Organizations and projects
Understand organization-wide roles, project boundaries, grants, and lifecycle.
An organization is the top-level tenancy boundary in the API Platform. It owns projects, members, billing, and organization-wide policy. Projects divide integrations within that boundary: they scope API keys, member access, usage and request-log attribution, and applicable project limits.
Roles and project grants
| Role | Scope | Primary responsibilities |
|---|---|---|
| Owner | Organization-wide | Full administration, including managing Owners and deleting the organization. |
| Admin | Organization-wide | Manage members, invites, project grants, projects, and organization settings. |
| Developer | Granted projects | Create and revoke credentials and read operational data within explicitly granted projects. |
| Viewer | Granted projects | Read usage, logs, resolved limits, and membership information without creating credentials or changing configuration. |
An organization can have more than one Owner, and always has at least one. Only an Owner can make a member Owner, or change or remove another Owner. Invitations never carry the Owner role: invite the person first, then make them Owner from the members list. The last Owner cannot change their own role, be removed, or leave the organization until another member is made Owner.
Developer and Viewer access is default-deny: they can access only explicitly granted projects. Owner and Admin access is organization-wide and does not depend on project grants.
API key authority is independent of the role held by the member who created the key. A later role or membership change does not silently change a running integration’s key permissions.
Open Organization
Manage organization membership, roles, invitations, grants, and settings.
Project lifecycle
Every organization has a Default Project and can create additional projects for separate applications, environments, teams, or customers.
- The Default Project can be renamed but cannot be archived.
- Archiving another project retires its API keys; final invalidation can take about a minute.
- Archived projects remain as historical attribution for usage and request logs.
- Treat each production integration as its own project when it needs independent credentials, access, or attribution.
Open Projects
Manage the project boundaries within an organization.