# Team and roles

Source: https://docs.graphops.xyz/platform/team-and-roles

Give engineers access to integrations, finance teammates access to billing, and other teammates a
read-only view. Roles apply within each organization, so the same person can have different
responsibilities in different teams.

## Roles

_Owners manage everything, including members and roles. Developers manage API keys, service accounts and Subgraph resources, billing admins manage billing, and every role can read the dashboard and usage._

- Members and roles: Owner
- API keys: Owner, Developer
- Service accounts: Owner, Developer
- Managed Subgraphs and Endpoint Aliases: Owner, Developer
- Billing: Owner, Billing admin
- Read dashboard and usage: Owner, Developer, Billing admin, Viewer

| Role          | Best for                                                                                                                |
| ------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Owner         | Trusted administrators who manage team access, billing, and every resource.                                             |
| Developer     | Engineers who operate integrations, API keys, service accounts, Managed Subgraphs, and Endpoint Aliases.                |
| Billing admin | Finance or operations teammates who manage the monthly plan, top-ups, automatic top-ups, payment, invoices, and alerts. |
| Viewer        | Teammates who need visibility without change access.                                                                    |

Each role is a set of permissions, one for each action with its own consequence. The platform, the
GraphOps platform API, and [service accounts](/platform/service-accounts#choose-permissions)
use the same permissions. The last column shows whether a service account can hold each one.
**Person only** permissions create or change credentials and service accounts, move money, or
change who belongs to the organization, so only a signed-in person can use them. Before a
person-only change, GraphOps asks you to
[sign in again](/platform/account-and-security#sign-in-again-for-sensitive-changes) if you have not
signed in recently.

| Area | Permission | Owner | Developer | Billing admin | Viewer | Service account |
| --- | --- | --- | --- | --- | --- | --- |
| Organization | Read organization overview | Yes | Yes | Yes | Yes | Yes |
| Services | Read data services | Yes | Yes | Yes | Yes | Yes |
| Usage | Read usage | Yes | Yes | Yes | Yes | Yes |
| Subgraphs | Read Subgraphs | Yes | Yes | Yes | Yes | Yes |
| Subgraphs | Run explorer queries | Yes | Yes | Yes | Yes | No |
| Substreams | Read Substreams packages | Yes | Yes | Yes | Yes | Yes |
| Managed Subgraphs | Read Managed Subgraphs | Yes | Yes | Yes | Yes | Yes |
| Managed Subgraphs | Create Managed Subgraphs | Yes | Yes | — | — | Yes |
| Managed Subgraphs | Rename Managed Subgraphs | Yes | Yes | — | — | Yes |
| Managed Subgraphs | Stage deployments | Yes | Yes | — | — | Yes |
| Managed Subgraphs | Cancel Next | Yes | Yes | — | — | Yes |
| Managed Subgraphs | Promote Next | Yes | Yes | — | — | Yes |
| Managed Subgraphs | Reconfigure Managed Subgraphs | Yes | Yes | — | — | Yes |
| Managed Subgraphs | Delete Managed Subgraphs | Yes | Yes | — | — | Yes |
| Endpoint Aliases | Read Endpoint Aliases | Yes | Yes | Yes | Yes | Yes |
| Endpoint Aliases | Create Endpoint Aliases | Yes | Yes | — | — | Yes |
| Endpoint Aliases | Retarget Endpoint Aliases | Yes | Yes | — | — | Yes |
| Endpoint Aliases | Reconfigure Endpoint Aliases | Yes | Yes | — | — | Yes |
| Endpoint Aliases | Delete Endpoint Aliases | Yes | Yes | — | — | Yes |
| API keys | Read API keys | Yes | Yes | — | — | Yes |
| API keys | Create query keys | Yes | Yes | — | — | Person only |
| API keys | Edit API key access | Yes | Yes | — | — | Person only |
| API keys | Rotate API keys | Yes | Yes | — | — | Person only |
| API keys | Rename API keys | Yes | Yes | — | — | Yes |
| API keys | Revoke API keys | Yes | Yes | — | — | Yes |
| Service accounts | Read service accounts | Yes | Yes | — | — | Yes |
| Service accounts | Create service accounts | Yes | Yes | — | — | Person only |
| Service accounts | Edit service accounts | Yes | Yes | — | — | Person only |
| Service accounts | Create service account keys | Yes | Yes | — | — | Person only |
| Service accounts | Delete service accounts | Yes | Yes | — | — | Person only |
| Members | Read members | Yes | — | — | — | Yes |
| Members | Change member roles | Yes | — | — | — | Person only |
| Members | Remove members | Yes | — | — | — | Person only |
| Invitations | Read invitations | Yes | — | — | — | Yes |
| Invitations | Invite members | Yes | — | — | — | Person only |
| Invitations | Resend invitations | Yes | — | — | — | Person only |
| Invitations | Revoke invitations | Yes | — | — | — | Person only |
| Billing | Read billing | Yes | — | Yes | — | Yes |
| Billing | Make purchases | Yes | — | Yes | — | Person only |
| Billing | Reduce and cancel | Yes | — | Yes | — | Person only |
| Billing | Change billing details | Yes | — | Yes | — | Person only |
| Billing | Change billing notifications | Yes | — | Yes | — | Person only |

Your role applies equally to the platform, direct API requests, and authenticated support reads.
Every member can see usage and technical resources, plus the plan size, remaining credits, and
active-key count on **Overview**.

Choose the narrowest role that covers each person's work. Custom roles and a separate admin role
are not available: use the owner role for team administration and the billing admin role for
payment responsibilities. The person who creates an organization becomes its owner.

## Invite a teammate

_An invitation stays pending for 7 days, and an owner can resend an expired one to reopen it for another 7 days. The recipient joins only by signing in with the invited email and accepting it; creating an account alone does not join the organization. Revoked and accepted links cannot be reused._

1. Owner invites: Email and role.
2. Pending: Expires after 7 days.
3. Recipient accepts: Signed in with that email.
4. Member: Has the chosen role.

- Expired: No answer within 7 days; an owner can resend it.
- Revoked: An owner withdrew it.

1. As an **Owner**, open
**Organization → Invitations**.
2. Invite the teammate by email and choose the least-privileged role that matches their job. You
can offer only a role whose permissions your own role includes, so only an owner can invite an
owner.
3. Tell the recipient which organization they are joining and which email you used.
4. The recipient signs in with the invited email, verifies it if needed, and accepts the
invitation. Creating an account alone does not accept it.

Check the email address before sending. If the role or recipient is wrong, revoke the pending
invitation and send a new one; accepted and revoked invitation links cannot be reused.

If an invitation expires before the recipient accepts it, open the
**Archived** tab and choose **Resend** from its row menu. The same
invitation becomes pending again for another 7 days, and the recipient gets a new email. Resend is
unavailable when a newer pending invitation already exists for that email.

## Update or remove access

Owners can change roles or remove members from
**Organization → Members**. Like an invitation,
a role change never grants a role with permissions your own role lacks. Review access before
sensitive work begins and whenever someone's responsibilities change.

When you remove someone who had access to API key secrets, rotate or revoke the keys they could
have copied. Removing a member, or changing their role, does not change or revoke the keys or
service accounts they created; **Created by** in
**API keys** shows who created each key.

When your own role changes while the dashboard is open, the next refresh verifies your membership
and updates the pages you can use. You remain in the organization; a page outside your new role
returns to **Overview**.

## Next steps

* [API keys](/platform/api-keys): Give each workload its own key and rotate exposed ones.
* [Service accounts](/platform/service-accounts): Give your automation its own identity and permissions.
* [Billing and credits](/platform/billing-and-credits): Set up your monthly plan, automatic top-ups, payment details, and low-credit alerts.
* [Secure your account](/platform/account-and-security): Protect owner and billing accounts with two-factor authentication.