Workspaces, roles & teams

A workspace (called an organization in some API paths) is the unit of access: it has one plan, one Balance, one team and its own API keys, audit log and settings. Its plan is one it pays for, or one another workspace you own pays for and covers it with (Pro 3, Team 10 and Scale 25 workspaces per subscription, Billing → Workspaces). Signing up creates your personal workspace; create more from the workspace switcher. How many you can own depends on the best plan among them.

Free limits are per person, across all your free workspaces. A paid plan's limits are shared across the workspaces it covers. A second free workspace shares the first one's allowance: every Hobby count (projects, functions, databases, team members, emails and the rest) is the total across the free workspaces its owner owns.

Roles

Role	Can
Owner	Everything, including the plan, cards, the Balance, spending limits, withdrawals and refunds, requiring two-factor sign-in of every member, and deleting the workspace.
Admin	Members and invitations, API keys (create, give an expiry date, pause, revoke), workspace settings (CDN, Shield, AI Gateway models, mail controls), the audit log, reading billing, deleting projects.
Developer	Create, change and delete resources and deployments; read environment variables, function source and stream keys.
Viewer	Read only — no environment variables, secrets or function source.

Team members

Admins invite by email. The invitation is emailed, and accepting it needs a verified email at the invited address.
Seats per plan: 3 hobby, 10 pro, 25 team, 100 scale. Pending invitations hold a seat; a full workspace answers 402 plan_limit, and accepting re-checks. On Hobby the seats are people across all the owner's free workspaces. On a paid plan they are per workspace, even when one plan covers several.
Removing a member lists the API keys they created so you can revoke them.

An owner can require two-factor sign-in of every member: Settings → Workspace, or PUT /api/orgs/:id/security { requireMfa: true }, signed in to the dashboard (an AI connector is answered 403 dashboard_only). The owner needs two-factor on their own account first, so the rule can never lock them out.
While it is on, a member without two-factor is refused on everything that acts in the workspace, from the dashboard, the API or a connector, with 403 workspace_requires_mfa and where to turn it on. Their own account pages stay open, and they can still leave the workspace.
API keys belong to the workspace, not to a person, and keep working. GET /api/orgs/:id/security says whether the rule is on; owners and admins also see which members have no two-factor yet.

What lives where

In the workspace: the plan, Balance and cards, members, API keys, the audit log, domains bought, repos, the mail log and settings, and CDN, Shield and AI Gateway settings.
In a project: its site or app, environment variables, custom domains, and its databases, buckets, functions, vector collections, memory stores, agents, auth pool, payment account and media.

Deleting a workspace or account

Deleting a workspace cancels its subscription immediately (no proration refund) and tears down every project. Workspaces its plan covered move to Hobby (or to a complimentary plan they still have); nothing in them is deleted.
It is refused while the workspace owns unexpired bought domains (transfer them out, or turn off auto-renew and let them lapse), has a domain transfer, refund or Balance top-up in progress, or holds project earnings.
A positive Balance is given up, not refunded, and only when you say so: send { "confirmForfeit": true } (the first answer is 409 confirm_forfeit_required).
Deleting your account (DELETE /api/auth/me { password, confirmForfeit? }) applies the same rules to every workspace it removes.

Reference

REST

GET    /api/orgs                        # your workspaces
POST   /api/orgs                        { "name" }                              # browser session
GET    /api/orgs/:id/members · PATCH · DELETE                                    # admin to change
POST   /api/orgs/:id/invitations        { "email", "role": "admin"|"developer"|"viewer" }
GET    /api/orgs/:id/security · PUT { "requireMfa": true|false }               # owner, signed in, to change
DELETE /api/orgs/:id                    { "confirmForfeit"? }                   # owner