11],"ExtractSchema","extract-schema",[477,478,11,11],"Job","job",[480,481,11,11],"LedgerEntry","ledger-entry",[483,484,11,11],"LintResult","lint-result",[486,378,11,11],"Org",[488,489,11,11],"Program","program",[491,492,11,11],"ProgramDefinition","program-definition",[494,495,11,11],"ProgramVersion","program-version",[497,498,11,11],"Proposal","proposal",[500,501,11,11],"Schedule","schedule",[503,504,11,11],"Session","session",[506,507,11,11],"SiteProfile","site-profile",[509,510,11,11],"StepRecord","step-record",[512,513,11,11],"Webhook","webhook",[515,516,11,11],"WebhookDelivery","webhook-delivery",[518,519,11,11],"WebhookEvent","webhook-event",[521,522,11,523],"DSL","dsl",[524,526,529,532,535,538,603,637,640,751,754,756],[27,525,11,11],"\u002Freference\u002Fdsl",[527,528,11,11],"Inputs","inputs",[530,531,11,11],"Options","options",[533,534,11,11],"Policies","policies",[536,537,11,11],"Steps","steps",[539,540,11,541],"Actions","actions",[542,544,546,548,550,552,554,556,558,560,562,565,568,570,573,575,577,579,582,585,587,589,591,594,596,598,600],[27,543,11,11],"\u002Freference\u002Fdsl\u002Factions",[545,545,11,11],"fill",[547,547,11,11],"click",[549,549,11,11],"press",[551,551,11,11],"hover",[553,553,11,11],"select",[555,555,11,11],"check",[557,557,11,11],"uncheck",[559,559,11,11],"upload",[561,561,11,11],"scroll",[563,564,11,11],"wait_for","wait-for",[566,567,11,11],"set_session","set-session",[569,569,11,11],"extract",[571,572,11,11],"capture_response","capture-response",[574,574,11,11],"evaluate",[576,576,11,11],"paginate",[578,578,11,11],"download",[580,581,11,11],"read_pdf","read-pdf",[583,584,11,11],"set_vars","set-vars",[586,586,11,11],"sleep",[588,588,11,11],"reload",[590,590,11,11],"goto",[592,593,11,11],"await_input","await-input",[595,595,11,11],"checkpoint",[597,597,11,11],"screenshot",[599,599,11,11],"when",[601,602,11,11],"loop_until","loop-until",[604,605,11,606],"Conditions","conditions",[607,609,611,613,615,617,619,621,623,625,627,629,631,633,635],[27,608,11,11],"\u002Freference\u002Fdsl\u002Fconditions",[610,610,11,11],"url",[612,612,11,11],"title",[614,614,11,11],"visible",[616,616,11,11],"hidden",[618,618,11,11],"exists",[620,620,11,11],"absent",[622,622,11,11],"text",[624,624,11,11],"count",[626,626,11,11],"network",[628,628,11,11],"var",[630,630,11,11],"landmark",[632,632,11,11],"all",[634,634,11,11],"any",[636,636,11,11],"not",[638,639,11,11],"Targets","targets",[641,642,11,643],"Fields","fields",[644,646,649,651,654,656,659,661,663,666,668,671,672,674,677,679,681,683,685,687,690,693,695,698,701,703,704,707,709,712,714,716,718,720,722,724,726,728,731,733,734,736,738,740,743,745,747,749],[27,645,11,11],"\u002Freference\u002Fdsl\u002Ffields",[647,648,11,11],"allow_suffix","allow-suffix",[650,650,11,11],"attr",[652,653,11,11],"base_url","base-url",[655,655,11,11],"candidates",[657,658,11,11],"case_insensitive","case-insensitive",[660,660,11,11],"country",[662,662,11,11],"currency",[664,665,11,11],"date_format","date-format",[667,667,11,11],"decimal",[669,670,11,11],"false_values","false-values",[642,642,11,11],[673,673,11,11],"flags",[675,676,11,11],"follow_redirects","follow-redirects",[678,678,11,11],"frame",[680,680,11,11],"json",[682,682,11,11],"locale",[684,684,11,11],"many",[686,686,11,11],"max",[688,689,11,11],"max_items","max-items",[691,692,11,11],"max_length","max-length",[694,694,11,11],"min",[696,697,11,11],"min_items","min-items",[699,700,11,11],"min_length","min-length",[702,702,11,11],"name",[626,626,11,11],[705,706,11,11],"null_markers","null-markers",[708,708,11,11],"nullable",[710,711,11,11],"on_invalid","on-invalid",[713,713,11,11],"pattern",[715,715,11,11],"presence",[717,717,11,11],"regex",[719,719,11,11],"required",[721,721,11,11],"role",[723,723,11,11],"sample",[725,725,11,11],"selector",[727,727,11,11],"source",[729,730,11,11],"strip_fragment","strip-fragment",[732,732,11,11],"testid",[622,622,11,11],[735,735,11,11],"thousands",[737,737,11,11],"timezone",[739,739,11,11],"transforms",[741,742,11,11],"true_values","true-values",[744,744,11,11],"type",[746,746,11,11],"unique",[748,748,11,11],"values",[750,750,11,11],"xpath",[752,753,11,11],"Assertions","assertions",[755,739,11,11],"Transforms",[757,758,11,759],"Lint codes","lint",[760,762,765,768,771,774,777,780,783,786,789,792,795,798,801,804,807,810,813,816,819,822,825,828,831],[27,761,11,11],"\u002Freference\u002Fdsl\u002Flint",[763,764,11,11],"E001","e001",[766,767,11,11],"E002","e002",[769,770,11,11],"E003","e003",[772,773,11,11],"E004","e004",[775,776,11,11],"E005","e005",[778,779,11,11],"E006","e006",[781,782,11,11],"E007","e007",[784,785,11,11],"E008","e008",[787,788,11,11],"E009","e009",[790,791,11,11],"E010","e010",[793,794,11,11],"E011","e011",[796,797,11,11],"E012","e012",[799,800,11,11],"E013","e013",[802,803,11,11],"E014","e014",[805,806,11,11],"W001","w001",[808,809,11,11],"W002","w002",[811,812,11,11],"W003","w003",[814,815,11,11],"W004","w004",[817,818,11,11],"W005","w005",[820,821,11,11],"W006","w006",[823,824,11,11],"W007","w007",[826,827,11,11],"W008","w008",[829,830,11,11],"W009","w009",[832,833,11,11],"W010","w010",[835,836,11,11],"Codes","codes",[838,839,11,11],"Events","events",[841,129,11,842],"CLI",[843,845,847,850,853,856,859,862,865,868,871,874,877,880,883,886,889,892,895,898,901,904,907,910,913,916,919,922,925,928,931,934,937,940,943,946,949,952,955,958,961,964,967,970,973,976,979,982,985,988,991,994,997,1000,1003],[27,844,11,11],"\u002Freference\u002Fcli",[846,846,11,11],"kaab",[848,849,11,11],"kaab auth","kaab-auth",[851,852,11,11],"kaab auth login","kaab-auth-login",[854,855,11,11],"kaab auth logout","kaab-auth-logout",[857,858,11,11],"kaab auth status","kaab-auth-status",[860,861,11,11],"kaab completion","kaab-completion",[863,864,11,11],"kaab completion bash","kaab-completion-bash",[866,867,11,11],"kaab completion fish","kaab-completion-fish",[869,870,11,11],"kaab completion powershell","kaab-completion-powershell",[872,873,11,11],"kaab completion zsh","kaab-completion-zsh",[875,876,11,11],"kaab credits","kaab-credits",[878,879,11,11],"kaab jobs","kaab-jobs",[881,882,11,11],"kaab jobs cancel","kaab-jobs-cancel",[884,885,11,11],"kaab jobs get","kaab-jobs-get",[887,888,11,11],"kaab jobs input","kaab-jobs-input",[890,891,11,11],"kaab jobs list","kaab-jobs-list",[893,894,11,11],"kaab jobs resume","kaab-jobs-resume",[896,897,11,11],"kaab jobs run","kaab-jobs-run",[899,900,11,11],"kaab jobs snapshot","kaab-jobs-snapshot",[902,903,11,11],"kaab jobs steps","kaab-jobs-steps",[905,906,11,11],"kaab jobs takeover","kaab-jobs-takeover",[908,909,11,11],"kaab open","kaab-open",[911,912,11,11],"kaab open job","kaab-open-job",[914,915,11,11],"kaab programs","kaab-programs",[917,918,11,11],"kaab programs alias","kaab-programs-alias",[920,921,11,11],"kaab programs alias set","kaab-programs-alias-set",[923,924,11,11],"kaab programs diff","kaab-programs-diff",[926,927,11,11],"kaab programs lint","kaab-programs-lint",[929,930,11,11],"kaab programs list","kaab-programs-list",[932,933,11,11],"kaab programs pull","kaab-programs-pull",[935,936,11,11],"kaab programs push","kaab-programs-push",[938,939,11,11],"kaab proposals","kaab-proposals",[941,942,11,11],"kaab proposals approve","kaab-proposals-approve",[944,945,11,11],"kaab proposals list","kaab-proposals-list",[947,948,11,11],"kaab proposals reject","kaab-proposals-reject",[950,951,11,11],"kaab proposals show","kaab-proposals-show",[953,954,11,11],"kaab schedules","kaab-schedules",[956,957,11,11],"kaab schedules create","kaab-schedules-create",[959,960,11,11],"kaab schedules list","kaab-schedules-list",[962,963,11,11],"kaab schedules pause","kaab-schedules-pause",[965,966,11,11],"kaab schedules resume","kaab-schedules-resume",[968,969,11,11],"kaab schedules runs","kaab-schedules-runs",[971,972,11,11],"kaab sessions","kaab-sessions",[974,975,11,11],"kaab sessions create","kaab-sessions-create",[977,978,11,11],"kaab sessions delete","kaab-sessions-delete",[980,981,11,11],"kaab sessions list","kaab-sessions-list",[983,984,11,11],"kaab sessions verify","kaab-sessions-verify",[986,987,11,11],"kaab usage","kaab-usage",[989,990,11,11],"kaab version","kaab-version",[992,993,11,11],"kaab webhooks","kaab-webhooks",[995,996,11,11],"kaab webhooks create","kaab-webhooks-create",[998,999,11,11],"kaab webhooks deliveries","kaab-webhooks-deliveries",[1001,1002,11,11],"kaab webhooks list","kaab-webhooks-list",[1004,1005,11,11],"kaab webhooks test","kaab-webhooks-test",[125,126,11,11],[1008,1009,11,11],"Plans and pricing","plans",[1011,1012,1013,1014],"Changelog","\u002Fchangelog","i-lucide-history",[1015,1016],[27,1012,11,11],[1017,1018,11,11],"Deprecations","deprecations",{"id":1020,"title":74,"body":1021,"breaking":1564,"date":1565,"description":1566,"extension":1567,"generated":1564,"meta":1568,"navigation":1569,"path":1570,"seo":1571,"stem":1572,"version":1565,"__hash__":1573},"docs\u002F2.concepts\u002F16.accounts-and-roles.md",{"type":1022,"value":1023,"toc":1549},"minimark",[1024,1028,1033,1036,1040,1043,1051,1055,1058,1062,1201,1204,1211,1215,1233,1279,1298,1306,1310,1321,1324,1328,1347,1394,1398,1404,1457,1461,1505,1508],[1025,1026,1027],"p",{},"People sign in to the panel with their own account and act inside an organisation through a role; programs and scripts act through API keys with a scope. Both are judged against the same list of actions, so what a person may do in the panel and what a key may do through the API never disagree.",[1029,1030,1032],"h2",{"id":1031},"when-to-use-it","When to use it",[1025,1034,1035],{},"Read this page when you invite colleagues, decide who may approve proposals or see billing, create API keys for automation, or set up two-factor authentication. The organisation is the boundary for everything else: programs, jobs, sessions, credits and keys belong to one organisation, and nothing is shared between organisations.",[1029,1037,1039],{"id":1038},"signing-in","Signing in",[1025,1041,1042],{},"The panel signs you in with an e-mail address and password (at least twelve characters, and not a commonly used one), a one-time link sent by e-mail, GitHub or Google. A password account has to confirm its address before it can act in an organisation.",[1025,1044,1045,1046,1050],{},"Your first sign-in creates a personal organisation, owned by you, so that there is always somewhere to put a program. You can rename it, create more from the organisation switcher (",[1047,1048,1049],"strong",{},"Create organisation","), and be invited into others.",[1029,1052,1054],{"id":1053},"invitations","Invitations",[1025,1056,1057],{},"An owner or admin invites by e-mail and role. The invitation is good for seven days, once, and only for the address it was sent to: whoever accepts it has to be signed in with that address. An organisation can send twenty invitations an hour.",[1029,1059,1061],{"id":1060},"roles","Roles",[1063,1064,1065,1091],"table",{},[1066,1067,1068],"thead",{},[1069,1070,1071,1075,1079,1082,1085,1088],"tr",{},[1072,1073],"th",{"align":1074},"left",[1072,1076,1078],{"align":1077},"center","owner",[1072,1080,1081],{"align":1077},"admin",[1072,1083,1084],{"align":1077},"developer",[1072,1086,1087],{"align":1077},"reviewer",[1072,1089,1090],{"align":1077},"viewer",[1092,1093,1094,1111,1126,1141,1156,1171,1186],"tbody",{},[1069,1095,1096,1100,1103,1105,1107,1109],{},[1097,1098,1099],"td",{"align":1074},"Read programs, jobs, proposals, sessions, schedules, webhooks and usage",[1097,1101,1102],{"align":1077},"✓",[1097,1104,1102],{"align":1077},[1097,1106,1102],{"align":1077},[1097,1108,1102],{"align":1077},[1097,1110,1102],{"align":1077},[1069,1112,1113,1116,1118,1120,1122,1124],{},[1097,1114,1115],{"align":1074},"Approve and reject proposals; take over, resume and cancel jobs",[1097,1117,1102],{"align":1077},[1097,1119,1102],{"align":1077},[1097,1121,1102],{"align":1077},[1097,1123,1102],{"align":1077},[1097,1125],{"align":1077},[1069,1127,1128,1131,1133,1135,1137,1139],{},[1097,1129,1130],{"align":1074},"Build and publish programs, move aliases, run jobs, manage sessions, schedules and webhooks",[1097,1132,1102],{"align":1077},[1097,1134,1102],{"align":1077},[1097,1136,1102],{"align":1077},[1097,1138],{"align":1077},[1097,1140],{"align":1077},[1069,1142,1143,1146,1148,1150,1152,1154],{},[1097,1144,1145],{"align":1074},"See API keys and the audit log",[1097,1147,1102],{"align":1077},[1097,1149,1102],{"align":1077},[1097,1151,1102],{"align":1077},[1097,1153],{"align":1077},[1097,1155],{"align":1077},[1069,1157,1158,1161,1163,1165,1167,1169],{},[1097,1159,1160],{"align":1074},"Create, rotate and revoke API keys",[1097,1162,1102],{"align":1077},[1097,1164,1102],{"align":1077},[1097,1166],{"align":1077},[1097,1168],{"align":1077},[1097,1170],{"align":1077},[1069,1172,1173,1176,1178,1180,1182,1184],{},[1097,1174,1175],{"align":1074},"Billing, bring-your-own providers, members and invitations, organisation settings",[1097,1177,1102],{"align":1077},[1097,1179,1102],{"align":1077},[1097,1181],{"align":1077},[1097,1183],{"align":1077},[1097,1185],{"align":1077},[1069,1187,1188,1191,1193,1195,1197,1199],{},[1097,1189,1190],{"align":1074},"Delete the organisation",[1097,1192,1102],{"align":1077},[1097,1194],{"align":1077},[1097,1196],{"align":1077},[1097,1198],{"align":1077},[1097,1200],{"align":1077},[1025,1202,1203],{},"Only an owner may make somebody an owner or an admin, and an organisation always keeps at least one owner. The last owner cannot leave.",[1025,1205,1206,1207,1210],{},"A ",[1208,1209,1087],"code",{}," is the role for people who keep programs running without building them: they approve healing proposals, take over parked jobs and resume them, but cannot see keys or billing.",[1029,1212,1214],{"id":1213},"api-keys-and-scopes","API keys and scopes",[1025,1216,1217,1218,1221,1222,1225,1226,1221,1229,1232],{},"An API key belongs to the organisation, not to the person who created it. It has a mode, ",[1208,1219,1220],{},"live"," (",[1208,1223,1224],{},"sk_live_…",") or ",[1208,1227,1228],{},"test",[1208,1230,1231],{},"sk_test_…","), and one or more scopes:",[1063,1234,1235,1245],{},[1066,1236,1237],{},[1069,1238,1239,1242],{},[1072,1240,1241],{},"Scope",[1072,1243,1244],{},"May",[1092,1246,1247,1257,1270],{},[1069,1248,1249,1254],{},[1097,1250,1251],{},[1208,1252,1253],{},"read",[1097,1255,1256],{},"read everything a key may read: programs, jobs, proposals, sessions, schedules, the organisation, credits, usage",[1069,1258,1259,1264],{},[1097,1260,1261],{},[1208,1262,1263],{},"run",[1097,1265,1266,1267,1269],{},"everything ",[1208,1268,1253],{}," may, plus create and act on jobs, write and publish programs, decide proposals, manage sessions and schedules",[1069,1271,1272,1276],{},[1097,1273,1274],{},[1208,1275,1081],{},[1097,1277,1278],{},"everything, including keys, webhooks, bring-your-own providers and organisation settings; never members, and never deleting the organisation",[1025,1280,1281,1282,1284,1285,1287,1288,1291,1292,1297],{},"A key creates keys of its own mode only, and only an owner, an admin or an ",[1208,1283,1081],{}," key grants ",[1208,1286,1081],{},". A refused request answers ",[1208,1289,1290],{},"403",". See ",[1293,1294,1296],"a",{"href":1295},"\u002Fgetting-started\u002Fkeys-and-modes","Keys and modes"," for creating, rotating and revoking keys.",[1025,1299,1300,1301,1305],{},"A coding agent connected over MCP acts through an OAuth grant instead of a key: its permissions are the scopes you granted, limited by your own current role. See ",[1293,1302,1304],{"href":1303},"\u002Fguides\u002Fmcp","MCP",".",[1029,1307,1309],{"id":1308},"two-factor-authentication","Two-factor authentication",[1025,1311,1312,1313,1316,1317,1320],{},"Owners and admins need an authenticator app (TOTP) for the actions that matter most: keys, billing, members, bring-your-own providers, sessions and deleting the organisation. A new organisation's owners have seven days before this applies; after that, an owner or admin without it is refused those actions with ",[1208,1314,1315],{},"403 two_factor_required",". Creating, rotating or revoking a key, changing the organisation or the payment method, and deleting the organisation also ask for your password or a code again if you have not entered one in the last fifteen minutes (",[1208,1318,1319],{},"403 reauth_required",").",[1025,1322,1323],{},"Enrolling gives you ten backup codes; each works once.",[1029,1325,1327],{"id":1326},"in-the-panel","In the panel",[1025,1329,1330,1331,1334,1335,1338,1339,1341,1342,1338,1345,1305],{},"Your account menu has ",[1047,1332,1333],{},"Profile",", ",[1047,1336,1337],{},"Security"," and ",[1047,1340,411],{},"; the organisation switcher has ",[1047,1343,1344],{},"Organisation settings",[1047,1346,1049],{},[1348,1349,1350,1366,1379,1385],"ul",{},[1351,1352,1353,1355,1356,1358,1359,1362,1363,1365],"li",{},[1047,1354,1337],{}," shows ",[1047,1357,1309],{}," (\"a code from an authenticator app at every sign-in\") with buttons for new backup codes and to turn it off, your ",[1047,1360,1361],{},"Password",", and ",[1047,1364,41],{},": the browsers signed in to your account. An owner or admin who turns two-factor off is warned that keys, members and billing will be locked for them until they turn it on again.",[1351,1367,1368,1370,1371,1374,1375,1378],{},[1047,1369,377],{}," settings show the name, slug, region and plan; ",[1047,1372,1373],{},"Leave organisation","; and, for an owner, ",[1047,1376,1377],{},"Delete organisation",", which asks you to type the organisation's name and says that programs, jobs, results, snapshots, sessions and keys are deleted within 24 hours.",[1351,1380,1381,1384],{},[1047,1382,1383],{},"Members"," lists everyone with their role and whether two-factor is on, lets an owner or admin change a role, and removes a member, who loses access at once.",[1351,1386,1387,1389,1390,1393],{},[1047,1388,1054],{}," has an ",[1047,1391,1392],{},"Invite people"," form (e-mail and role; \"they get an e-mail with a link that works once, for seven days\") and the pending invitations.",[1029,1395,1397],{"id":1396},"worked-example","Worked example",[1025,1399,1400,1401,1305],{},"A team of three automates price checks on ",[1208,1402,1403],{},"https:\u002F\u002Fshop.example.com",[1405,1406,1407,1417,1426,1436,1451],"ol",{},[1351,1408,1409,1410,1413,1414,1416],{},"Ayşe signs up and gets a personal organisation; she renames it ",[1208,1411,1412],{},"acme-pricing"," and turns on two-factor under ",[1047,1415,1337],{},", because as its owner she will need it for keys and billing.",[1351,1418,1419,1420,1422,1423,1425],{},"She invites Deniz as ",[1208,1421,1084],{}," and Mert as ",[1208,1424,1087],{},". Each gets an e-mail with a link that works once, for seven days, and only for that address.",[1351,1427,1428,1429,1432,1433,1435],{},"Deniz builds the program, publishes it and puts it on a schedule. He can see the organisation's API keys but cannot create one, so Ayşe creates an ",[1208,1430,1431],{},"sk_live_"," key with the ",[1208,1434,1263],{}," scope for their CI.",[1351,1437,1438,1439,1442,1443,1446,1447,1450],{},"The site changes. A ",[1208,1440,1441],{},"relocate"," proposal arrives, and Mert, as a reviewer, opens it under ",[1047,1444,1445],{},"Review"," and approves it with ",[1047,1448,1449],{},"Promote",". He cannot see the billing page or the keys.",[1351,1452,1453,1454,1456],{},"Later Deniz leaves the company. Ayşe removes him under ",[1047,1455,1383],{},"; he loses access at once. The CI key keeps working, because it belongs to the organisation, not to Deniz.",[1029,1458,1460],{"id":1459},"pitfalls","Pitfalls",[1348,1462,1463,1469,1478,1484,1499],{},[1351,1464,1465,1468],{},[1047,1466,1467],{},"Keys outlive people."," Removing a member does not revoke the keys they created. Rotate keys a departing person had access to.",[1351,1470,1471,1474,1475,1477],{},[1047,1472,1473],{},"A reviewer cannot run jobs."," Give ",[1208,1476,1084],{}," to anyone who needs to create jobs, not only approve them.",[1351,1479,1480,1483],{},[1047,1481,1482],{},"Two-factor applies to owners and admins after seven days."," Enrol before the grace period ends, or keys, billing and members lock for you.",[1351,1485,1486,1492,1493,1495,1496,1498],{},[1047,1487,1488,1489,1491],{},"An ",[1208,1490,1081],{}," key can do almost everything an admin can."," Use ",[1208,1494,1263],{}," for automation and keep ",[1208,1497,1081],{}," keys for tooling that manages keys or webhooks.",[1351,1500,1501,1504],{},[1047,1502,1503],{},"Test keys run test jobs only."," A key's mode decides the job's mode; a request cannot override it.",[1029,1506,155],{"id":1507},"reference",[1348,1509,1510,1519,1533,1543],{},[1351,1511,1512,1338,1515],{},[1293,1513,1061],{"href":1514},"\u002Freference\u002Fcodes#roles",[1293,1516,1518],{"href":1517},"\u002Freference\u002Fcodes#key-scopes","key scopes",[1351,1520,1521,1334,1525,1334,1529],{},[1293,1522,1524],{"href":1523},"\u002Freference\u002Fapi\u002Fapi-keys\u002Fcreate-api-key","Create an API key",[1293,1526,1528],{"href":1527},"\u002Freference\u002Fapi\u002Fapi-keys\u002Frotate-api-key","rotate",[1293,1530,1532],{"href":1531},"\u002Freference\u002Fapi\u002Fapi-keys\u002Frevoke-api-key","revoke",[1351,1534,1535,1338,1539],{},[1293,1536,1538],{"href":1537},"\u002Freference\u002Fapi\u002Fschemas\u002Fapi-key","API key schema",[1293,1540,1542],{"href":1541},"\u002Freference\u002Fapi\u002Fschemas\u002Forg","organisation schema",[1351,1544,1545],{},[1293,1546,1548],{"href":1547},"\u002Fguides\u002Fsecurity-and-data","Security and data",{"title":1550,"searchDepth":1551,"depth":1551,"links":1552},"",3,[1553,1555,1556,1557,1558,1559,1560,1561,1562,1563],{"id":1031,"depth":1554,"text":1032},2,{"id":1038,"depth":1554,"text":1039},{"id":1053,"depth":1554,"text":1054},{"id":1060,"depth":1554,"text":1061},{"id":1213,"depth":1554,"text":1214},{"id":1308,"depth":1554,"text":1309},{"id":1326,"depth":1554,"text":1327},{"id":1396,"depth":1554,"text":1397},{"id":1459,"depth":1554,"text":1460},{"id":1507,"depth":1554,"text":155},false,null,"Signing in to the panel, organisations and invitations, the five roles and what each may do, API key scopes, and two-factor authentication.","md",{},true,"\u002Fconcepts\u002Faccounts-and-roles",{"title":74,"description":1566},"2.concepts\u002F16.accounts-and-roles","VJ_KnllJE1PHqHPyou-nWlU7uABEa8yTs4h70Dgbcpo",[1575,1579],{"title":71,"path":1576,"stem":1577,"description":1578,"children":-1},"\u002Fconcepts\u002Fqueueing","2.concepts\u002F15.queueing","Why your job starts when it does: priorities, plan weights, concurrency, credits, session locks, and what happens to a job when its worker dies.",{"title":77,"path":1580,"stem":1581,"description":1582,"children":-1},"\u002Fconcepts\u002Fdata-retention","2.concepts\u002F17.data-retention","What Kaabist stores about your work, where it lives, when it is deleted, and how to ask for everything to be erased.",1793593413918]