# Team

Organisations, the owner, admin and viewer roles, invitations by email, switching and deleting organisations, and the audit log in the punchout.dev portal.

URL: https://punchout.dev/docs/account/team/

This page explains how organisations, roles and invitations work in the punchout.dev portal, and what the audit log records.

## Organisations

An organisation holds shops, a team and a plan. Signing up creates one, named after the company you enter, with you as its owner. One account can belong to several organisations.

- **Switch organisation** in the top left of the portal changes the organisation you are working in. The portal remembers your choice across reloads.
- **New organisation …** in the same menu creates another organisation with its own shops, team and plan. You become its owner, the portal switches to it, and it starts on the Sandbox plan.
- **Settings** → **Organisation** shows the name, the **Organisation ID**, your role and the plan. Owners and admins can change the name and the **Billing email**.

## Roles

| | Viewer | Admin | Owner |
| --- | --- | --- | --- |
| See shops, buyers, usage, members, billing and the audit log | Yes | Yes | Yes |
| Create, change and delete shops | No | Yes | Yes |
| Create, rotate, disable and delete buyer credentials | No | Yes | Yes |
| Create setup links, start test punchouts | No | Yes | Yes |
| Claim a shop from an instant tag | No | Yes | Yes |
| Rename the organisation, change the billing email | No | Yes | Yes |
| Invite admins and viewers, change their roles, remove them | No | Yes | Yes |
| Invite, promote, demote or remove owners | No | No | Yes |
| Buy a plan, switch plans, book connections, open billing | No | No | Yes |
| Delete the organisation | No | No | Yes |

A viewer sees a "Read-only access" note on pages they cannot change. Plan notices by email (transfer allowance, Sandbox end, refused launches) go to every owner.

## Invite someone

1. Open **Settings** → **Members** and click **Invite member**.
2. Enter the email address and choose the role. Only an owner can invite an owner.
3. Click **Send invitation**. The link in the email is valid for seven days and works once.

**Invitations** on the same page lists pending invitations with their expiry, and **Revoke** withdraws one. A second invitation to the same address replaces the first. The portal refuses an address that already belongs to the organisation, and one whose email bounced or was reported as spam. In the second case, check the address with the person and contact support to release it.

## Accept an invitation

The link opens the portal's invitation page, which names the organisation, the invited address and the role.

| Situation | What to do |
| --- | --- |
| No account for the invited address | Choose a password and click **Create account and join**. The account is confirmed at once, because the link proved the mailbox |
| An account exists | **Sign in and join** with that account's password |
| Already signed in as the invited account | **Join** |
| Signed in as a different account | Enter the password of the invited account and click **Sign in and join** |

After joining, the portal signs you in to the new organisation. An account that had never confirmed its address counts as confirmed after accepting.

## Change roles and remove members

On **Settings** → **Members**, change a role in the member's row, or remove the member. A removed member loses access at once. Owners and admins can leave an organisation by removing themselves the same way. A viewer cannot remove themselves, so an owner or admin does it for them. Coming back takes a new invitation.

The last owner can neither be demoted nor removed, and cannot leave. The portal marks that member as "last owner". To hand an organisation over, make someone else an owner first.

## Delete an organisation

Only owners can use **Settings** → **Organisation** → **Delete organisation**.

- You confirm by typing the organisation's name.
- Deleting is refused while a subscription is running. Cancel it first in **Manage billing** under **Settings** → **Billing**. A canceled subscription runs until the end of its period, so deleting works after that date.
- It deletes the organisation's shops with their buyer credentials, sessions, setup links and test punchout results, and all memberships.
- The members' accounts stay. Members who were working in the deleted organisation continue in their next one.
- The audit log entries are not deleted with the organisation. They include an entry for the deletion itself.

Deleting cannot be undone.

## The audit log

**Settings** → **Audit log** lists what happened in the organisation, newest first, with **When**, **Who**, **Action**, **Target** and **Details**. **Load more** pages back. Every member can read it, viewers included.

It records, among others:

- sign-ins, sign-outs and password changes of members;
- shops created, changed, deleted and claimed;
- buyer credentials created, changed, rotated and deleted;
- setup links created and revoked, test punchouts started;
- organisation changes, role changes, removals, invitations sent, revoked and accepted;
- checkouts, plan changes, connection changes, go-live bookings and billing updates from Stripe (shown as "System").

An entry stores the acting user's ID, the action, the ID of the target and short details such as the names of changed fields or a role. For a change, it stores the field names, not the new values. It never stores a secret, a token or the email address of somebody who has no account. The **Who** column shows the actor's current email address, looked up when you view the log.