Current

Teams, roles and invites

Share projects with a team and control what each member role can do

Personal and team projects

Every project is either personal or belongs to a team.

Project type	Who has access	Notes
Personal	The project owner, who has the `owner` role	Other users receive a not-found response.
Team	Members of the team, with the role each member holds	Access comes only from membership, including for the project's original owner.

A member who leaves a team loses every capability on its projects at once.

Roles

Each team member has one role. A role decides which actions the member can take in the dashboard and through connected agents.

Capability	Owner	Admin	Editor	Viewer
Read project, pages, generations, and domains (`project.read`, `docs.read`, `generation.read`, `domains.read`)	✓	✓	✓	✓
Edit pages and site settings, publish, restore, and decide approval requests (`docs.write`, `site.write`, `docs.publish`, `docs.restore`, `approvals.decide`)	✓	✓	✓	—
Run generations, manage domains, configure approvals, manage the team, and create projects (`generation.run`, `domains.write`, `approvals.configure`, `team.manage`, `project.create`)	✓	✓	—	—
Delete projects and the team (`project.delete`, `team.delete`)	✓	—	—	—

In practice:

Viewer can read the project, its pages, generations, and domains. Viewers cannot change content.
Editor can also edit pages and site settings, publish and restore branches, and decide approval requests.
Admin can also run generations, manage domains, set approval rules, manage members, and create projects.
Owner can also delete projects and the team. Only owners can give, take, or change the owner role.

Agents and team roles

A connected agent gets the intersection of three limits: the member's role, the scope granted on the consent page, and the projects chosen for that grant. The role is the only part that depends on the team.

An agent acting for a viewer can read content, but every write tool returns "not found."
No OAuth scope grants approval or team management. Those actions always require a dashboard user with the matching role.

See Connect an AI Agent with MCP and MCP Scopes and Approval Requests for how to grant scopes.

Approval requests in a team

Any member whose role includes approvals.decide can decide a request. Approving also requires the capability of the action itself. For example, an editor can approve a publish but not a project deletion or a generation.
Requests show the name of the member who asked and the member who decided.
Require another decider is off by default. When you turn it on in Project settings under Agent approvals, the member whose agent asked cannot approve that request. That member can still reject or cancel it, because those actions do not run anything. The request detail shows the reason and disables Approve.
If a member who requested an approval leaves the team, their pending requests become stale and are cleaned up automatically.

Who owns project resources

Storage, billing, generations, and the GitHub installation stay with the project owner, even when a team member acts on the project. Doxa still records the member who acted wherever the product tracks attribution, such as site settings changes, approval decisions, and generation cancellations. Branch changes record the owner, as they do for agent actions.

Manage teams with the REST API

Team routes are part of the Doxa REST API. Each request must come from a signed-in user with the role listed below.

Route	Who can call it
`GET /teams`, `POST /teams`	Any signed-in user. The creator becomes the first owner.
`GET /teams/:teamId`	Members. The invite list requires `team.manage`.
`PATCH /teams/:teamId`	Rename the team. Requires `team.manage`.
`DELETE /teams/:teamId`	Requires `team.delete`. Returns `409 team_has_projects` while the team has projects.
`POST /teams/:teamId/invites`	Requires `team.manage`. Inviting an owner requires the owner role. An optional `email` sends the invite link by email.
`DELETE /teams/:teamId/invites/:inviteId`	Requires `team.manage`. Revokes a pending invite.
`PATCH /teams/:teamId/members/:userId`	Requires `team.manage`. Only owners can change the owner role.