Skip to main content
Your workspace has roles, an editable permission matrix, and optional teams. This page explains the model so the API’s 403 and 404 responses make sense.
Team and role management happens in the dashboard, not the API. GET /v1/members reads the roster; inviting teammates and editing permissions are dashboard actions.

​
Roles

Every workspace keeps at least one Company Admin — the last one can’t be demoted or removed.

​
The permission matrix

Four toggles. Admins can change the Developer and Recruiter columns from Settings → User roles; the Admin column is fixed. These are only the defaults — your workspace may have customized them, so check Settings → User roles for what’s actually enabled. Customizations are stored as a diff from the defaults, so a workspace that never changes them picks up improvements automatically.

​
How teams scope access

A team groups members. Teams are opt-in: a workspace with no teams behaves as if everyone can see everything their role allows. Once teams exist, a non-admin can reach an assessment or report when any of these holds:
1

They created it

Your own work is always yours.
2

They share a team with the creator

…and their role’s shared-access level permits it.
3

The creator is on no team

Unassigned work stays visible workspace-wide, so putting one person on a team doesn’t hide everyone else’s work.
Sharing is computed, not stored — content is shared “within the creator’s teams”, so moving someone between teams re-scopes their work immediately.

​
What this means for the API

An API key inherits the role of the member who created it. A key created by a Recruiter carries Recruiter permissions.
Scope and permission are two different gates, and both apply. A write-scoped key created by a Recruiter gets 403 on POST /v1/assessments — the scope allows writes, the role doesn’t allow that particular one.
How the failures look:
For an integration that should see everything in the workspace, have a Company Admin create the key. A key made by a team-scoped member sees only what that member sees, which is usually a surprise when a nightly export quietly returns fewer rows than expected.