Platform: Team and roles

Give engineers access to integrations, finance teammates access to billing, and other teammates a read-only view. Roles apply within each organization, so the same person can have different responsibilities in different teams.

Roles

Owners manage everything, including members and roles. Developers manage API keys, service accounts and Subgraph resources, billing admins manage billing, and every role can read the dashboard and usage.

Role	Best for
Owner	Trusted administrators who manage team access, billing, and every resource.
Developer	Engineers who operate integrations, API keys, service accounts, Managed Subgraphs, and Endpoint Aliases.
Billing admin	Finance or operations teammates who manage the monthly plan, top-ups, automatic top-ups, payment, invoices, and alerts.
Viewer	Teammates who need visibility without change access.

Each role is a set of permissions, one for each action with its own consequence. The platform, the GraphOps platform API, and service accounts use the same permissions. The last column shows whether a service account can hold each one. Person only permissions create or change credentials and service accounts, move money, or change who belongs to the organization, so only a signed-in person can use them. Before a person-only change, GraphOps asks you to sign in again if you have not signed in recently.

Area	Permission	Owner	Developer	Billing admin	Viewer	Service account
Organization	Read organization overview	Yes	Yes	Yes	Yes	Yes
Services	Read data services	Yes	Yes	Yes	Yes	Yes
Usage	Read usage	Yes	Yes	Yes	Yes	Yes
Subgraphs	Read Subgraphs	Yes	Yes	Yes	Yes	Yes
Subgraphs	Run explorer queries	Yes	Yes	Yes	Yes	No
Substreams	Read Substreams packages	Yes	Yes	Yes	Yes	Yes
Managed Subgraphs	Read Managed Subgraphs	Yes	Yes	Yes	Yes	Yes
	Create Managed Subgraphs	Yes	Yes	No	No	Yes
	Rename Managed Subgraphs	Yes	Yes	No	No	Yes
	Stage deployments	Yes	Yes	No	No	Yes
	Cancel Next	Yes	Yes	No	No	Yes
	Promote Next	Yes	Yes	No	No	Yes
	Reconfigure Managed Subgraphs	Yes	Yes	No	No	Yes
	Delete Managed Subgraphs	Yes	Yes	No	No	Yes
Endpoint Aliases	Read Endpoint Aliases	Yes	Yes	Yes	Yes	Yes
	Create Endpoint Aliases	Yes	Yes	No	No	Yes
	Retarget Endpoint Aliases	Yes	Yes	No	No	Yes
	Reconfigure Endpoint Aliases	Yes	Yes	No	No	Yes
	Delete Endpoint Aliases	Yes	Yes	No	No	Yes
API keys	Read API keys	Yes	Yes	No	No	Yes
	Create query keys	Yes	Yes	No	No	Person only
	Edit API key access	Yes	Yes	No	No	Person only
	Rotate API keys	Yes	Yes	No	No	Person only
	Rename API keys	Yes	Yes	No	No	Yes
	Revoke API keys	Yes	Yes	No	No	Yes
Service accounts	Read service accounts	Yes	Yes	No	No	Yes
	Create service accounts	Yes	Yes	No	No	Person only
	Edit service accounts	Yes	Yes	No	No	Person only
	Create service account keys	Yes	Yes	No	No	Person only
	Delete service accounts	Yes	Yes	No	No	Person only
Members	Read members	Yes	No	No	No	Yes
	Change member roles	Yes	No	No	No	Person only
	Remove members	Yes	No	No	No	Person only
Invitations	Read invitations	Yes	No	No	No	Yes
	Invite members	Yes	No	No	No	Person only
	Resend invitations	Yes	No	No	No	Person only
	Revoke invitations	Yes	No	No	No	Person only
Billing	Read billing	Yes	No	Yes	No	Yes
	Make purchases	Yes	No	Yes	No	Person only
	Reduce and cancel	Yes	No	Yes	No	Person only
	Change billing details	Yes	No	Yes	No	Person only
	Change billing notifications	Yes	No	Yes	No	Person only

Your role applies equally to the platform, direct API requests, and authenticated support reads. Every member can see usage and technical resources, plus the plan size, remaining credits, and active-key count on Overview.

Choose the narrowest role that covers each person's work. Custom roles and a separate admin role are not available: use the owner role for team administration and the billing admin role for payment responsibilities. The person who creates an organization becomes its owner.

Invite a teammate

An invitation stays pending for 7 days, and an owner can resend an expired one to reopen it for another 7 days. The recipient joins only by signing in with the invited email and accepting it; creating an account alone does not join the organization. Revoked and accepted links cannot be reused.

As an Owner, open Organization → Invitations.
Invite the teammate by email and choose the least-privileged role that matches their job. You can offer only a role whose permissions your own role includes, so only an owner can invite an owner.
Tell the recipient which organization they are joining and which email you used.
The recipient signs in with the invited email, verifies it if needed, and accepts the invitation. Creating an account alone does not accept it.

Check the email address before sending. If the role or recipient is wrong, revoke the pending invitation and send a new one; accepted and revoked invitation links cannot be reused.

If an invitation expires before the recipient accepts it, open the Archived tab and choose Resend from its row menu. The same invitation becomes pending again for another 7 days, and the recipient gets a new email. Resend is unavailable when a newer pending invitation already exists for that email.

Update or remove access

Owners can change roles or remove members from Organization → Members. Like an invitation, a role change never grants a role with permissions your own role lacks. Review access before sensitive work begins and whenever someone's responsibilities change.

When you remove someone who had access to API key secrets, rotate or revoke the keys they could have copied. Removing a member, or changing their role, does not change or revoke the keys or service accounts they created; Created by in API keys shows who created each key.

When your own role changes while the dashboard is open, the next refresh verifies your membership and updates the pages you can use. You remain in the organization; a page outside your new role returns to Overview.

RolesCopy Anchor Link

Invite a teammateCopy Anchor Link

Update or remove accessCopy Anchor Link

Next stepsCopy Anchor Link

Roles

Invite a teammate

Update or remove access

Next steps