Organizations

An organization is your company's or team's account in fastmon. It holds the plan, billing, and members. Every site, invite, and notification rule belongs to exactly one organization.

What's on an organizationCopy Anchor Link

PlansCopy Anchor Link

A new organization starts on none and leaves it by exactly three routes: an approval starts its trial, a checkout buys a plan, or a partner provisions it.

The plan gates features and quotas, never which metrics are collected. features on the organization lists each feature as covered by a partner, granted by fastmon, included in the plan, or locked.

What a plan is measured in. The billed unit is the application, and only a production application takes a slot: a development application is free and unlimited. A plan includes a number of production slots and a monthly pageview volume; both can be extended with permanent add-ons bought in advance. Creating or promoting a production application past the included slots is refused with 402 app_limit_reached (see Errors), and an organization with no entitlement at all gets 402 billing_required or 402 trial_expired.

The pageview volume counts each stored pageview once, bots included. A sampled pageview counts as stored, not scaled up, and the last 15 minutes count once they are finalized. GET /organizations/{id}/usage answers it as pageview_count with its time_range.

E-invoices. Business customers in Germany, the Netherlands, and Belgium with a VAT id also get each invoice over Peppol. The VAT id is the Peppol identifier, so it has to match your registration.

RolesCopy Anchor Link

A role is a fixed bundle of permissions. A permission is one capability in resource:action form (analytics:read, release:write, member:manage); every API route names the one it needs, and the dashboard shows or hides actions by the same list. GET /permissions lists every permission with a description and the roles that hold it.

Billing is two permissions, not one role. billing:read opens the invoices, the billing address, and the VAT id; billing:manage moves the money.

The bundles nest: a member holds everything a viewer holds, an owner everything a member holds. Personal API keys are cut from the same bundles: a key's scopes are permissions, intersected with your current role on every request. An organization key belongs to the organization instead and stands on its scopes alone, capped at issue time. Managing organization keys and connected apps takes org_key:manage, which members and owners hold and viewers do not.

An organization can have several owners. Owners change roles under Members (PATCH /members/{member_id}); only an owner can hand out the owner role. The last owner cannot be demoted or leave while other members remain (last_owner). Transfer ownership hands the organization to another member in one step.

Partner accessCopy Anchor Link

In a client organization, a partner employee acts with the role they hold in the partner organization: owner, member, or viewer. With two agencies serving one client, the stronger role applies. A direct membership in the client wins.

Partner access can issue organization keys and connect org-owned apps in a client, such as the Shopware plugin through OAuth. Even an agency owner cannot do the following in a client:

• Delete it, remove its last member, transfer it, or manage its billing.
• Demote or remove its owners, or grant the owner role while it has an owner.
• Add members without an invite, or manage its partner links.
• Issue keys for the client's own clients.

Partner-minted credentials outlive the partnership. The client's key and connection lists mark them with via_partner_org_id, and detaching a partner lists them.

The client rotates the keys and disconnects the apps. A rotation by a client member clears the mark.

The partner.removed audit entry lists them as credentials_left. It shows in the audit logs of both organizations.

Common scenariosCopy Anchor Link

One product, one orgCopy Anchor Link

One organization, one billing relationship, several sites under it (acme-marketing, acme-app, acme-docs).

Multiple unrelated productsCopy Anchor Link

For two unrelated brands with separate billing and access, create two organizations. You can be a member of both.

Agency running client sitesCopy Anchor Link

Use the partner plan. Each client is a partner client: a sub-organization the agency runs. Agency users see all clients; the client sees only itself. A partner organization can also issue one API key that follows its client list instead of one key per client.

A partner covers features and pageviews per client with PATCH /organizations/{org_id}/partner/clients/{client_org_id}, within the contract at GET /organizations/{org_id}/partner/contract.

A member of the partner organization creates a client, hands it over with owner_email, and detaches it. A member of the client revokes the agency's access. Both need direct membership; see Partner access.

The Partnerfloor shows the live traffic of every client.

Common surprisesCopy Anchor Link

• The org switcher is just UI. API requests scope by the URL (/organizations/{id}/…), not by whichever tab you've got open.
• Members are global fastmon users. Inviting an existing user reuses their account.
• An invite waits on the account. Someone who signed up without the mail link finds their open invites on the start screen.
• Adding a member directly needs an owner. POST /organizations/{id}/members requires member:manage. Members invite instead, and an invite carries the role.
• Sites can't move between organizations. Ask support if you need this.

RelatedCopy Anchor Link

• Sites: the resources owned by an organization.
• API: Organizations endpoints: programmatic access.