Organizations

Organization accounts

Run Anoman as a team. Invite staff, group endusers, and scope keys, usage, policies, and billing to a shared org account.

Concept

Personal vs organization accounts

Every user starts with a personal account. An organization account is a multi-user tenant you create and invite people into. All data — API keys, usage, policies, and billing — is scoped to whichever account you are acting as, so nothing leaks between your personal account and an org.

You can belong to several accounts at once (your own personal account plus one or more orgs). The account switcher in the dashboard top bar decides which one every action applies to.

Roles

Five roles, highest to lowest

RBAC is enforced server-side on the gateway (authoritative and audited), not just hidden in the UI. Roles rank owner > admin > admin_read_only > member > enduser.

Role	What they can do
owner	Full control including transferring ownership and deleting the org. Exactly one owner at a time.
admin	Full management — invite and remove members, manage groups, keys, billing, and policies. Cannot modify the owner.
admin_read_only	Auditor. Sees everything across the org but changes nothing. Ideal for compliance and finance reviewers.
member	Staff member with dashboard access per RBAC — works with keys, usage, and traces within their permissions.
enduser	Copilot-only user with no dashboard and no API key. Their chat spends the org pool under group caps.

endusers are covered in detail under Managed endusers; staff invitations (admin / admin_read_only / member) are covered under Team invitations.

Create

Two ways to create an org

Self-serve — call POST /anoman/v1/accounts, available on Pro and Enterprise plans only (see Plans & Billing). Starter and PAYG receive 403 tier_not_eligible. In the dashboard this is the account switcher's “Create organization” modal, which shows an upgrade prompt if you're not on Pro/Enterprise. The creator becomes the owner.
Ops-provisioned — for sales-led enterprise deals the Anoman team can provision an org for you regardless of tier. Talk to sales.

# Create an organization (Pro / Enterprise plans only).
# The caller becomes the owner. Starter / PAYG get 403 tier_not_eligible.
curl https://api.anoman.io/anoman/v1/accounts \
  -H "Authorization: Bearer anm-sk-..." \
  -H "Content-Type: application/json" \
  -d '{ "name": "Acme Corp" }'

# 200 OK
# {
#   "id": "acct_9f2b...",
#   "name": "Acme Corp",
#   "type": "organization",
#   "role": "owner"
# }

Account switcher

Choosing which account you act as

The account switcher in the dashboard top bar (or POST /anoman/v1/accounts/switch on the gateway) sets your active account. Every subsequent request — creating keys, viewing usage, editing policies — applies to that account. Users on a personal account only see their own data and no members list.

# Switch which account you're acting as. Every request afterward is
# scoped to that account's keys, usage, policies, and billing.
curl https://api.anoman.io/anoman/v1/accounts/switch \
  -H "Authorization: Bearer anm-sk-..." \
  -H "Content-Type: application/json" \
  -d '{ "account_id": "acct_9f2b..." }'

The Members page (/dashboard/members) only appears when you're acting as an org; a personal account has nobody to manage.

Convert & transfer

Convert a personal account, transfer ownership

Promote a personal account into an org with /convert (owner-only), which keeps your existing keys and history but unlocks membership. Hand the org to someone else with /transfer-ownership (owner-only): the new owner becomes owner and you are demoted to admin.

# Convert a personal account into an organization (owner-only).
curl https://api.anoman.io/anoman/v1/accounts/acct_9f2b.../convert \
  -H "Authorization: Bearer anm-sk-..."

# Transfer ownership to another member (owner-only). The new owner
# becomes 'owner'; you are demoted to 'admin'.
curl https://api.anoman.io/anoman/v1/accounts/acct_9f2b.../transfer-ownership \
  -H "Authorization: Bearer anm-sk-..." \
  -H "Content-Type: application/json" \
  -d '{ "user_id": "usr_4c81..." }'

Server-authoritative. Every role check runs on the gateway and is cross-pod-safe and audited — a member can never escalate themselves by editing the dashboard, and an admin can never modify the owner.

Next steps

Build out your org

Team invitations — invite staff (admin / admin_read_only / member) by email.
Member groups — bundle model access and per-member spend caps for endusers.
Managed endusers — onboard non-technical staff onto Copilot with no keys.

Set up your organization

Create an org, invite your team, and manage everyone from one Members page.

Open Members Back to docs