Team, seats, sign-ins, and the audit log
Who can do what in an organization, how seats are counted and charged, and what the audit log and sign-in history record.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
What is an organization?
Everything belongs to one: endpoints, events, API keys, billing, and the people with access. Settings apply across every endpoint on the account, and the plan is held by the organization rather than by any individual.
What roles are there?
| Role | Can do |
|---|---|
| Owner | Everything, including billing, deleting the organization, and changing roles |
| Admin | Everything except deleting the organization and transferring ownership |
| Member | Endpoints, events, replay, and saved events |
Role is enforced on the server on every request, not in the interface. Hiding a button is a courtesy to the person reading the screen; it is never what stops an action.
An API key cannot perform an owner or admin action, whatever the scope on the key. Those actions need a signed-in person, because a key is a long-lived credential that gets pasted into deploy pipelines, and a leaked key must not be able to change who has access or cancel a subscription.
How many people can I invite?
| Plan | Seats included |
|---|---|
| Hobby | 1 |
| Starter | 1 |
| Pro | 3 |
| Business | 5 |
Inviting somebody while seats remain uses one of the seats the plan includes, and nothing is charged. The option to buy a seat appears only once every included seat is taken.
What does an extra seat cost?
A seat costs what the plan costs, on the cycle you already pay on. There is no separate per seat tariff: bringing somebody into a Pro organization is charged at the Pro rate, because that seat consumes the same allowance and the same features the plan sells.
Somebody who already pays for an organization of their own, on your plan or higher, joins without taking a seat. They are already paying for the capacity they bring.
What happens when somebody leaves?
Removing a member frees their seat immediately, so the next person you invite takes that seat rather than needing another one bought.
Reducing the number of seats you pay for is not something the dashboard does yet. Email support@shellorbit.com and we will take them off the subscription.
What does the audit log record?
Every action that changes configuration or access, with who did it and when: endpoints created and deleted, keys issued and revoked, members invited, removed, and re-roled, domains claimed and verified, plans changed, and subscriptions cancelled or resumed.
It records the action, not the payload. What an event contained is in the event log, which has its own retention; the audit log is about what people did to the account.
Who signed in, and from where?
The sign-in history records every sign in, wrong password, wrong code, and sign out for the people in your organization: when, how they signed in, the IP address, the browser and operating system, and an approximate location (city, region, and country) worked out from the IP address. Owners and admins see everyone; every other member sees their own. A location is approximate by nature, so a VPN or an office proxy shows its own location rather than the person’s.
Where you are signed in right now is listed at the top of the same page, with the device, address, and location of each session. Sign out any one of them, or every one except the browser you are using.
How far back can I see?
Every plan records everything. The plan decides how much of it you can read:
| Plan | Audit log and sign-in history | CSV export of the audit log |
|---|---|---|
| Hobby | Last 30 days | No |
| Starter | Last 60 days | No |
| Pro | Last 90 days | Yes |
| Business | Last year | Yes |
Upgrading shows the longer window straight away, because the history was being kept all along. Records are deleted a little over a year after they were made.