Organizations and roles

An organization is the shared workspace for a team. Everything you connect belongs to the team rather than to one person, so anyone on it opens the same repositories and reads the same findings.

What belongs to the team

When you connect a repository, the team owns it. Not you. That is why the work carries on when someone leaves, and why two teams on the same account never see each other's repositories or findings.

Connected repositories, and every scan, finding, and fix under them
The accounts you connected at GitHub, GitLab, and Bitbucket
Connected container registries and the images from them
Scan settings, the onboarding profile, and usage
The plan, the allowance every scan spends from, and the billing account
The audit log

The three roles

Everyone on the team can scan and read. Only an owner or an admin can change what is connected, or put code on a repository.

Role	What this person can do
`owner`	Everything an admin can do. Created the organization. This seat cannot be removed by another administrator.
`admin`	Connect and disconnect repositories and accounts, change scan settings, change the plan and its seats, and open and merge pull requests.
`member`	Scan, read findings, triage them, and generate patches. Cannot change what is connected, and cannot open or merge a pull request.

Role by action

Action	`owner`	`admin`	`member`
Run a scan	Yes	Yes	Yes
Read findings, branches, commits, and the audit log	Yes	Yes	Yes
Read the plan and the allowance	Yes	Yes	Yes
Triage a finding	Yes	Yes	Yes
Generate a patch	Yes	Yes	Yes
Export an SBOM	Yes	Yes	Yes
Connect or disconnect a repository	Yes	Yes	No
Change scan settings and coverage checks	Yes	Yes	No
Connect or disconnect a GitHub, GitLab, or Bitbucket account	Yes	Yes	No
Connect a container registry, or add an image	Yes	Yes	No
Open a pull request for a fix, or merge one	Yes	Yes	No
Attest a proof	Yes	Yes	No
Change the plan, buy seats, or open the billing portal	Yes	Yes	No

Switching team in the workspace

The switcher sits at the top of the sidebar. It lists the organizations you belong to and creates a new one. It also opens the management view, where you invite members and change their roles. The workspace acts on whichever organization is selected there.

Choosing one from the CLI

Which organization cf acts onbash

cf org list
cf org use acme
cf org show

Belong to exactly one organization and you can skip all of this: the API uses that one. Belong to several and name none, and commands answer organization_required instead of guessing. Guessing would mean showing you another team's findings and saying nothing about it. Full detail in Organizations in the CLI.

Errors you will see

Code	What happened
`organization_required`	You belong to more than one organization and named none.
`organization_not_found`	That slug is not an organization you belong to. A slug that does not exist gets the same answer, so the error never confirms that someone else's organization is real.
`organization_forbidden`	You are a member here, and this action needs an owner or an admin.
`billing_forbidden`	Changing what the organization pays needs an owner or an admin. Reading the plan does not.
`unknown_organization`	`cf org use` was given a slug your account does not have. Nothing was stored.

Have a correction or need help?

Email the docs team