> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hyperprop.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Team and roles

> Add and remove dashboard users, give them roles with exactly the access they need, and manage it all from your own admin tools with your API key.

Your team members sign in to the dashboard at `https://portal.hyperprop.com`.
What each person can see and do is set by their **role**. You can manage both
from the dashboard or with the API, for example to onboard staff from your own
HR or admin system.

Reading the team and roles works with a [read-only key](https://docs.hyperprop.com/authentication.md#read-only-keys);
changes need a full-access key.

## Roles

A role is a map of **permission domains** to a level: `none` (hidden),
`view` (read only) or `manage` (read and change).

| Domain | Covers |
| - | - |
| `analytics` | Analytics, firm P\&L and the audit log |
| `traders` | Traders, trading accounts, lockouts, purchases, balances and mass credit |
| `payouts` | Payout eligibility, payouts and payout history |
| `plans` | Trading plans and trading rules |
| `webhooks` | Webhook endpoints, deliveries, the event history and API logs |
| `operations` | Time Machine, reverting trading days and bulk updates |
| `billing` | Your Hyperprop invoices, credits, billing details and usage |
| `team` | Team members and roles |
| `settings` | Organization profile and API keys |
| `support` | Support tickets |

Every organization has four system roles you can assign but not change:

| Role | Access |
| - | - |
| Admin | Manage everything |
| Support | Manage traders, accounts and operations; view payouts, plans and analytics; no billing, team or settings |
| Finance | Execute payouts; view billing, analytics, accounts and operations |
| Audit | View everything, change nothing |

`GET /organization/roles` lists the system roles and your custom roles with
their permission maps.

### Create a custom role

```bash theme={null}
curl -X POST "https://api.hyperprop.com/platform/v1/organization/roles" \
  -H "X-API-Key: hp_live_your_key_here" \
  -H "Idempotency-Key: role-payout-desk" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Payout Desk",
    "description": "Reviews and executes payouts only",
    "permissions": { "payouts": "manage", "traders": "view", "analytics": "view" }
  }'
```

A domain you leave out is `none`. Change a custom role with
`PATCH /organization/roles/{roleId}`; members with that role get the new access
on their next request. Delete it with `DELETE /organization/roles/{roleId}`
once no member has it.

## Team members

`GET /organization/team` lists members with their role (`roleId`,
`roleName`) and resolved `permissions`.

### Add a member

```bash theme={null}
curl -X POST "https://api.hyperprop.com/platform/v1/organization/team" \
  -H "X-API-Key: hp_live_your_key_here" \
  -H "Idempotency-Key: hr-employee-1042" \
  -H "Content-Type: application/json" \
  -d '{ "email": "alex@example.com", "fullName": "Alex Morgan", "roleId": "66666666-6666-4666-8666-666666666666" }'
```

For an email that is new to Hyperprop, a dedicated login is created and the
response contains a temporary password in `tempPassword`, **shown once**.
Share it with the person through a secure channel; they should change it after
signing in. If the email already has a Hyperprop login, it is linked instead
(`linkedExisting: true`, no temporary password). An email that is already a
staff login at another organization returns `409 EMAIL_IN_USE`.

### Change a role, reset a password, remove a member

| Action | Request |
| - | - |
| Change role | `PATCH /organization/team/{memberId}` with `{ "roleId": "..." }` |
| New temporary password | `POST /organization/team/{memberId}/reset-password` (returned once) |
| Remove | `DELETE /organization/team/{memberId}`: their access ends immediately |

To keep your organization manageable, you cannot demote or remove the last
member who can manage the team.

## People versus API keys

Roles apply to people signed in to the dashboard. [API keys](https://docs.hyperprop.com/authentication.md)
are not team members and have no role: a full-access key can call every
endpoint, and a read-only key can call every `GET` endpoint. If your own tool
lets several people act through one key, enforce who may do what inside your
tool.

Changes to trading accounts are recorded in the audit log
(`GET /organization/audit-log`) with who made them: the team member's email,
or the API key.


## Related topics

- [Change a team member's role](https://docs.hyperprop.com/platform-api/team-and-roles/change-a-team-members-role.md)
- [Add a team member with a role](https://docs.hyperprop.com/platform-api/team-and-roles/add-a-team-member-with-a-role.md)
- [Remove a team member](https://docs.hyperprop.com/platform-api/team-and-roles/remove-a-team-member.md)
- [Create a custom role](https://docs.hyperprop.com/platform-api/team-and-roles/create-a-custom-role.md)
- [List roles (system presets + your custom roles)](https://docs.hyperprop.com/platform-api/team-and-roles/list-roles-system-presets-+-your-custom-roles.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.