Invite and manage your team

Everything here is under Team in the dashboard and needs the admin role. No email is sent by ProbeRun: you tell the invitee to sign in.

Invitations

Invite an address with a role. The invitation expires after 14 days; re-inviting after expiry works, and the expired row is superseded.
Only one outstanding invitation per address; inviting again while one is outstanding is refused (invitation_outstanding). Revoke it first.
The invitee claims it by signing in through your IdP with a verified email that matches, from the IdP the invitation was created under. See federated login for what “verified” means and the per-tenant escape hatch.
Revoking an invitation is immediate.

Team → Settings can let people join without an invitation: JIT provisioning (anyone from your organization who signs in) and admission groups (people in one of the listed IdP groups). When the deployment’s sign-in service is shared by many organizations, these only work once the operator has bound your tenant to your organization; until then, turning them on is refused with org_binding_required. See federated login.

Roles

Three nested roles: viewer < developer < admin. Change a member’s role under Team → Members; it applies on their next request, because the API reads role from ProbeRun’s database every time rather than from the session.

You cannot demote or remove the last admin (last_admin). Promote someone else first.

Removing a member

Removing a member takes effect on their next request: their session no longer resolves to a membership (member_removed). It does not sign them out of your IdP, and it does not end an already-open dashboard session at the IdP level, which lasts up to AUTH_SESSION_MAX_AGE_HOURS (default 8). If your offboarding depends on the IdP alone, add removal in ProbeRun to the runbook.

How many members

There is no member limit in the current build; invite as many members as you need.

What is recorded