Skip to main content
Every resource in Autousers — Evaluation, Autouser, Template, ApiKey, WebhookEndpoint — lives on exactly one Team. Permissions cascade from team membership; sharing breaks open select per-evaluation exceptions.

​
Roles

Every team has exactly one Owner. Use POST /v1/teams/{id}/transfer-admin to hand off.

​
Auth and team binding

API key callers cannot pivot to a different team mid-request. To act on a different team, mint a new key on that team.

​
Reading your teams

​
Members

Role changes emit no webhook today; subscribe to the audit log API (coming Wave 3) for that signal.

​
Per-evaluation sharing

Beyond team membership, you can share a single evaluation with people who are not on the team. Three primitives: Edit-on-share is gated by editorsCanShare on the evaluation row — default true. When the Owner flips it off, only Admin+ can edit sharing.

​
”Not found” vs “no access”

We deliberately conflate the two. A 404 from /v1/evaluations/{id} means either “no such row” or “you lack permission”. This avoids leaking the existence of resources to outsiders. The single exception: cross-team requests where the caller has a membership on a team but not the resource’s team return a 403 with code: evaluation_no_access and a details object containing the resource’s team name and the caller’s email. The dashboard uses this to render a “switch account” empty state.

​
Deletion

Deleting a team cascades to every resource on it — evaluations, autousers, templates, API keys, webhook endpoints. Irreversible. Owner-only.
The Owner gets a final-warning email 24 hours before any team-deletion endpoint is wired up to the dashboard. (As of this writing, team deletion is dashboard-only — no API route.)