> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pcnaid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Team Management & Roles

> How to invite team members, manage Owner, Admin, and Analyst roles, and share secure invitation links.

# Team Management & Roles

Pcnaid Lifecycle Manager for Apple Pay® supports role-based access control (RBAC) to allow multi-user collaboration across your organization without sharing owner credentials.

Manage team access by navigating to **Team** (`https://lifecyclemanager.app/team`).

## Role permissions hierarchy

| Role | Permissions & Access Scope | Invitation Authority | Demotion / Removal Rules |
| - | - | - | - |
| **Owner** | Full administrative authority across billing, domains, KYC, settings, team members, and API credentials. | Can invite **Admin** and **Analyst** members. | Immutable. The workspace owner cannot be demoted, reassigned, or removed (`cannot_demote_owner`, `cannot_remove_owner`). |
| **Admin** | Operational access to manage domains, storefront connectors, notification settings, support tickets, and view financial data. | Can invite **Analyst** members. | Can be updated or removed by the workspace Owner. |
| **Analyst** *(Viewer)* | Read-only access to overview charts, transaction feeds, refund logs, and performance reports. Cannot alter settings or invite members. | None. | Can be updated or removed by the workspace Owner. |

## Inviting a new team member

1. On the **Team** page (`/team`), click the **Invite user** button.
2. In the modal dialog, provide the user's corporate email address.
3. Select their assigned role (**Admin** or **Viewer / Analyst**).
4. Click **Send invite**.
5. The Control Plane generates a cryptographically secure token, persists only its SHA-256 hash, and constructs a one-time invitation link:
   ```text theme={null}
   https://lifecyclemanager.app/invite/accept?token=<secure_token>
   ```
6. The invitation remains valid for exactly **7 days**. The invitee clicks the link to accept access and authenticate via Auth0.

> [!NOTE]
>
> Raw invitation tokens are never logged or permanently retained in plaintext. If an invite link expires before acceptance, the Owner can delete the expired invite and issue a fresh invitation.

## Modifying roles & removing access

* **Changing a Role**: In the Team Members table, click the **Role** dropdown next to an active member and choose their new permission tier. The change is committed immediately via `PATCH /applepay-lifecycle/v1/team/members/{auth0UserId}`.
* **Removing a Member**: Click **Remove** next to the user. After confirming, their access token is revoked and their membership row is deleted from the tenant database.
* **Revoking an Invitation**: In the pending invitations list, click the delete icon to revoke the invitation token and prevent subsequent acceptance.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.