> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mithunai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Team Members, Invitations & Access Management

> Manage organization membership, invite team members, assign role-based access control (RBAC) tiers, and audit administrative actions.

MITHUNAI organizations support multi-user collaboration governed by a four-tier Role-Based Access Control (RBAC) model. Organization Owners and Administrators can invite colleagues, designate appropriate permission boundaries, and revoke access instantly across both the graphical Web Console and the `/arukz/api/v1/members` HTTP API.

```mermaid theme={"theme":{"light":"github-light","dark":"github-dark"}}
flowchart TD
    OWNER["Owner\n(Full Governance & Billing)"]
    ADMIN["Administrator\n(API Keys & Branding)"]
    EDITOR["Editor\n(Assistants & Knowledge)"]
    MEMBER["Member\n(Ask & Search)"]

    OWNER --> ADMIN --> EDITOR --> MEMBER
```

***

## Role Permissions Matrix

Permissions are strictly bounded by organization scope. A member holds exactly one role within an organization:

| Permission Area                            | Owner | Administrator | Editor | Member |
| :----------------------------------------- | :---: | :-----------: | :----: | :----: |
| **Manage Billing & Organization Deletion** |  Yes  |       No      |   No   |   No   |
| **Manage Support Access Consent**          |  Yes  |      Yes      |   No   |   No   |
| **Create & Revoke API Keys**               |  Yes  |      Yes      |   No   |   No   |
| **Configure White-Label Branding**         |  Yes  |      Yes      |   No   |   No   |
| **Manage Knowledge Sources & Sync**        |  Yes  |      Yes      |   Yes  |   No   |
| **Create & Configure Assistants**          |  Yes  |      Yes      |   Yes  |   No   |
| **Publish Widget Deployments**             |  Yes  |      Yes      |   Yes  |   No   |
| **Ask Questions & View Own Conversations** |  Yes  |      Yes      |   Yes  |   Yes  |

<Note>
  **The Principle of Non-Escalation**: An Administrator cannot create an Owner API key or grant the
  Owner role to another user. You can only assign roles at or below your own privilege tier.
</Note>

***

## Inviting a Team Member

### Via Web Console

1. Navigate to **Settings → Members** in the console sidebar.
2. Click **Invite Member**.
3. Enter the colleague's corporate email address.
4. Select the target role (`Administrator`, `Editor`, or `Member`).
5. Click **Send Invitation**. The user receives an email with an activation link.

### Via HTTP API

```bash Invite Member theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -X POST https://app.mithunai.com/arukz/api/v1/members \
  -H "Authorization: Bearer $MITHUNAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "dev-lead@example.com",
    "role": "editor"
  }'
```

***

## Listing Organization Members

Retrieve all current members, active roles, and last sign-in timestamps:

```bash List Members theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl https://app.mithunai.com/arukz/api/v1/members \
  -H "Authorization: Bearer $MITHUNAI_API_KEY"
```

```json Response theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "members": [
    {
      "id": "mem_01j8k92f",
      "email": "sarah.chen@example.com",
      "name": "Sarah Chen",
      "role": "owner",
      "joined_at": "2026-08-15T10:00:00Z"
    },
    {
      "id": "mem_01j8k93a",
      "email": "dev-lead@example.com",
      "name": "Alex Mercer",
      "role": "editor",
      "joined_at": "2026-09-01T14:32:00Z"
    }
  ]
}
```

***

## Revoking Membership & Session Termination

When an employee departs or changes responsibilities, revoking membership takes effect immediately:

* **Instant Active Session Invalidation**: The user's active JWT session tokens are invalidated at the gateway layer within milliseconds.
* **Zero In-Flight Access**: Any pending or running queries initiated by the revoked user are terminated.
* **Audit Logging**: The revocation event, timestamp, and revoking administrator's ID are logged to the organization's immutable audit log.