# Team

Canonical HTML: https://anchorshell.com/docs/team

Invite teammates, assign access, and manage shared Relay configuration without sharing credentials.

Last updated: 2026-09-17

A Team shares one AnchorShell workspace and Relay configuration. Each member has their own login, permissions, and API keys. Permissions control which operations a member can perform; [limits](https://anchorshell.com/docs/limits) separately control how much they can use.

Available seats and plan entitlements constrain membership. Inviting someone does not share your password or turn their API keys into your keys.

## Dashboard

1. Open **Team**, invite a member by email, and choose a role.
2. The recipient accepts the invitation before its seven-day expiry and completes account setup.
3. Open a member to review Relay and workspace permissions.
4. Adjust permissions or remove the member when access is no longer needed.

Use scoped grants for provider management, Group configuration, usage, logs, queues, or limits. Owner access cannot be edited as an ordinary member permission preset.

## API

Use a key with the relevant permissions; see [API authentication](https://anchorshell.com/docs/api). Replace placeholders with IDs from the corresponding list or create response.

Team reads require `cloud:team:read`; changes require `cloud:team:manage` and the user's normal role checks. Because these writes can delegate access, use a management key containing all of your current permissions.

### List members

```bash
curl 'https://api.anchorshell.com/api/team/members' \
  -H 'Authorization: Bearer <API_KEY>'
```

**Response — 200 OK**

Selected response fields shown; IDs and values are illustrative.

```json
{
  "members": [
    {
      "id": "<MEMBER_ID>",
      "name": "Your name",
      "email": "you@example.com",
      "role": "owner",
      "status": "active"
    }
  ],
  "team_members": [
    {
      "id": "<MEMBER_ID>",
      "name": "Your name",
      "email": "you@example.com",
      "role": "owner",
      "status": "active"
    }
  ]
}
```

### Invite a member

```bash
curl -X POST 'https://api.anchorshell.com/api/team/invitations' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "teammate@example.com",
  "role": "developer"
}'
```

**Response — 201 Created**

Invitation created and invitation email queued; expires_at is authoritative.

```json
{
  "invitation": {
    "id": "<INVITATION_ID>",
    "email": "teammate@example.com",
    "role": "developer",
    "expires_at": "2026-09-24T12:00:00Z",
    "accepted_at": null,
    "revoked_at": null
  }
}
```

### Read permissions

```bash
curl 'https://api.anchorshell.com/api/team/members/<MEMBER_ID>/permissions' \
  -H 'Authorization: Bearer <API_KEY>'
```

**Response — 200 OK**

Selected response fields shown; IDs and values are illustrative.

```json
{
  "member": {
    "id": "<MEMBER_ID>",
    "name": "Your name",
    "email": "you@example.com",
    "role": "developer",
    "status": "active"
  },
  "mode": "custom",
  "permissions": [
    "relay:request",
    "relay:usage:read:self"
  ],
  "editable": true
}
```

### Replace Relay permissions

```bash
curl -X PUT 'https://api.anchorshell.com/api/team/members/<MEMBER_ID>/permissions' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
  "permissions": [
    "relay:request",
    "relay:usage:read:self"
  ]
}'
```

**Response — 200 OK**

Selected response fields shown; IDs and values are illustrative.

```json
{
  "member": {
    "id": "<MEMBER_ID>",
    "name": "Your name",
    "email": "you@example.com",
    "role": "developer",
    "status": "active"
  },
  "mode": "custom",
  "permissions": [
    "relay:request",
    "relay:usage:read:self"
  ],
  "editable": true
}
```

The `permissions` array replaces custom Relay grants, rather than adding to them. Omit `platform_permissions` to leave workspace grants unchanged.

### Remove a member

```bash
curl -X DELETE 'https://api.anchorshell.com/api/team/members/<MEMBER_ID>' \
  -H 'Authorization: Bearer <API_KEY>'
```

**Response — 204 No Content**

No response body.

### Apply a user token budget

```bash
curl -X POST 'https://api.anchorshell.com/api/relay/pro/user-limit-policies' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
  "user_uuid": "<MEMBER_ID>",
  "target_type": "global",
  "metric": "tokens",
  "period": "day",
  "limit_value": 100000,
  "enabled": true
}'
```

**Response — 200 OK**

No policy ID is returned. List policies to obtain its limit_uuid.

```json
{
  "ok": true
}
```

Budget changes require `relay:limits:manage`; they do not change the member's permissions.

## Next

[Send your first managed request](https://anchorshell.com/guides/managed-first-request).