> For the complete documentation index, see [llms.txt](https://docs.kyvvu.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kyvvu.com/platform/organizations.md).

# Organizations & Access

**What you'll learn:** How organizations, members, and access control work in the Kyvvu platform.

***

## Organizations

Every Kyvvu account belongs to an organization. All data (agents, policies, logs, incidents) is isolated to the authenticated user's organization. There is no cross-organization data access.

When you sign up on the dashboard, your organization is determined by your email domain. Users with the same email domain are grouped into the same organization. `kyvvu auth` logs an existing account into the CLI via a device code — it doesn't create the account or change its organization.

## Member roles

| Role       | Capabilities                                                                          |
| ---------- | ------------------------------------------------------------------------------------- |
| **Admin**  | Full access: manage members, create/delete agents, manage policies, view all data.    |
| **Member** | Create agents, view data, manage own API keys. Cannot manage org settings or members. |

## Member verification

New members require verification before they can create agents or API keys:

1. User signs up → account created, marked as **pending**.
2. An org admin verifies the member via the dashboard or API.
3. Once verified, the member can create agents and API keys.

If `kyvvu whoami` (or `kyvvu auth`) shows "pending verification," contact your org admin.

### Registration cap

The platform has an early-access registration cap (`KV_REGISTRATION_CAP`). When the cap is reached, new accounts are created but **waitlisted**. Waitlisted users receive a message:

```
Kyvvu is in early access — we're actively managing growth.
Your account has been created and you're on the waitlist.
We'll contact you at you@company.com when your account is ready.
```

## Dashboard management

1. Navigate to **Organization** in the sidebar.
2. **Members** tab — view all members, their roles, and verification status.
3. Click a member to:
   * **Verify** — approve a pending member.
   * **Change role** — promote to admin or demote to member.
   * **Remove** — revoke access.

## API endpoints

| Method   | Path                                      | Description               |
| -------- | ----------------------------------------- | ------------------------- |
| `GET`    | `/api/v1/orgs`                            | List organizations.       |
| `GET`    | `/api/v1/orgs/{org_id}`                   | Get organization details. |
| `GET`    | `/api/v1/orgs/{org_id}/members`           | List members.             |
| `POST`   | `/api/v1/orgs/{org_id}/members`           | Invite a member.          |
| `PATCH`  | `/api/v1/orgs/{org_id}/members/{user_id}` | Update role or verify.    |
| `DELETE` | `/api/v1/orgs/{org_id}/members/{user_id}` | Remove member.            |
| `GET`    | `/api/v1/orgs/{org_id}/stats`             | Organization statistics.  |

## API keys

API keys authenticate agents with the platform. Manage them via the dashboard (**Organization** > **API Keys**) or the API:

| Method   | Path                             | Description                 |
| -------- | -------------------------------- | --------------------------- |
| `POST`   | `/api/v1/auth/api-keys`          | Create a new API key.       |
| `GET`    | `/api/v1/auth/api-keys`          | List API keys.              |
| `PATCH`  | `/api/v1/auth/api-keys/{key_id}` | Enable/disable a key.       |
| `DELETE` | `/api/v1/auth/api-keys/{key_id}` | Revoke (soft-delete) a key. |

API keys are prefixed with `KvKey-` and are shown only once at creation time.

***

## Next steps

* [Dashboard Guide](/platform/dashboard.md) — navigate the platform
* [Incident Management](/platform/incidents.md) — triage policy violations
* [Configuration Reference](/deployment/configuration.md) — environment variables including registration cap