Memberships and invitations

A membership moves from active to suspended, blocked or removed, and a suspended or blocked one can become active again or be removed. A removed one can be reinstated by an administrator as the same membership. Blocking applies only while the sso_enforcement flag is on, and it defaults OFF. You see the status next to each organization on the Memberships page. See Organizations in your account.

Removing a membership also takes away the role assignments you held in that organization, for good: reinstating the membership does not give them back, and your sessions in it stay ended. The removal is carried out as a follow-up step, so it can finish a moment after the status changes.

A membership is an owner, a member or a guest. A guest is invited by a sponsor, who must be an active member who is not a guest, and the membership expires on its own after a set time. An expired guest membership stops giving access when it expires, not when a cleanup job next runs. An organization can forbid guests, and by default it allows them. A guest never receives more than their sponsor could grant, never a high-risk permission, and never authority they can pass on, and it ends no later than the guest membership.

There are two.

1. An invitation. An administrator of an organization invites an email address, optionally with a role. You can accept it from the link in the email, or, when the address is a verified address of your account, from Invitations to join on the Memberships page, where you can also decline it.
2. Signing up on your own. Where sign-up is open, a new account is created without joining any organization. Its own personal workspace is made when an app first needs one, described in The personal workspace. Sign-up is not open everywhere, so you may not see it. The account gets its default username once the email address is verified.

A person can also ask to leave. See below.

An invitation is a link sent to the invited email address.

• It is valid for 7 days unless the platform operator has changed the lifetime; the lifetime in force when it is sent applies.
• A personal workspace takes no invitations, and an organization can send only a limited number a day (100 by default; the platform operator can change it).
• It can be used once. After it is accepted, or after it is revoked or has expired, the link no longer works.
• Opening the link changes nothing by itself. Only the button on the page accepts it. This means an email scanner that fetches the link cannot accept it for you.

The page is titled Join an organization and says You were invited to an organization. It shows the organization, the role if there is one, and for a guest invitation the terms, so you know what you are accepting before you select anything. An invitation that ran out says This invitation has expired. Ask for a new one. and one already used, revoked or declined says This invitation was already used.

Before you act, the page shows Organization: with its name, Role: if the invitation carries one, and, for a guest invitation, You join as a guest, sponsored by the sponsor for a number of days from the day you accept. It also says what you must do next: Choose a password to create your account and join., Sign in to the account this invitation is for, then accept. or You are signed in as the invited account. Accept to join.

If the link is for an address with no account yet, accepting it creates an account, so it is refused when sign-up is closed, when the address's domain is not allowed or when the day's limit of new accounts is spent. The page then shows the same message as for any invalid link.

If the account the page is showing is not yours, select Sign in with another account. If the link is not valid any more, the page says This invitation is not valid any more. Ask for a new one. An invitation that ran out or was already used has its own message (above); this one covers a link that is incomplete or was never valid.

Roles in an invitation#

An invitation can carry a role. When the invitation is accepted, the membership is created and the role is assigned to you in that organization. A role is assigned on the inviter's authority, and nobody can hand out more than they hold. If the role cannot be assigned, you still join, without it. See Permissions and roles.

If an invitation carries no role, you join with a membership and no extra permissions, and an administrator can assign roles later.

Invitations in your account#

An invitation sent to a verified address of your account also appears on the Memberships page under Invitations to join, with its role, when it expires and, for a guest, the sponsor and the number of days. Select Accept to join, or Decline and then Decline invitation to refuse it. A declined invitation stops working, and an administrator has to invite you again. Accepting from this list never creates an account. A session that came in through the lost-passkey emailed code cannot accept or decline here until you confirm with a second factor. See Authentication methods.

You can leave from the Memberships page. Select Leave on the organization's row, read the dialog Leave this organization?, and select Leave organization. You lose access to it, and an administrator has to invite you again for you to rejoin.

Three refusals exist, and the page offers no Leave button for any of them. Your personal organization cannot be left, and the page says This is your personal organization. The last platform administrator of the internal organization cannot leave it, and the page says You are the last administrator. An account that an organization manages cannot leave the organization that manages it, and the row is headed Managed by this organization.

An application cannot assume your membership still holds just because a token was issued earlier.

• At sign-in, an organization the application preselects must have you as an active member, or the request is refused with access_denied.
• When an application asks identity whether you may do something, a person who is not an active member is always denied. See Authorization.

• Organizations
• Principals and accounts