# Existing team administration These operations support existing workplace teams. New team signup is unavailable. Teams share organization resources while members keep their own accounts and sign-in choices; [families](https://notify.belweave.ai/docs/family) have a smaller, separate feature set. HTML: https://notify.belweave.ai/docs/teams ## Availability and usage New workplace team creation is unavailable and returns `403`. Personal and Family plans are available for new accounts. Teams pricing is to be determined; existing teams keep their current capabilities. Teams is TBD and new workplace signup is unavailable. Existing teams retain free access without seat charges; this administration reference serves those teams. > Pages have no monthly notification cap, whether raised by an agent connection or service. Administrative notices about invitations and shared apps are excluded from usage accounting. ## Role permissions Existing workplace teams assign each account one of these roles. These permissions apply to teams, not Family groups: | Field | Type | Description | | --- | --- | --- | | `owner` | one per team | Everything an admin can do, plus deleting the team, managing billing, transferring ownership, verifying the email domain, auto-join, and retention. The owner must transfer ownership before leaving. | | `admin` | role | Renames the team, invites and removes members, changes roles, removes any team app, creates and edits on-call and device groups, and reads the audit log. | | `member` | role | Uses and adds team apps, raises and acknowledges pages, and schedules overrides for themselves. | Assigning `owner` transfers ownership and changes the former owner to `admin`. Removing a member immediately prevents new team-app passes and removes that person from rotations. ## Issue a workplace invitation An owner or admin can issue a revocable, single-person invite that lasts seven days. Supplying `email` also alerts an existing Notify account at that address. A `domain` restriction must use the organization’s verified domain. ```bash notify teams invite team_... --email teammate@example.com --role member notify teams invite team_... --domain acme.com --role member # { "invite": { ... }, "code": "…", "url": "https://notify.belweave.ai/join/…" } ``` The join page identifies the team, inviter, and assigned role. The recipient signs in to accept; an agent may prepare an invitation but cannot join on a person’s behalf. ## Shared workplace apps Members can add a [hosted app](https://notify.belweave.ai/docs/web-apps) or share one they originally added with `notify apps share app_... --team team_...`. Use `--personal` to return it to personal use. Other members receive a notice and see the shared app. - Each viewer chooses sign-in consent and profile sharing independently. - A team-app pass carries pairwise `sub`, `team_id`, and the current `team_role`, checked when issued. The app server still decides authorization. - The original contributor and team admins can rename/remove the app. Deleting the team returns shared apps to their original contributors. ## Target a device group A device group (`dgrp_…`) selects workplace members and/or individual devices; it is not an on-call rotation. Owners/admins manage groups. Targeting is allowed for those admins/owners and current group members; other teammates get `403`, and cross-team IDs return `404`. `group` is exclusive with `deviceIds` and `oncall`. Group questions settle on the first valid answer from a current group member. ```bash notify groups create --team team_... --name Maintenance --members user_a,user_b notify send "Cold-room sensor is offline" --group dgrp_... notify send ask "Start maintenance?" --approval --group dgrp_... notify activity start --title Maintenance --status Running --group dgrp_... notify page ocg_example_maintenance "Pager" --group dgrp_... ``` ## Domains and retention Organization settings belong to the existing team. To claim a domain, the owner must have a verified email there. Requesting a challenge stores a pending token; publish `_notify-verification.` with TXT value `notify-verify=` and run verify. Only successful verification establishes the unique `verifiedDomain`. Pending domains need not be unique. Public email providers and Apple relay domains cannot be claimed. Auto-join is owner-controlled, off by default, and requires a verified domain; an eligible user must have `emailVerified: true` and an available seat. SSO/SCIM are future work. Retention may be `7`, `30`, `90`, or `365` days, or `null` indefinitely. It applies to organization-targeted notifications, prompts, and pages, not personal sends. Hourly cleanup removes expired rows in bounded indexed batches and resumes shortly after a time-budget stop. It preserves pending prompts, their events, and active activities. ```bash notify teams domain team_... acme.com # Add TXT _notify-verification.acme.com = notify-verify= notify teams verify-domain team_... notify teams update team_... --auto-join --retention 30 notify teams update team_... --no-domain --no-retention ``` ## Review organization events Owners and admins can inspect the append-only team audit in the dashboard or `GET /api/agent/teams/:id/audit`; members receive `403`. Filters include an inclusive `from`. CSV export walks at most 50,000 rows and reports additional rows with `X-Audit-Truncated: true`. Records contain actor, target, IP, user agent, and timestamp without message bodies or replies. Covered events include invites, membership/roles, deletion, device groups, app sharing, org-targeted notifications/activities/pages, answered approvals, and settings. The human responder is the actor for an answer. Token creation/revocation is excluded from team audit.