Teams

Consuela Cloud is organized around organizations. Every user belongs to at least one organization and can belong to several, switching between them from the account menu. Each organization has its own members, roles, crawl history, and billing — nothing is shared across organization boundaries.

Roles

Every member of an organization holds exactly one role. The three roles are hierarchical: each level inherits everything the level below it can do.

Role	Capabilities
Owner	Full control over the organization. Manages billing, SSO configuration, SCIM tokens, IP restrictions, and can transfer ownership or delete the organization. One owner per organization.
Admin	Manages members: invites and removes users, changes roles (up to admin), and configures organization-level crawl defaults and API keys. Cannot access billing or SSO settings.
Member	Uses the product: starts crawls, views results, publishes punch lists, exports data, and manages their own API keys.

Members

The members list shows everyone in the organization. Each row displays the member's name, email address, current status, role, and whether the member is managed by SCIM.

Column	Description
Name	Display name from the user's account profile.
Email	The email address tied to the account.
Status	Active, invited (pending acceptance), or suspended.
Role	Owner, admin, or member.
SCIM-managed	Whether the member was provisioned through SCIM. SCIM-managed members cannot have their role changed through the UI — role assignment is controlled by the identity provider.

Owners and admins can change a member's role or remove them from the organization. Removing a member revokes their access immediately; their past activity (crawls started, punch lists published) remains in the organization's history.

Invitations

Owners and admins invite new members by entering an email address and selecting a role. The invitation counts against the organization's seat limit immediately — if no seats are available, the server returns 402 payment_required with a link to upgrade the plan.

Accept flow

The invitation email contains a link with a single-use token. When the recipient opens the link, their current session identifies who they are. The server verifies that the session's email matches the address the invitation was sent to — if it does not match, the accept is refused. This prevents a forwarded link from attaching the wrong account to the organization.

If the recipient is not signed in, they are directed to sign up or log in with a ?next= redirect that returns them to the accept flow after authentication completes.

SCIM

SCIM v2 provisioning automates the user lifecycle from an identity provider. When a user is assigned to the Consuela application in your IdP, SCIM creates their account and adds them to the organization. When a user is unassigned or deactivated, SCIM suspends their access. Role changes made in the IdP are reflected automatically.

Setting up SCIM

Navigate to your organization's SSO settings and generate a SCIM bearer token. The token is displayed once — copy it before closing the dialog. Enter the token and the SCIM base URL into your identity provider's provisioning configuration.

Endpoints

The SCIM server exposes two resource types, each supporting the standard create, read, update, and delete operations:

Resource	Endpoint	Operations
Users	`/scim/v2/Users`	Create, read, update, delete (CRUD). Maps IdP user attributes to Consuela accounts.
Groups	`/scim/v2/Groups`	Create, read, update, delete (CRUD). Maps IdP groups to organization roles.

All SCIM requests must include the bearer token in the Authorization header. The token authenticates every request and scopes it to a single organization.

SSO domains

Domain verification ties an email domain to an organization's identity provider. Once a domain is verified, any user who signs in with an email address on that domain is routed to the configured IdP instead of seeing the standard login form.

Verification flow

Add the domain in your organization's SSO settings. The server generates a DNS verification record — a TXT record with a unique value that you add to the domain's DNS zone. Once the record is in place, select Check DNS to trigger verification. The server queries DNS for the expected record and, if found, marks the domain as verified.

Verification is checked once at the time you press the button, not continuously. If you later remove the DNS record, the domain remains verified until it is explicitly removed from the organization's settings.

IP restrictions

Organizations can restrict sign-in to a set of IP address ranges. Each entry is a CIDR range with an optional label for identification (for example, 203.0.113.0/24 labeled "Office").

When at least one range is configured, sign-in attempts from addresses outside the allowed ranges are refused. Existing sessions are not affected — a user who is already signed in will not be disconnected if their IP changes or a new restriction is added. The restriction applies only at the point of authentication.

Seats

Seat limits depend on the plan: Free and Pro include one seat, Business includes ten, and Enterprise is unlimited. The organization settings page shows the current seat count. When the limit is reached, invitations and SCIM provisioning return 402 payment_required until the plan is upgraded.