Existing team administration
These operations support existing workplace teams. New team signup is unavailable. Teams share organization resources while members keep their own accounts and sign-in choices; families have a smaller, separate feature set.
Availability and usage
New workplace team creation is unavailable and returns 403. Personal and Family plans are available for new accounts. Teams pricing is to be determined; existing teams keep their current capabilities.
Teams is TBD and new workplace signup is unavailable. Existing teams retain free access without seat charges; this administration reference serves those teams.
Role permissions
Existing workplace teams assign each account one of these roles. These permissions apply to teams, not Family groups:
| Field | Type | Description |
|---|---|---|
| owner | one per team | Everything an admin can do, plus deleting the team, managing billing, transferring ownership, verifying the email domain, auto-join, and retention. The owner must transfer ownership before leaving. |
| admin | role | Renames the team, invites and removes members, changes roles, removes any team app, creates and edits on-call and device groups, and reads the audit log. |
| member | role | Uses and adds team apps, raises and acknowledges pages, and schedules overrides for themselves. |
Assigning owner transfers ownership and changes the former owner to admin. Removing a member immediately prevents new team-app passes and removes that person from rotations.
Issue a workplace invitation
An owner or admin can issue a revocable, single-person invite that lasts seven days. Supplying email also alerts an existing Notify account at that address. A domain restriction must use the organization’s verified domain.
notify teams invite team_... --email teammate@example.com --role member
notify teams invite team_... --domain acme.com --role member
# { "invite": { ... }, "code": "…", "url": "https://notify.belweave.ai/join/…" }The join page identifies the team, inviter, and assigned role. The recipient signs in to accept; an agent may prepare an invitation but cannot join on a person’s behalf.
Shared workplace apps
Members can add a hosted app or share one they originally added with notify apps share app_... --team team_.... Use --personal to return it to personal use. Other members receive a notice and see the shared app.
- Each viewer chooses sign-in consent and profile sharing independently.
- A team-app pass carries pairwise
sub,team_id, and the currentteam_role, checked when issued. The app server still decides authorization. - The original contributor and team admins can rename/remove the app. Deleting the team returns shared apps to their original contributors.
Target a device group
A device group (dgrp_…) selects workplace members and/or individual devices; it is not an on-call rotation. Owners/admins manage groups. Targeting is allowed for those admins/owners and current group members; other teammates get 403, and cross-team IDs return 404. group is exclusive with deviceIds and oncall. Group questions settle on the first valid answer from a current group member.
notify groups create --team team_... --name Maintenance --members user_a,user_b
notify send "Cold-room sensor is offline" --group dgrp_...
notify send ask "Start maintenance?" --approval --group dgrp_...
notify activity start --title Maintenance --status Running --group dgrp_...
notify page ocg_example_maintenance "Pager" --group dgrp_...Domains and retention
Organization settings belong to the existing team. To claim a domain, the owner must have a verified email there. Requesting a challenge stores a pending token; publish _notify-verification.<domain> with TXT value notify-verify=<token> and run verify. Only successful verification establishes the unique verifiedDomain. Pending domains need not be unique. Public email providers and Apple relay domains cannot be claimed. Auto-join is owner-controlled, off by default, and requires a verified domain; an eligible user must have emailVerified: true and an available seat. SSO/SCIM are future work.
Retention may be 7, 30, 90, or 365 days, or null indefinitely. It applies to organization-targeted notifications, prompts, and pages, not personal sends. Hourly cleanup removes expired rows in bounded indexed batches and resumes shortly after a time-budget stop. It preserves pending prompts, their events, and active activities.
notify teams domain team_... acme.com
# Add TXT _notify-verification.acme.com = notify-verify=<token>
notify teams verify-domain team_...
notify teams update team_... --auto-join --retention 30
notify teams update team_... --no-domain --no-retentionReview organization events
Owners and admins can inspect the append-only team audit in the dashboard or GET /api/agent/teams/:id/audit; members receive 403. Filters include an inclusive from. CSV export walks at most 50,000 rows and reports additional rows with X-Audit-Truncated: true. Records contain actor, target, IP, user agent, and timestamp without message bodies or replies. Covered events include invites, membership/roles, deletion, device groups, app sharing, org-targeted notifications/activities/pages, answered approvals, and settings. The human responder is the actor for an answer. Token creation/revocation is excluded from team audit.
Reach an internal service
Expose a private HTTP service through Notify Connector and the OpenTunnel relay. The public hostname reaches the service; a verified Notify pass or signed callback still determines who may use it.
Page a responder
For existing workplace teams, choose the current responder and escalate unanswered pages. This chapter covers rotations, page creation, and the human acknowledgement that stops escalation.