> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sixtyfour.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & Permissions

> Understand the organizational roles and permissions for Sixtyfour.

Sixtyfour uses role-based access control (RBAC) to manage what organization members can see and do. Every member is assigned one of three roles: Member, Admin, or Owner.

| Role | Inherits from | Typical use |
| - | - | - |
| **Member** | — | Developers and end users running API calls, or using the platform's Agent |
| **Admin** | Member | Team leads managing keys, billing, and webhooks |
| **Owner** | Admin | Billing and IT administrators with full org control |

<Note>
  Each role is additive — Admins have everything Members have, and Owners have everything Admins have.
</Note>

## Permission reference

The table below lists every permission and which roles hold it.

| Permission | Member | Admin | Owner |
| - | :-: | :-: | :-: |
| `org:read` | ✓ | ✓ | ✓ |
| `org:write:rename` | | | ✓ |
| `org:write:support` | | | ✓ |
| `members:read` | ✓ | ✓ | ✓ |
| `members:write:invite` | | ✓ | ✓ |
| `members:write:role` | | | ✓ |
| `members:write:remove` | | | ✓ |
| `oauth:read` | ✓ | ✓ | ✓ |
| `oauth:write` | | ✓ | ✓ |
| `webhooks:read` | ✓ | ✓ | ✓ |
| `webhooks:write` | | ✓ | ✓ |
| `keys:read` | ✓ | ✓ | ✓ |
| `keys:write` | | ✓ | ✓ |
| `billing:read` | ✓ | ✓ | ✓ |
| `billing:write` | | ✓ | ✓ |
| `usage:read` | ✓ | ✓ | ✓ |
| `logs:read` | | ✓ | ✓ |
| `logs:export` | | ✓ | ✓ |
| `agent:read` | ✓ | ✓ | ✓ |
| `agent:write` | | ✓ | ✓ |
| `data:read` | ✓ | ✓ | ✓ |
| `data:write` | ✓ | ✓ | ✓ |
| `integrations:write` | ✓ | ✓ | ✓ |

## Member

The default role for anyone invited to an organization.

| Permission | Description |
| - | - |
| `org:read` | View organization details |
| `members:read` | View the member list |
| `oauth:read` | View OAuth client configurations |
| `webhooks:read` | View webhook configurations |
| `keys:read` | View that API keys exist (not the key value) |
| `billing:read` | View billing information and invoices |
| `usage:read` | View usage dashboards and credit balance |
| `agent:read` | View agent configurations |
| `data:read` | Read enrichment and search data |
| `data:write` | Run enrichment and search requests |
| `integrations:write` | Manage third-party integrations |

<Note>
  API key values are only visible at generation time. `keys:read` confirms a key exists — it does not expose the key value.
</Note>

## Admin

Admins have all Member permissions, plus the ability to manage team access and account configuration.

| Permission | Description |
| - | - |
| `members:write:invite` | Invite new members to the organization |
| `keys:write` | Create and revoke API keys |
| `oauth:write` | Create and manage OAuth clients |
| `webhooks:write` | Create and manage webhooks |
| `billing:write` | Update billing details and payment methods |
| `logs:read` | View detailed API call logs |
| `logs:export` | Export API logs as CSV |
| `agent:write` | Create and update agent configurations |

## Owner

Owners have all Admin permissions, plus organization-level controls that affect membership structure and account identity.

| Permission | Description |
| - | - |
| `members:write:role` | Change a member's role |
| `members:write:remove` | Remove members from the organization |
| `org:write:rename` | Rename the organization |
| `org:write:support` | Manage support access and settings |

<Warning>
  Only an existing Owner can promote another member to Owner or remove an Owner from the organization. Assign this role carefully.
</Warning>

## Manage role assignments

Role assignments are managed from the organization settings page in the Sixtyfour app.

1. Go to [Organization settings](https://app.sixtyfour.ai/settings/organization).
2. Open the **Team Members** section.
3. Change a member's role or remove them from the organization.

You need `members:write:role` to change roles and `members:write:remove` to remove members — both held by **Owners** only. **Admins** can invite new members but cannot change existing roles.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.