Team members and roles
Invitations, pre-built and custom roles, access end dates, keys limited by role and the audit log.
Everyone in an organization holds one member role. The role decides which actions the member can take, which channels they can use (the dashboard, MCP connections and the browser extension) and which environments they can work in. The same role is checked on every request, whatever the channel.
Plans
Starter has 1 seat, for the owner. Team members start on Growth, which has 10 seats. A pending invitation holds a seat. From Growth, owners and admins invite members into 7 pre-built roles (Owner, Admin, Developer, Analyst, Billing, Viewer and Auditor), can set a date when a member's access ends, and can view and export the audit log. Audit events are recorded on every plan. From Scale, owners and admins can also create custom roles by removing permissions, channels or environments from a pre-built role.
| Plan | Seats | Invitations and pre-built roles | Custom roles | Audit log view | Create further organizations |
|---|---|---|---|---|---|
| Free | 1 | No | No | No | No |
| Starter | 1 | No | No | No | No |
| Growth | 10 | Yes | No | Yes | Yes |
| Scale | 25 | Yes | Yes | Yes | Yes |
| Business | 25 | Yes | Yes | Yes | Yes |
Starter plans bought before team access was released keep 3 seats with the Owner, Admin and Analyst roles until the plan changes. Owning an organization on Growth or above lets you create further organizations. A person can own only one Free organization. Organizations you already own are kept.
Invite members
Owners and admins invite people under Settings → Members. In the dashboard you can paste up to 20 email addresses at once; they all get the same role and the same optional access end date. Each invitation lasts 7 days. You can resend it, which keeps its role and end date, or cancel it. A pending invitation holds a seat, so you cannot invite more people than the plan has seats.
The person accepts or declines from the link in their email. Accepting copies the invitation's role and end date to their membership. The invitation is refused if, by then, the person who sent it no longer has a role at least as strong, the role was deleted, the plan no longer allows it or the end date has passed.
Members can see who else is in the organization only when their role holds members:read. Pending invitations and their email addresses are visible to the same members. Two-factor status, last activity, sign-in method, connections and keys per member are shown only to members with members:write.
Pre-built roles
VAT Tools keeps these roles current. Existing members who had the earlier plain member role are now Analysts.
| Role | What it is for | Channels | Permissions |
|---|---|---|---|
| Owner | Everything, including two-factor policy and deleting the organization. Only an owner can make someone an owner. | Dashboard, MCP, Extension | vat:validate company:search company:verify vat:discover tax:assess history:read usage:read billing:read bulk:read bulk:write reconciliation:run monitors:read monitors:write webhooks:read webhooks:write members:read members:write keys:read keys:write connections:read connections:write billing:write settings:write security:write audit:read organization:delete |
| Admin | Everything except security settings and deleting the organization. | Dashboard, MCP, Extension | vat:validate company:search company:verify vat:discover tax:assess history:read usage:read billing:read bulk:read bulk:write reconciliation:run monitors:read monitors:write webhooks:read webhooks:write members:read members:write keys:read keys:write connections:read connections:write billing:write settings:write audit:read |
| Developer | Every product permission, developer keys and the connection list. Cannot manage members, billing or settings. | Dashboard, MCP, Extension | vat:validate company:search company:verify vat:discover tax:assess history:read usage:read billing:read bulk:read bulk:write reconciliation:run monitors:read monitors:write webhooks:read webhooks:write members:read keys:read keys:write connections:read |
| Analyst | Runs checks, bulk jobs and monitors and reads history and usage. No webhooks, keys or management. | Dashboard, MCP, Extension | vat:validate company:search company:verify vat:discover tax:assess history:read usage:read billing:read bulk:read bulk:write reconciliation:run monitors:read monitors:write members:read |
| Billing | Reads usage and changes the plan and billing details. Sees no history. | Dashboard | usage:read billing:read members:read billing:write |
| Viewer | Reads history, bulk jobs, monitors and usage. Runs nothing. | Dashboard | history:read usage:read billing:read bulk:read monitors:read members:read |
| Auditor | Reads history and checks individual VAT numbers, which are recorded under their name. Sees no usage or members. | Dashboard | vat:validate history:read |
Every pre-built role works in both sandbox and live. Product permissions such as vat:validate are the same names developer keys use as scopes. Management permissions such as members:write only work in a dashboard session; keys and connections never get them.
Custom roles
On Scale and above, owners and admins can create up to 20 custom roles under Settings → Roles. A custom role starts as a copy of a pre-built role other than Owner. You then remove permissions, channels or environments, for example an Analyst that can only use sandbox. You cannot add anything the source role does not have, and new permissions VAT Tools adds later are never added to a custom role on their own.
- Renaming a custom role keeps its members.
- Editing it applies on its members' next request. Their connections that relied on a removed permission, channel or environment are revoked.
- Deleting it is refused while members hold it or pending invitations use it. Move those members to another role or cancel the invitations first.
Access end dates
An invitation or a membership can carry a date when access ends: 7, 30 or 90 days, or a date you choose up to 365 days ahead. Auditor invitations default to 90 days. Owners never have an end date.
- The date is checked on every dashboard request, every connection call and every token refresh. After it passes, the member has no access and holds no seat.
- The member is reminded 7 days and 1 day before. The person who invited them and the organization's owners and admins are told 7 days before and when access ends.
- The expired membership stays in the member list until an owner or admin removes it. They can renew it with a new date while a seat is free.
Removing members and leaving
When a member is removed, leaves or reaches their end date, their access stops on the next request and their connections in the organization are revoked. Developer keys and webhook endpoints they created keep working and are flagged, so owners and admins can review them. The removal dialog lists the member's keys and lets you revoke them in the same step.
Keys and connections
A new developer key can hold only the scopes and environment its creator's role allows; see Keys and member roles. A connection (an MCP client or the browser extension) acts for the member who approved it and never exceeds their current role; see Connect with OAuth.
Audit log
VAT Tools records an audit event for every invitation, membership, role, end date, ownership, custom role, key, connection, billing, settings and two-factor policy change, for VAT Tools support actions and for denied management actions. Events are recorded on every plan and kept for 400 days.
Members with audit:read (owners and admins by default) read the log under Settings → Audit log on plans with team roles. Filter by person, kind of action and date, and export the filtered list as CSV. Each event shows when it happened, who did it, what changed, the outcome, the sign-in country, a shortened network address, a short device description and the values before and after. The log never contains secrets or key material.
When the plan changes
Before a downgrade, the owner sees which members are affected. Each member then gets the strongest pre-built role the new plan allows that does not exceed their current role. A member for whom no such role exists is suspended: the membership is kept but has no access until the plan is upgraded or an owner or admin gives them another role. A downgrade never widens anyone's access.
Management routes
Members, invitations, roles and the audit log are managed through /v1/organization/members, /v1/organization/invitations, /v1/organization/roles and /v1/organization/audit-events. They accept dashboard sessions only, from the VAT Tools origin. Developer keys and connections cannot call them. Each invitation request takes one email address. Owners and admins can also download the member list as CSV for an access review.
Refusals carry a code, for example ROLE_ESCALATION when a role exceeds your own, SEATS_FULL when every seat is taken and INVITATIONS_NOT_AVAILABLE on a plan without invitations. See Errors, retries and idempotency for the full list.