> For the complete documentation index, see [llms.txt](https://finext.gitbook.io/one-kyc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://finext.gitbook.io/one-kyc/admin/team.md).

# Team

The **Team** section manages the users that have access to the tenant admin panel. It handles invitations, role assignment, and access revocation.

## Member list

The member registry shows:

* **Email** — the user's email address.
* **Role** — the assigned role, which determines the available sections and actions.
* **Added on** — the date the user was added to the tenant team.

## Roles and permissions

Roles determine which sections and operations a team member can use. Sample roles:

* **Administrator** — full access to every section, including team management, API keys, and tenant settings.
* **Operator** — access to sessions and the manual review queue.
* **Observer** — read-only access (cannot perform actions).

The exact list of roles and their permissions depends on your tenant configuration.

### Per-user permissions

In addition to the role, you can override a granular set of permissions for a single member through `PUT /v1/team/{user_id}/permissions`. Each permission (for example, `reviews.read`, `sessions.export`, `storage.config_read`, `storage.config_write`, etc.) can be force-enabled or force-disabled for a specific user, regardless of their role. Use this when the standard role permissions do not cover a specific scenario (for example, an operator who additionally needs the right to export sessions).

## Inviting a member

To add a new member to the team:

1. Click **"Invite"**.
2. Enter the invitee's email address.
3. Pick the role to assign to the user.
4. Confirm the invitation.

An email with a sign-in or sign-up link is sent to the supplied address.

### Managing invitations

The **"Invitations"** sub-section lists pending invitations. Available actions:

* **Resend** — if the email did not reach the recipient, the invitation can be sent again.
* **Revoke invitation** — removes the invitation from the pending list. After revocation, the link in the email becomes invalid.

## Changing a member's role

To change an existing member's role:

1. Find the user in the list.
2. Pick the new role from the drop-down (for example, promote to administrator or restrict to operator).
3. Save changes.

The new permissions take effect after saving. The user's current admin-panel session is refreshed on the next sign-in.

## Removing a member

To revoke a user's access to the admin panel:

1. Find the user in the list.
2. Click **"Remove"**.
3. Confirm the action.

After removal, the user can no longer sign in to this tenant's admin panel. Every action the user previously took remains in the [audit log](/one-kyc/admin/audit.md).

## Resetting a member's password

An administrator can reset another team member's password through `POST /v1/users/{user_id}/reset-password` (for example, after account compromise or loss of access). After the action, the member receives an email with a link to set a new password. The action is recorded in the audit log as `user.password_reset`.

{% hint style="info" %}
Team management and role changes are available only to users with the administrator role.
{% endhint %}