Share a workspace, not a password.
Group your forms and mailboxes into an organization, invite teammates by email, and give each one exactly the access they need — from full admin down to read-only.
Organizations
An organization owns content — forms, agent mailboxes, projects, submissions. Every member of an org can reach that org's content (subject to their role); nothing is shared by copying a token around. Manage your orgs at Dashboard → Organizations.
Roles
| role | can |
|---|---|
| owner | Everything, plus org settings, billing, transfer/delete. One per org. |
| admin | Manage the team (invite / change role / remove) and edit org settings. Can't delete the org. |
| member | Full read + write on the org's content (forms, mailboxes, submissions, rules, projects). No team or settings management. |
| viewer | Read-only. See everything; change nothing. |
Invite teammates
On the Team panel (admin+), enter an email and a role. We email an accept link; the invite also shows in the pending list. The invitee must sign in with that email to accept.
$ curl -X POST https://login.ollastack.com/api/orgs/<orgId>/members \ -H "Cookie: ollastack_session=…" -H "Content-Type: application/json" \ -d '{ "email": "teammate@acme.com", "role": "member" }'
Roles you can invite: viewer, member, admin.
The viewer role
A viewer is read-only across the whole workspace — perfect for a client, a stakeholder, or an on-call responder who should see leads and mail but never change anything. They can open every form, submission, and mailbox, but:
- Write controls are hidden or disabled in the UI, with a "view-only access" banner.
- The API rejects every mutation (create / edit / delete / send / clear) with a not-found or forbidden response — enforced server-side, not just in the UI.
- They can't create content, manage the team, or touch org settings.
Promote a viewer to member any time to unlock writes.
Transfer ownership
The owner can hand the org to another member (owner-only). The new owner takes over; the previous owner stays on as an admin so they keep access.
$ curl -X POST https://login.ollastack.com/api/orgs/<orgId>/transfer-ownership \ -H "Cookie: ollastack_session=…" -H "Content-Type: application/json" \ -d '{ "userId": "<newOwnerUserId>" }'