Teams, Organizations & Roles
OrcFlows is multi-tenant from the ground up. Every workflow, secret, connector connection, knowledge base, and execution belongs to exactly one tenant (workspace). On top of tenants, an optional organization layer groups multiple tenants for enterprise customers.
Tenants (workspaces)
A tenant is the basic unit of isolation — a tenant_slug (e.g. acme) identifies it for login. Each tenant has:
- Its own users, workflows, executions, secrets, connectors, knowledge bases.
- A plan (
free,pro,enterprise) — see Billing & Plans. - Optionally, an
organization_idlinking it into an organization.
GET /api/v1/tenant returns the current tenant's info (slug, name, plan).
User roles
Each user has exactly one role within their tenant:
| Role | Permissions |
|---|---|
owner | Everything, including billing, SSO config, deleting workflows, removing members, changing roles. |
admin | Manage workflows, secrets, team invites, audit log — everything except billing/SSO/ownership transfer and removing members. |
member | Create/edit workflows, run executions, use connectors and knowledge bases. |
viewer | Read-only access to workflows and executions. |
Role checks are enforced via middleware, e.g. auth.RequireRole(auth.RoleAdmin, auth.RoleOwner) on sensitive routes (deleting workflows, managing secrets, viewing the audit log).
Team management
| Endpoint | Role required | Description |
|---|---|---|
GET /api/v1/team/members | admin/owner | List all members of the tenant. |
POST /api/v1/team/invite | admin/owner | Invite a new member by email with a role. |
PUT /api/v1/team/members/{id}/role | owner | Change a member's role. |
DELETE /api/v1/team/members/{id} | owner | Remove a member. |
Organizations (Enterprise)
Organizations are an optional grouping layer above tenants for enterprise customers running multiple workspaces (e.g. separate tenants per business unit or client) under one billing/admin umbrella. They don't change the 1-tenant-per-workspace model — a tenant simply gains a nullable organization_id.
| Endpoint | Description |
|---|---|
POST /api/v1/organizations | Create an organization. If the creator's current tenant has no organization yet, it's automatically assigned as the first member. |
GET /api/v1/organizations | List organizations owned by the current user. |
GET /api/v1/organizations/{id} | Get an organization with its grouped tenants (owner-only). |
POST /api/v1/organizations/{id}/tenants/{tenantId} | Assign another tenant to the organization (org-owner-only). |
Organizations are gated by the organizations_enabled plan limit (Enterprise only — see Billing & Plans).
SSO
Enterprise tenants can configure SAML/OIDC single sign-on:
| Endpoint | Description |
|---|---|
GET /api/v1/auth/sso/check | Check if SSO is configured for a tenant slug (public, used on the login screen). |
GET /api/v1/auth/sso/authorize / .../callback | SSO login flow (public — browser redirects). |
GET / PUT / DELETE /api/v1/sso/config | Manage the tenant's IdP configuration (owner-only, gated by sso_enabled). |
See Configuration for the redirect URL setup.
Audit log
GET /api/v1/audit (admin/owner only) returns a chronological log of sensitive actions: workflow changes, secret creation/deletion, role changes, signals sent, organization changes, etc. — recorded automatically by internal/audit.