# Organization administration

> Manage members, duplicate users, routing integrations, templates, and API keys.

This is the machine-readable version of this Firewatch documentation page.

## Access roles and responder seats

Organization administrators can invite members, promote or demote
administrators, and remove members. Invitations are single-use and expire.

Firewatch stores two independent membership settings:

- **Access role:** an Administrator can manage organization configuration;
  a Member has normal product access.
- **On-call access:** a Responder can own services, join schedules, receive
  overrides, and participate in shift trades; a Collaborator can view and
  collaborate without being eligible for paging.

An administrator can be either a responder or collaborator. This keeps a
billing or security administrator free when they never participate in on-call.
Firewatch Cloud counts responder memberships as paid seats; collaborator
memberships are free.

For Firewatch Cloud, assigning responder access at any point counts as one paid
responder seat for the full billing month. Changing that person back to a
collaborator does not remove the charge for that month. This prevents rapid role
changes from bypassing seat billing.

Members can invite free collaborators. Only administrators can add a responder,
invite another administrator, or change on-call access.

Before changing a responder to a collaborator, remove their service ownership,
schedule participation, overrides, and pending shift trades. Firewatch rejects
the change while any routing reference remains.

Firewatch blocks removals that would leave active product records without a
valid owner or responder. Resolve those references before trying again.

Only administrators can change roles, merge users, configure organization
integrations, edit alert templates, or manage API keys.

## Merge duplicate users

Use **Organization → Members → Merge duplicate** when two active accounts
represent the same person after an identity-provider change or duplicate
registration.

Choose:

- the **source** account that will be retired; and
- the **target** account whose profile and email will remain.

Enter the target email exactly to confirm. Firewatch then:

- preserves the stronger administrator role;
- transfers non-duplicate service ownership and schedule participation;
- transfers schedule overrides, external-login records, passkeys, and claims;
- transfers the Slack mapping when it does not conflict;
- adopts the source's verified phone only when the target lacks one;
- retains responder access when either merged account was a responder;
- redirects existing merged-user references to the target; and
- disables and audits the source account.

Both accounts must be active, email-confirmed members of only the current
organization. The source cannot be the administrator's current session. Resolve
pending invitations and source-account shift trades first, and keep the combined
passkey count at ten or fewer.

Merging is not a reversible UI operation. Confirm the retained account and email
carefully.

## Slack workspace

When the deployment has a Slack app configured, open **Organization →
Integrations** and select **Add to Slack**. A Slack administrator must approve
the requested bot scopes.

Synchronization compares current, verified Firewatch member emails with Slack
and stores immutable Slack user IDs. Firewatch:

- does not import the Slack directory as Firewatch users;
- does not guess using display names; and
- sends alerts by direct message, not by mentioning a person in a shared
  channel.

Unmatched members continue to receive their other available channels. Re-run
synchronization after membership or Slack-email changes.

Slack interaction requests are validated with Slack's timestamped signature.
Acknowledge and resolve buttons update Firewatch, then the worker updates the
original alert message and adds lifecycle context.

## Alert templates

Open **Organization → Alert templates** to customize plain-text email subject
and body, SMS, voice, Slack, and webhook wording.

Templates use only the variables shown in the page. They cannot execute code,
read secrets, or emit arbitrary email HTML. Firewatch validates length and
syntax before saving and safely creates the email HTML alternative.

Use **Restore defaults** to remove the organization customization.

## Outbound webhooks

An organization can configure up to ten signed delivery endpoints. The signing
secret appears only at creation or rotation. Pausing an endpoint retains its
configuration without sending new deliveries.

Rotation invalidates the previous secret immediately. See
[Outbound alert webhooks](/docs/integrations/outbound-webhooks/) for signature
verification and destination restrictions.

## API keys

Organization API keys authenticate machine integrations such as alert adapters.
The full secret is shown only when created; Firewatch stores a non-reversible
validation value.

Keep keys in a secret manager, use separate keys for separate senders, and
revoke a key when its owner or purpose changes. An organization API key is not a
global Firewatch administrator credential.

## Self-hosted provider settings

Self-hosted administrators can revisit **Admin settings** after the initial
setup. The page detects email, Twilio, and Slack status and generates the
environment changes selected by the administrator.

The UI does not write the host's `.env` file. Copy the generated values into
deployment secret storage, run `docker compose up -d`, then re-check the status.
Firewatch Cloud does not expose provider credentials to customer
administrators.