Team

This page explains how organisations, roles and invitations work in the punchout.dev portal, and what the audit log records.

Organisations

An organisation holds shops, a team and a plan. Signing up creates one, named after the company you enter, with you as its owner. One account can belong to several organisations.

• Switch organisation in the top left of the portal changes the organisation you are working in. The portal remembers your choice across reloads.
• New organisation … in the same menu creates another organisation with its own shops, team and plan. You become its owner, the portal switches to it, and it starts on the Sandbox plan.
• Settings → Organisation shows the name, the Organisation ID, your role and the plan. Owners and admins can change the name and the Billing email.

Roles

	Viewer	Admin	Owner
See shops, buyers, usage, members, billing and the audit log	Yes	Yes	Yes
Create, change and delete shops	No	Yes	Yes
Create, rotate, disable and delete buyer credentials	No	Yes	Yes
Create setup links, start test punchouts	No	Yes	Yes
Claim a shop from an instant tag	No	Yes	Yes
Rename the organisation, change the billing email	No	Yes	Yes
Invite admins and viewers, change their roles, remove them	No	Yes	Yes
Invite, promote, demote or remove owners	No	No	Yes
Buy a plan, switch plans, book connections, open billing	No	No	Yes
Delete the organisation	No	No	Yes

A viewer sees a “Read-only access” note on pages they cannot change. Plan notices by email (transfer allowance, Sandbox end, refused launches) go to every owner.

Invite someone

1. Open Settings → Members and click Invite member.
2. Enter the email address and choose the role. Only an owner can invite an owner.
3. Click Send invitation. The link in the email is valid for seven days and works once.

Invitations on the same page lists pending invitations with their expiry, and Revoke withdraws one. A second invitation to the same address replaces the first. The portal refuses an address that already belongs to the organisation, and one whose email bounced or was reported as spam. In the second case, check the address with the person and contact support to release it.

Accept an invitation

The link opens the portal’s invitation page, which names the organisation, the invited address and the role.

Situation	What to do
No account for the invited address	Choose a password and click Create account and join. The account is confirmed at once, because the link proved the mailbox
An account exists	Sign in and join with that account’s password
Already signed in as the invited account	Join
Signed in as a different account	Enter the password of the invited account and click Sign in and join

After joining, the portal signs you in to the new organisation. An account that had never confirmed its address counts as confirmed after accepting.

Change roles and remove members

On Settings → Members, change a role in the member’s row, or remove the member. A removed member loses access at once. Owners and admins can leave an organisation by removing themselves the same way. A viewer cannot remove themselves, so an owner or admin does it for them. Coming back takes a new invitation.

The last owner can neither be demoted nor removed, and cannot leave. The portal marks that member as “last owner”. To hand an organisation over, make someone else an owner first.

Delete an organisation

Only owners can use Settings → Organisation → Delete organisation.

• You confirm by typing the organisation’s name.
• Deleting is refused while a subscription is running. Cancel it first in Manage billing under Settings → Billing. A canceled subscription runs until the end of its period, so deleting works after that date.
• It deletes the organisation’s shops with their buyer credentials, sessions, setup links and test punchout results, and all memberships.
• The members’ accounts stay. Members who were working in the deleted organisation continue in their next one.
• The audit log entries are not deleted with the organisation. They include an entry for the deletion itself.

Deleting cannot be undone.

The audit log

Settings → Audit log lists what happened in the organisation, newest first, with When, Who, Action, Target and Details. Load more pages back. Every member can read it, viewers included.

It records, among others:

• sign-ins, sign-outs and password changes of members;
• shops created, changed, deleted and claimed;
• buyer credentials created, changed, rotated and deleted;
• setup links created and revoked, test punchouts started;
• organisation changes, role changes, removals, invitations sent, revoked and accepted;
• checkouts, plan changes, connection changes, go-live bookings and billing updates from Stripe (shown as “System”).

An entry stores the acting user’s ID, the action, the ID of the target and short details such as the names of changed fields or a role. For a change, it stores the field names, not the new values. It never stores a secret, a token or the email address of somebody who has no account. The Who column shows the actor’s current email address, looked up when you view the log.