Manage your organization in the admin window

Open the admin window and manage members, groups and roles, policies, connections, usage, billing and the audit log of a team plan organization.

The admin window is where the owners, admins and billing managers of a team plan organization manage it: members and invitations, groups and custom roles, policies, connections, usage and billing, and the audit log. It opens at https://cloud.altifigence.com/admin and is separate from Settings, which keeps your personal and app settings.

The roles below describe the default permissions. Each organization can customize admin permissions; the sections and actions you can use follow your effective permissions. See Custom admin permissions.

Section

What it covers

Default access

Overview

Plan, seats in use, the current QUOTA period and to-dos, according to your read permissions. The plan and QUOTA views must be enabled by the service.

Owner, Admin, Billing

Members

Members, invitations, roles and seats

Owner, Admin

Groups

Groups that give custom roles to several members

Owner, Admin

Roles

Custom roles built from the existing permissions

Owner, Admin

Projects

The organization's projects

Owner, Admin

Policies

Rules for Agent, MCP, sharing and project creation

Owner, Admin

Connections

Service accounts, organization API keys, MCP connections, organization Git

Owner, Admin

Usage

QUOTA and usage by member, project and engine, with CSV export. Usage and billing views must be enabled by the service.

Owner, Admin, Billing

Billing

Plan, seats, payment methods, billing details and invoices. Usage and billing views must be enabled by the service.

Owner, Admin, Billing

Audit

Search and export of the audit log

Owner, Admin

Who can open the admin window

The admin window is for team plan organizations (account type Business or Academic). What opens depends on your effective permissions in the organization you are managing. The table shows the defaults before the organization customizes permissions.

Your situation

What you see

Owner or Admin of a team plan organization

Every section: Overview, Members, Groups, Roles, Projects, Security, Policies, Connections, Usage, Billing and Audit. Usage and billing views must be enabled by the service.

Billing

Overview, Usage and Billing, including invoices. Overview shows only the cards your permissions allow. An unavailable section returns you to the first permitted section, normally Overview, with a notice. Usage and billing views must be enabled by the service.

Member

No admin permissions by default. A guidance page lists the organization's administrators so that you can ask for the permissions you need.

Any role in a personal organization

No admin window. A page explains that the admin window is for team plan organizations and links to Settings, where your personal settings stay.

Not a member of the organization, or an address that does not exist

The same "Page not found" page. It never shows the organization's name.

The window shows only what your effective permissions allow, and the account service checks every request again, so changing the address does not give access.

The base roles are:

Role

What it is for

Owner

Owns the organization. Ownership changes only by transfer, so the organization always has an owner.

Admin

Manages members, groups, roles and settings.

Billing

Handles billing and usage.

Member

Works in the projects of the organization.

Custom roles add permissions to a person or a group (see Groups and custom roles). Organization-specific permission settings and custom grants can change which admin sections and actions a member can use. They do not grant access to private project content. The owner role cannot be reduced.

Guidance page that a Member sees, with the list of organization administrators (sample data)Explanation page for a personal organization (sample)Page not found, shown for an address that does not exist or an organization you do not belong toBilling role with Overview, Usage and Billing navigation (example data)

Open the admin window

  1. Sign in to Altifigence Cloud and check the organization you are working in.

  2. Open the account menu (your name in the navigation panel) and choose Organization admin. You can also open Settings and choose Organization admin, which is listed with Projects, Connected devices and Developer access, or go to https://cloud.altifigence.com/admin.

  3. The admin window opens full screen with a menu on the left. The top bar shows the managed organization and your role. Use the organization selector to switch between your team organizations. Choose Back to Cloud to return.

If Cloud is using a different organization from the one you want to manage, the window asks Switch Cloud to this organization? Choose Switch to the organization you want, or keep managing the one Cloud is using. Switching also switches your other open Cloud tabs.

In the desktop app, Organization admin opens the admin window in your browser. Sign in there if you are asked.

The organization IAM pages have moved to the admin window. In Cloud, old Overview, Members, Groups and Roles addresses redirect to the matching admin section for the selected team organization. Old organization Agent-policy addresses lead to Policies. Where a moved-page notice is shown, it says Organization administration has moved and offers Open the admin window. Personal organizations have no admin window.

Projects, Connected devices and Developer access remain in Settings. In Cloud, an old /console/projects or /console/manage/projects address moves to Organization admin → Projects after the project administration read succeeds for the selected Business or Academic organization; its query and fragment are preserved. While that read is pending or fails, the existing console page stays open. Old organization policy addresses move to Policies; without a team organization they open /admin for guidance. The desktop app does not automatically redirect these addresses. Credit wallets and purchases remain in console Billing; its old addresses do not automatically redirect. Plan and time-pack checkout opens on www.altifigence.com in a new window or tab. Use Usage and Billing in the admin window for organization reports and billing.

The Organization admin entry is shown for every role in a Business or Academic organization. Members without admin permissions see the guidance page; the entry does not give them administration permissions.

Changes need a recent sign-in

Every change allowed by your permissions in the admin window needs a sign-in from the last 10 minutes. If your last sign-in is older, the window sends you to the sign-in page and brings you back to the page you were on. Depending on the page, your change is then continued once automatically or you are asked to make it again. Check the page before you repeat a change.

Changes to members, groups, roles and security ask for a reason of up to 1,000 characters, which is recorded with the change. The Audit page does not show reasons. Policies and connections ask for a reason too, but it is not recorded. Do not put passwords, keys or other credentials in any reason.

If you see "Too many requests", wait a few minutes and try again.

Overview

What it does. Overview shows the organization's plan, how many seats are in use, the current QUOTA period (the share remaining and the reset date) and to-dos: pending invitations and billing problems, such as an expired saved payment method or a team contract that is not active. A security warnings row is shown but is not available yet. The plan and QUOTA views must be enabled by the service.

Who can use it. Owner, Admin and Billing by default. Only cards allowed by your read permissions appear.

Steps.

  1. Open the admin window. Overview is the first page.

  2. Choose Review next to pending invitations to open the Invitations page.

  3. Choose Open billing to go to Billing when a billing problem is shown.

Overview with plan, seats, QUOTA period and to-dos (sample data)

Members and invitations

What it does. Members lists the people in the organization with their role and status. From here you invite people, change roles, suspend or remove members, restore a member, transfer ownership and give custom roles. The Paid seats card shows the contract and Standard/Premium usage when configured.

Who can use it. Owner and Admin by default. Only the owner can transfer ownership.

Members with Paid seats, tier counts, seat types and Change seat actions (example data)

Invite a member

  1. Open Members and choose Invite member.

  2. Enter the person’s email address and choose Member, Admin or Billing. Choose Paid or Free (view-only); for a paid invitation, choose Standard or Premium. Scroll down to enter a reason.

  3. Choose Send invitation.

New invitations default to a paid seat. The person receives an email and accepts the invitation on the account site. An invitation expires 7 days after it is sent. The period is fixed and cannot be changed.

Email, role and seat-type choices in Invite a member; cropped before the tier and reason fields (example data)

Follow, resend or cancel invitations

  1. Open Members and choose Invitations.

  2. Read the status of each invitation: Pending, Waiting for a seat, Accepted, Cancelled or Expired. A row also shows whether the email was sent and when the invitation expires.

  3. Choose Resend to send a new email and start a new 7-day period. The earlier link stops working. Wait a minute between sends. At most 5 invitation emails are sent to one address in a day.

  4. Choose Cancel invitation to stop an invitation from being accepted. For a cancelled or expired invitation, choose Send again.

A paid invitation marked Waiting for a seat was accepted while every paid seat was in use. It waits until paid-seat capacity is available (see Seats).

Invitations with their status and the Resend and Cancel invitation actions (sample data)

Change a role, suspend or remove a member

  1. Open Members and find the person. The member list searches the members loaded so far; choose Load more to include the rest.

  2. Choose Change role to set Admin, Member or Billing. The Owner role is set only by transferring ownership, and nobody can change their own role.

  3. Choose Suspend to take access away. The member loses access and the work they were running in this organization stops. If stopping that work takes a moment, a notice says so and it is retried automatically.

  4. Choose Remove to remove the person from the organization.

  5. Enter a reason and confirm.

The owner cannot be suspended or removed. To change the owner, transfer ownership first.

Restore a member by invitation

Access is not restored directly. A suspended or removed member comes back only by accepting a new invitation.

  1. Open Members and find the suspended or removed member.

  2. Choose Restore.

  3. Choose the role and seat type for the new invitation, and a tier if paid. Scroll down, enter a reason and choose Send invitation.

  4. The person receives an invitation by email and must accept it on the account site before regaining access. Like every invitation, it expires 7 days after it is sent.

Restore by invitation, with the recipient, role and seat-type choices; cropped before the tier and reason fields (example data)

Transfer ownership

Only the owner can do this.

  1. Open Members and choose Transfer ownership next to an active member whose email is verified.

  2. Confirm that you understand that you will no longer be the owner, and enter a reason.

  3. Choose Transfer ownership. The member becomes the owner and you become an Admin.

Seats

The Paid seats card on Members shows contracted capacity and, when available, the seat period and contract state. It also shows Standard and Premium usage against each tier's limit. Use those tier counts and the remaining seats shown in Change seat to check paid-seat availability. Changing a member's seat type or tier is separate from changing contracted capacity.

When every paid seat is in use, a paid invitation accepted now waits for available paid-seat capacity. Switching an active paid member to Free (view-only), suspending them or removing them frees a paid seat. The over-limit notice asks you to switch members to free or ask the organization owner to change paid capacity. Contracted capacity is not changed in the admin window.

The card also warns about the overall seat limit, a missing seat record, or a contract that was revoked, has ended or has not started yet. If tier limits are not configured, it says Seat tiers are not set up for this organization. Contact sales. There is no contact link or form on this card. The numbers in the screenshots are sample data.

Paid seats over-limit notice, tier counts and member seat actions (example data)

Seat types

  • New invitees get a paid seat by default. Existing members stay paid.

  • Changing a seat requires both View members and Manage member seats permissions. Owners and admins hold them by default; they can be customized per organization.

  • Only paid seats count against paid-seat capacity.

To change your own or another member's seat, open Members (/admin/<organization>/members) and choose Change seat in their Seat column. Select Paid or Free (view-only). For Paid, choose Standard or Premium under Paid seat tier; a full tier is unavailable for a new assignment. Review the effect, enter Reason and choose Save seat. A recent sign-in is required, and the reason is recorded in the change history. The organization role stays the same.

Selecting Paid explains that an active member uses one paid seat, subject to available capacity, and keeps their organization role.

If the dialog says No seat is available., or reports no seat in the selected tier, close it, refresh Members and open Change seat again after capacity becomes available. A rejected change cannot be resubmitted from that dialog. In the new dialog, choose an available tier or contact your organization admin.

Audit capacity uses every active member, including free members; see Audit retention and capacity.

Custom admin permissions

Each organization can customize fine-grained admin permissions for its base roles and grant permissions through custom roles to people or groups.

Permission

Default holders

Every admin permission

Owner and Admin

Billing and usage permissions

Owner, Admin and Billing

MCP unblock and member seat changes

Owner and Admin

Admin permissions for Member

None

The owner role cannot be reduced, and at least one owner always keeps permission management. A person managing permissions can grant only permissions they hold. Admin permissions do not grant project content access.

  1. Open Roles and find Base permissions (/admin/{organization-id}/roles). You need the permission Manage base permissions.

  2. Select or clear permissions for Admin, Billing and Member. Owner is fixed. Custom-role grants continue to apply even if you clear the corresponding base-role permission.

  3. Choose Save changes, review the changes, enter a reason and choose Save permissions. Save at most 100 changes together; refresh the mappings before preparing another batch.

  4. If access or the organization changed, choose Refresh mappings and discard draft, review the current mappings and start again.

Navigation follows effective permissions. A custom grant can open its matching section, but entering a section does not grant permission to read its data or perform every action. An unavailable section leads to the first section you can use; without any admin permissions, you see the guidance page. Permission editing must be enabled by the service before changes can be saved.

Groups and custom roles

What it does. A custom role combines existing organization permissions. A group gives custom roles to several members at once. You can only include permissions that you hold yourself.

Who can use it. Owner and Admin by default.

Permissions cover members and invitations, groups and roles, permission management, seat changes, security, policies, connections (including MCP unblock), project administration, usage and billing, and audit access and settings. Select the permissions needed for the work. The defaults and owner protections are described under Custom admin permissions.

Create a custom role.

  1. Open Roles and choose New role.

  2. Enter a role name and a description, and select the permissions.

  3. Enter a reason and choose Create role.

Use Edit to change a role. Remove deletes the role and also takes it away from every member and group that has it.

Custom roles list with readable permission names and New role, Edit and Remove actions; cropped to the list (example data)

Give a custom role to a member. Open Members, choose Custom roles for the person, select the roles and choose Save roles. You can assign only roles whose permissions you hold.

Create a group.

  1. Open Groups and choose New group.

  2. Enter a group name, select the active members to add and select the custom roles the group gives.

  3. Enter a reason and choose Create group.

Use Edit to change a group. Remove deletes the group: its members lose the permissions the group gave them, and the members themselves are not removed. Changing a group that has custom roles needs the permission to assign custom roles.

Groups (sample data)

Projects

What it does. Projects lists the organization's projects and manages project ownership, archiving, and direct member and group access when project administration is enabled. Project administration must be enabled by the service.

Who can use it. Owner and Admin by default. Project read, member management, group management, ownership transfer and archiving have separate customizable permissions. Reading the inventory does not grant access to private project content.

  1. Open Projects (/admin/{organization-id}/projects). Use Search projects to search by name or slug and All, Active or Archived to filter. Choose Load more for more results.

  2. Choose Manage access on a project to open its administration page (/admin/{organization-id}/projects/{project-id}).

  3. Under Members, use Add member to give an active organization member a project role; use Change role or Remove on an existing row. Billing managers cannot be added. Under Groups, use Add group and select Editor or Viewer. A group cannot own a project. Removing a direct grant leaves any group access in place; removing a group grant leaves other grants in place.

  4. Choose Transfer ownership. If the project has several owners, select Owner who hands it over; a sole owner is selected automatically, and an unowned project has no source owner. Select New owner, enter a reason and confirm. The former owner stays as an editor. Only the organization owner can transfer a project owned by the organization owner.

  5. Choose Archive project and confirm with a reason. An archived project remains readable in Cloud; content writes stop, while access management remains available. Unarchive project restores editing for people with an editing role.

Actions appear according to your permissions. Adding people or groups and choosing a new owner also needs permission to read the relevant member or group list. Changes need a recent sign-in and a reason. After signing in again, repeat the project change; it is not replayed automatically. If a project changed while you were working, close the form and start again from the refreshed page.

If project administration is disabled or its route is not yet offered, the page falls back to the projects you belong to, explains the unavailable actions and offers Open project settings. Other service errors are shown as errors. This fallback does not prove that the full administration service is enabled in production. In Cloud, old Settings Projects addresses move to this organization-wide administration page only after its project read succeeds; if the read is pending or fails, the console page remains available.

Projects with search, status filters and Manage access (example data)

Organization access

Account supports internal sign-in and organization administration.

Single sign-on and provisioning support

Capability

Status

Internal Account SSO

Supported

Organization selection at sign-in

Supported

User invitations and lifecycle

Supported

Group and role administration

Supported

Policies

What it does. Policies set the boundaries for everyone in the organization: Agent access, MCP tools, sharing and who can create projects. Organization restrictions take precedence over personal and project preferences, and the server enforces them, not only the screen. Personal Agent defaults stay in Settings. The organization restrictions that used to be under Settings, AI have moved here.

Who can use it. Owner and Admin by default, according to the organization's policy read and update permissions.

Steps.

  1. Open Policies.

  2. Under Agent access:

    • Allow personal API keys (BYOK) lets members use their own connected keys within the existing restrictions.

    • Allow web search lets members choose to search. They still give any consent that is required.

    • Agent permission ceiling sets the highest permission a member may choose: Ask, Allow or Auto.

  3. Under MCP tools:

    • Enable MCP turns MCP on for the organization. Tools must also be enabled in the connection policy and granted to the organization.

    • Restrict to selected tools limits MCP to the tools you select under Allowed tools. With nothing selected, all MCP tools are denied.

    • Denied tools always win over allowed tools.

  4. Under Sharing and projects:

    • Allow external sharing further restricts project sharing where it is supported. It does not enable project link sharing for Business or Academic organizations. Project sharing links can currently be created only for projects owned by personal organizations.

    • Restrict project creation limits creation to the roles you select under Roles allowed to create projects. The list applies to every role, including owners and admins. An empty list denies creation for everyone.

  5. Open Advanced Agent restrictions for web-search domain rules and search limits, the permissions and effort levels members may use, the output and instruction limits, the project context Agent may read and the history retention period. Existing restrictions stay in place and only the controls you change are saved.

  6. Enter a reason (required, up to 1,000 characters) and choose Save policies.

Agent automatic writes are off by default. An authorized policy administrator (Owner and Admin by default) can enable them under Agent access → Agent permission ceiling by selecting Auto. This allows automatic writes within existing project, tool and write permissions. Advanced Agent restrictions → Allowed Agent permissions can also edit the allowed permission set; it must include Auto to opt in. Changing another policy does not enable automatic writes.

The page shows the policy version and the organization revision. If either changed while you were editing, reload the current policies, review your changes and save again. Company-provided AI appears only as Agent; the policies never show model names.

Organization policies with Agent access and view-only comments controls (example data)

Connections

What it does. Connections manages service accounts, organization API keys, the MCP connections your members created, and the organization's Git connection.

Who can use it. Owner and Admin by default. The organization can customize separate read and management permissions for service accounts, API keys, MCP and Git.

Open Connections and choose a tab: Service accounts, API keys, MCP or Organization Git. The service account, API key and MCP lists show when each item was created and last used. Every change needs a reason and a recent sign-in.

A key is shown once. When you create or rotate one, the page shows Save your new key. Copy it and store it securely. It cannot be read again, and it is never shown in lists or stored in logs. If you lose it, rotate the key to get a new one.

Service accounts

  1. Choose Create service account, enter a name and a reason, and confirm. The scope is organization read access only.

  2. Copy the key when it is shown, then choose Done.

  3. Use Rotate to replace the keys of the service account. All previous keys stop working immediately.

  4. Use Revoke to stop the service account. Its keys are revoked with it.

Connections, Service accounts tab (sample data)

Organization API keys

  1. Open API keys and choose Create API key. Enter a name and a reason, and confirm.

  2. Copy the key when it is shown, then choose Done.

  3. Use Rotate to replace one key. The previous key stops working immediately. Use Revoke to stop a key.

A key grants organization read access only. It does not grant browser or admin access. To use a key, send GET /v1/organization-api/organization with Authorization: Bearer <organization API key> to the configured organization API endpoint. Do not send cookies, an Origin header, query parameters or a request body.

MCP connections

The MCP tab lists the connections that members of the organization made with Altifigence MCP, with the member, the client, the scopes, and when each was created, expires and was last used. Organization policies stay in effect.

To end a connection, choose Revoke next to it and confirm. This revokes all MCP access of that member in this organization, including access already issued, and it does not affect other members or other organizations. A revoked member stays blocked from MCP in this organization until an authorized administrator explicitly unblocks them. MCP unblock defaults to owners and admins and is customizable per organization. Signing in again, reconnecting, or turning Enable MCP back on does not clear this member-specific block.

  1. Open Connections → MCP (/admin/{organization-id}/connections).

  2. Choose Unblock MCP access. Enter the member's user UUID under Member user ID and enter Reason for change.

  3. Choose Confirm. The member must give new OAuth consent. Old connections, access tokens, refresh tokens and unfinished consent remain unusable; organization policy denies and tool permissions still apply.

The action needs Unblock MCP connections permission. If the page says the unblock API is unavailable, it must be enabled before this action can be used.

Older connections whose organization cannot be verified are not listed, because they cannot be assigned to the organization safely. Those members must connect again, and connecting again does not remove their older connections. If the list says the inventory is incomplete, go to the next page before you treat it as complete.

Organization Git

Organization Git connects a GitHub App installation that belongs to your organization. Personal Git connections are managed separately.

  1. Open Organization Git and choose Connect GitHub.

  2. Enter the GitHub App installation ID of the installation assigned to your organization, enter a reason and confirm.

  3. To disconnect, choose Revoke. This stops the next organization Git authorization. GitHub tokens that were already issued can stay valid until they expire.

MCP and Organization Git require configuration for your organization. If either is unavailable, its tab explains that. A GitHub App installation must be assigned to your organization before you can connect it.

Connections, Organization Git tab with the assigned GitHub App installation (example data)

Usage and billing

What it does. Usage shows the organization's QUOTA and its usage by member, project and engine, and exports it as CSV. Billing shows the plan, seats, payment methods, billing details and invoices of the team organization. Usage and billing views must be enabled by the service.

Who can use it. Owner, Admin and Billing by default. Usage and billing permissions are customizable per organization; Billing has only those admin permissions by default. Your own personal subscription is not managed here: it stays on the account site, and Billing has an Open account site link for it.

Usage

  1. Open Usage. The QUOTA card shows the share of QUOTA remaining, used and reserved in the current period and when it renews or resets. QUOTA is shown as shares of the period, not as amounts.

  2. Under Usage by member, project or engine, choose Member, Project or Engine in Group usage by. Engine rows show Agent, Project runtime, the name of the engine that ran a job, Engine job or Other.

  3. Choose the From (UTC) and To (UTC) dates and choose Show. Choose a report range of up to 92 UTC calendar days, counting both the From and To dates. The To date must be today (UTC) or earlier.

  4. Read the rows: Uses, Charged credits and Last used. Charged (USD) and Native qualification columns appear when the range has such charges; the report then shows each row as a labelled block on screens up to about 1040 pixels wide. A total closes the report. Member rows show names to people who can read members, "You" on your own row and a short key to everyone else.

  5. With usage-export permission, choose Export CSV to download the report. The file lists members by a pseudonymous key, not by name or email address (the Member report says so under the button).

When you can read the report, the CSV button appears only with usage-export permission, a valid range, detailed usage available and at least one row. If you have export permission without report-read permission, Export CSV is available for a valid range without displaying the report; the service still checks access and whether detailed usage is available. Usage CSV contains consumption summaries, rather than audit events. This download does not create the audit-history export receipt described under Audit log.

Usage by member with the QUOTA card (sample data)Usage by engine (sample data)

Billing

  1. Open Billing. The Plan and payment tab shows the plan, its status, when the current period ends and any scheduled change.

  2. Read the seat contract summary. Team plans and paid-seat capacity follow your contract. Check Standard/Premium usage on Members for each tier's availability. A member's seat type and tier are managed separately under Seats.

  3. The page shows Plan, Seats, Payment methods, Billing details and Personal subscription in that order, according to your permissions. Under Billing details, choose Edit beside Billing contact, Address or Business, change that section and choose Save. Each section is saved separately. Changes apply to future billing; existing invoices keep their original details. The page also shows the next payment when available.

Payment methods

  1. Under Payment methods, read the saved methods and their expiry.

  2. Choose Add or change payment method, then Continue to the payment provider. The payment provider opens in a new tab and the link works for a short time.

  3. To remove a saved method, choose Delete and confirm. A method that a subscription uses must be replaced first.

Invoices

  1. Open the Invoices tab.

  2. Read the date, invoice number, amount and status of each invoice. Choose Load more for older ones.

  3. Choose Get PDF, then Open PDF. If a PDF is not ready, the page says so.

Changing a payment method, deleting one or editing billing details needs a sign-in from the last 10 minutes. If the page shows Sign in again, choose it and then make the change again. Billing does not keep what you entered.

Read, export and change permissions are separate. With change permission but no read permission, the page can let you replace a billing section without showing saved details, or delete a saved payment method by its ID. Follow the page's permission and refresh guidance before making a change.

Billing plan, payment methods and billing controls with no concrete price or tax ID (example data)Invoices with dates, status and Get PDF controls; amounts are not shown (example data)

Audit log

What it does. The audit log shows management activity and security events of the organization. You can search and filter it and export it as CSV or JSON. It never shows email addresses, IP addresses, request contents or the reasons people entered.

Who can use it. Owner and Admin by default. Audit read/export and audit settings have separate permissions that the organization can customize.

The audit log includes member, invitation, group, role and permission changes; project access, ownership and archive changes; organization policy and connection activity; recorded API-key use; audit settings changes; and audit-history reads and exports. Security policy changes, domain changes and Sign out all members also appear, alongside recorded organization security entry denials. Billing details changes, payment-method removal and billing-portal requests record an authorization intent before the provider operation and a separate final result when it is settled. An intent is not evidence that the provider operation succeeded. Only events explicitly associated with the organization appear; unrelated historical sign-in activity is not assigned from current membership.

Audit retention and capacity

The audit retention policy keeps records for 5 years after the contract ends. Automatic retention deletion is currently off, so the retention setting neither deletes nor hides records. The retention setting (default: 12 months) applies only when automatic retention deletion is turned on.

Open Audit → Audit retention and capacity (/admin/{organization-id}/audit; capacity: #capacity). Audit settings read permission is required to see settings and usage. Changing settings also requires audit settings manage permission; manage permission alone does not grant read access. Audit event read permission is separate.

The Organization retention (months) setting accepts 1–1,200 whole months. Capacity per member (GB) defaults to 1 GB for every active member, including free and paid members; 1 GB is 1,000,000,000 bytes. This count is separate from paid-seat capacity. Organization capacity override (GB; leave empty to use members) replaces the member-based total. Removing a member can reduce capacity below stored usage and does not delete existing records.

To change these settings, enter a Reason for change, choose Save settings, review the old and new values, then confirm. Shortening the retention period is not available yet; you can keep or increase it. Saving requires a sign-in within the last 10 minutes. Saving a retention setting does not itself delete records or free space; automatic deletion remains off.

Stored usage shows estimated stored GB against capacity and the percentage used. Reserved capacity (separate from stored usage) and Incident response headroom (inside the total capacity) are shown separately. Recent growth per day (gross appends) averages observed days among the last seven completed UTC days; it excludes today and does not subtract deletions. Fewer than seven observed days is marked low confidence. Forecast full date (UTC) is shown only when the data is complete, current and reliable. When that reliable forecast reaches seven days or less, this page can show At the current rate, full in about {days} days. and Go to capacity settings, even while automatic notices are off. Unknown usage is not zero; backfilling, stale usage and unavailable archived history have separate messages. Use Reload settings and usage to check again. An Unknown value has no reliable current result: it may not have been computed yet, or an earlier result may be stale; it does not mean zero.

Capacity enforcement and automatic forecast notices are currently off. If stored usage reaches capacity, the page explains that enforcement is off; reaching the displayed total does not mean that recording has stopped or admin changes are being refused. Automatic archiving is also off. Exporting downloads a copy; it does not delete records or free capacity.

Automatic retention deletion is off in the release build. While it is off, the retention setting neither deletes nor hides records.

Search the audit log

  1. Open Audit.

  2. Enter a search term. The search is literal and covers the raw action code, the actor ID and the target ID. It does not search email addresses or event details.

  3. Narrow the results with From (inclusive) and To (exclusive) in UTC, Action (exact match), Actor user UUID and Target ID (exact match). For Action, choose a readable event name or enter an exact action code (letters, numbers and _ . : -). Event identifiers on an event shows its raw code. Choose Apply filters, or Reset to start again.

  4. Read each event. Its heading is the action in plain words, for example MCP access revoked or Member updated, with the outcome (Success, Failure or Blocked). Below it are when it occurred (UTC), the actor, the target (its kind and ID), the source and, for some events, details such as the provider or the number of items. Choose Event identifiers to see the raw action, the raw target kind and the raw source. An event the window does not recognize is shown as Unrecognized event. Use Previous page and Next page to move.

Pages come from a fixed snapshot, shown as Snapshot (UTC). If the snapshot or cursor expires, apply the filters again to start a new query.

Export the audit log

  1. Apply the filters you want.

  2. Choose Download CSV page or Download JSON page.

  3. If more records are available, choose Export next page for the next page. An export never downloads the whole history by itself.

Each page holds up to 1,000 rows and 2 MiB of UTF-8 content. If a page is too large, narrow the date range or the filters. Every page needs a sign-in from the last 10 minutes. Each download records a receipt. Capacity enforcement is currently off; exporting does not free audit capacity. In the CSV file, every cell is quoted, and a cell that starts with =, +, - or @ gets a leading apostrophe. The columns are id, organizationId, occurredAt, actorUserId, action, targetType, targetId, outcome and details.

Retention and capacity are described under Audit retention and capacity. Exporting does not free space.

Audit log with retention and capacity settings, search, readable events, Event identifiers and export (example data)

Common messages

Message

What to do

Sign in again to make this change.

Sign in again, then check the page and make the change if it was not applied.

This is not the organization selected for your session.

Switch Cloud to the organization, then try again.

The organization changed while you were working, and the list was reloaded.

Close the window and make the change again from the refreshed list.

The owner cannot be changed, suspended or removed here.

Transfer ownership first.

A suspended or removed member cannot be reactivated directly.

Send a new invitation. The member must accept it.

Ownership can only go to an active member with a verified email.

Choose another member, or ask the member to verify the email address.

Invitations are only available in an active team organization.

Check that you are managing a team plan organization.

Too many requests.

Wait a few minutes and try again.

Account security · Accounts, Licences, and Billing · MCP authentication · Agent · Plans and pricing

Team plan prices and seats follow your contract. This guide does not state prices.