Members, Invitations & Offboarding

This guide covers the full lifecycle of a person in your organization: joining, changing roles, being suspended, and leaving. Every action here has teeth: it takes effect immediately, it is enforced on the server, and it is recorded in the audit trail.

After reading this page you will be able to: invite someone at the right role and know exactly what the invite link can and cannot do, keep a pending invitation moving with a resent email or a fresh link, read the member list like a dashboard, suspend or remove a person and know with certainty that their access ended the moment you clicked, reset a locked out member without ever touching their credentials, and run a complete offboarding you can prove to an auditor.

The Members Screen

Open Settings → Members (part of the IAM area, alongside Roles, Groups, and Departments). The member list shows every person with their role and status, filterable by both, with pagination for large teams. Suspended members remain visible in the list, clearly marked, so nobody silently disappears from view while their case is open. Selecting a member opens their detail page with role controls, status controls, reset actions, and their recent activity.

Inviting People

Invitations are how people join your organization. You pre-authorize the role before the person ever signs in, so there is no window where a new member has more access than you intended.

1. In the Members screen, press Invite Member and enter the person’s email address and the role they should hold. Optionally assign them an organization mailbox at the same time.
2. Leave Email the invitation checked (the default) and press Create Invitation. Backbuild emails the invitee an invitation that names your organization, who invited them, and the role, with an Accept invitation button. The dialog confirms the email went out and also shows the single-use acceptance link with a Copy link button, so you can share it over another channel you trust as well. Uncheck Email the invitation when you would rather deliver the link yourself.
3. If the email cannot go out, the invitation is still created: the dialog says why (Backbuild stopped mailing that address because earlier mail to it bounced or was reported as spam, your organization reached its daily email limit, or the send failed) and shows the link for you to share instead.
4. The invitee opens the link and completes onboarding. When they finish, they are a member at exactly the role you chose.

An address can have one live invitation to your organization at a time. Creating a second invitation for an address that already has a pending one is refused; use Resend email or Copy new link on the existing invitation instead. If the earlier invitation has expired, a new invitation to the same address simply replaces it.

What the acceptance link is, and is not

The acceptance link is built for the exact failure everyone fears with invite links: forwarding. It is:

• Single use. It grants one membership, once.
• Locked to the first browser that uses it. The link binds to the browser in which someone first acts on it, by requesting the verification code or accepting while signed in. Simply opening it, as email security scanners and link previews do, does not bind it. A copy forwarded after that is dead on arrival, and even the first user must prove they control the invited mailbox.
• Expiring. A link lasts 7 days from the moment it was created. An expired link cannot be used, but the invitation is not lost: renew it from the Pending Invites tab with Resend email or Copy new link, which issue a new link with a fresh 7 days.
• Replaced, never repeated. Every Resend email or Copy new link creates a brand-new link and ends every earlier link for that invitation at once, so only the most recent link you sent can be used.
• Revocable. Revoke any pending invitation from the pending list at any moment, and the link stops working immediately. The pending list never displays the link’s secret, so an invitation cannot leak from the admin screen after the fact.

Combine invitations with the allowed email domains policy when you want a hard guarantee that only company addresses can ever join.

Managing pending invitations

The Pending Invites tab on the Members screen lists every invitation still waiting to be accepted, including those whose link has expired. Each row shows the invited address, the role, when it was invited, when its current link expires, and a status badge:

• Pending: the current link works until the time shown after Expires.
• Expired: the 7 days ran out. The invitation can still be renewed with either of the two buttons below.
• Opened: someone has acted on the current link (requested the verification code, or accepted while signed in), so that link is now locked to their browser.

Each row offers three actions:

• Copy new link creates a fresh acceptance link, copies it to your clipboard, and shows it in a dialog with a Copy button in case the clipboard was unavailable. Share it with the invitee over a channel you trust.
• Resend email emails the invitee a fresh link and confirms on screen. If the email cannot go out, the screen says why and opens the same link dialog so you can share the new link yourself.
• Revoke cancels the invitation, and its link stops working immediately.

Copy new link and Resend email always create a new link, and every earlier link for that invitation stops working the moment they do. There is no button that shows the current link again, by design: Backbuild keeps no readable copy of an invitation link once it has been handed to you, so it makes a new one instead of revealing an old one.

Both actions also give the invitation a clean restart. The new link gets a full 7 days; it is not locked to any browser, so an invitation that was opened in the wrong browser works again in the invitee’s own; and you become the invitation’s inviter, so a resent email names you. That last point matters because an invitation stops working once the person who sent it has been removed from the organization, or no longer holds a role at or above the one it grants. Renewing it under your name restores it.

Anyone who can manage members can use these actions, but only on invitations whose role is at or below their own: the same ceiling that applies when creating an invitation. Every new link and every resend is recorded in the audit trail.

Email limits. Resend email can be used up to 5 times per invitation per hour, and your organization can send up to 100 invitation emails per hour across new invitations and resends. New invitations also send at most 10 invitation emails per hour to any one address. When a limit is reached, nothing changes (no link is replaced and no invitation is created) and the screen tells you how many minutes to wait. Copy new link sends no email, so these limits never block it.

What the invitee experiences

The invitation email names your organization, the person who invited them, and the role, and carries an Accept invitation button plus the plain link. It asks them to accept within 7 days and tells them they can ignore it if they were not expecting it.

A brand-new invitee is walked through account setup on the acceptance page itself: they choose a sign-in password and a separate master password for their secrets vault, then land in your organization at the assigned role. If they were also assigned an organization mailbox, it is ready when they arrive: that mailbox address both receives their organization mail and is a sign-in credential for their account, so they can sign in with it as well.

An invitee whose email already has a Backbuild account keeps their existing credentials: the platform will never re-credential an existing account from an invite link. The setup page offers I already have a Backbuild account: sign in from the start. They sign in as themselves, the acceptance binds the membership to their account, and Backbuild switches them into your organization so they land there at the role you chose. Existing users skip any onboarding step they have already completed.

When an invitation goes wrong

Almost every invitation problem is fixed from the Pending Invites tab without starting over. When a link does not work, the invitee’s page names the reason, so ask them what it says:

On your side of the invitation:

• “They never got the email”: confirm the address on the Pending Invites tab, ask them to check spam and quarantine folders, then press Resend email. If the email cannot go out, the screen says why and gives you the new link to share another way.
• You lost the link: a link is shown only when it is created. Press Copy new link (or Resend email) to issue a new one; the lost link stops working at the same moment.
• A new invitation is refused as a duplicate: that address already has a live pending invitation. Use Resend email or Copy new link on it instead.
• The screen says there were too many emails: an email limit was reached (see Managing pending invitations). Wait the minutes the screen shows, or use Copy new link, which sends no email. When creating an invitation, you can also uncheck Email the invitation and share the link yourself.
• The person who sent it has left: once its inviter is removed from the organization, an invitation can no longer be accepted. Press Resend email or Copy new link; you become the inviter and it works again.
• They already have a Backbuild account: expected. They press I already have a Backbuild account: sign in on the setup page, sign in with their own credentials, and the invitation is accepted for that account.

Changing Roles

Change a member’s role from their detail page. Three server-side rules protect you from the classic role-change accidents:

• Hierarchy ceiling: you can only assign roles at or below your own level. An admin cannot mint an owner, and nobody can promote past themselves.
• Last-owner protection: the platform refuses to demote or remove the only owner, so an organization can never be orphaned.
• No self-service escalation: you cannot change your own role from the admin surface.

What each role can do, and how groups and departments layer on top, is covered in Roles, Groups & Permissions.

Member States: Active, Suspended, Archived, Removed

This table is the contract. Each state is enforced server-side the instant you set it.

Suspending and archiving both require a written reason, which lands in the audit trail alongside the action. Removal is a standard removal that ends the membership while preserving everything the person created. For the rare case where you must also strip the person’s organization-assigned artifacts, a separate force removal additionally deletes their assigned organization mailboxes and aliases, revokes their pending invitations, and ends their organization sessions, with an optional audit reason recorded on the action.

In every state and every removal flavor, the person’s global Backbuild account is untouched. You are managing their membership in your organization, not their identity. Their memberships in other organizations are unaffected.

The session guarantee

When you suspend, archive, or remove a member, their organization-scoped sessions are revoked immediately, on all devices, including API access held under that membership. There is no “until they sign out” window and no lingering token that keeps working. This is the guarantee that makes a 2 a.m. offboarding safe to do from your phone.

What happens to their work

Nothing they created is deleted by suspension or removal. Documents, entities, tasks, and messages remain in the organization, attributed to the person who made them, and the audit history stays intact. If the person owned projects, add a new project owner to each of those projects (see Projects) as part of offboarding.

Admin Resets: Password and Two-Factor

Both resets are designed so the admin never sees, sets, or transmits a credential:

• Password reset: triggers the member’s standard self-service reset email. You do not choose their password and you are never shown anything secret. The action reports success without disclosing account details, and the member takes it from there.
• Two-factor reset: for the “lost my phone” case. It un-enrolls the member’s second factor and revokes their sessions; at their next sign-in they must enroll a new second factor before proceeding. There is no state where the account continues without 2FA if your organization enforces it.
• Neither action can be aimed at yourself from the admin surface; manage your own credentials from your personal security settings.
• Both actions are audit-logged with the acting admin, target, and timestamp.

The Per-Member Activity Trail

Each member’s detail page includes their recent organization-scoped activity: what they touched, when, and from where. Use it to answer “what did this account do” during an investigation, to spot a dormant account before an access review, or to hand an auditor evidence for a specific person without exporting the world.

The Offboarding Runbook

Run these steps in order when someone leaves. The order matters: suspending first ends access instantly while everything else is still in place to review.

1. Suspend the member. Access and sessions end immediately; their data and assignments stay visible for the handover.
2. Reassign ownership. Add new owners to any projects they owned and reassign their open tasks.
3. Check their trail. Skim the member’s activity feed for anything that needs follow-up.
4. Revoke pending invitations they created, if any are still open in the pending list. If one of them should still go ahead, press Resend email or Copy new link on it instead: you become its inviter, so it keeps working after they are removed.
5. Remove the member (or force-remove if their org mailboxes and aliases must go too).
6. Verify. Confirm they are gone from the member list and that the removal appears in the audit trail. Their seat is now free.

Total time: minutes. Every step is logged, so the runbook doubles as your compliance evidence for the departure.

Frequently Asked Questions

If I remove someone, do they lose access immediately?
Yes. Sign-in to the organization is blocked and their org sessions are revoked at that moment, on every device, API access included.

What is the difference between suspending and removing? Which frees a seat?
Suspension blocks access but keeps the membership, visible and reversible, which is right for investigations and leave. Removal ends the membership and frees the seat. Both end sessions immediately; neither deletes any content.

What happens to everything a removed person created?
It stays, attributed to them. Removal never deletes work product. Assign new owners for anything they owned as part of the runbook above.

Does Backbuild email the invitation for me?
Yes, by default. The invitee gets an email with an Accept invitation button, and you also get the link in the dialog in case you want to share it another way. Uncheck Email the invitation to deliver the link only yourself.

Someone says their invite link is expired. What do I do?
Open the Pending Invites tab, find the invitation (it shows Expired), and press Resend email, or Copy new link to share it yourself. Either one issues a fresh link that lasts 7 days, and the old link stops working. You do not need to revoke it or create a new invitation.

Can I copy the link I already sent?
No, deliberately. Backbuild keeps no readable copy of an invitation link, so a link cannot leak from the admin screen later. Copy new link gives you a new one and retires the old.

Can a forwarded invite link let the wrong person in?
The link locks to the first browser that uses it, and setting up an account also requires a code sent to the invited address. It grants exactly one membership at the role you pre-authorized. If the wrong person opened it, revoke it; and with an allowed-domains policy, off-domain addresses cannot join at all.

Can I reset a member’s password for them?
You can trigger their self-service reset, which is the point: an admin never holds a member’s credential, so there is nothing to leak, reuse, or subpoena from the admin side.

Does removing someone delete their Backbuild account?
No. Membership and account are different things. You end their membership in your organization; their account and their other memberships are untouched.

API Reference

• GET /v1/organizations/:orgId/members: list members with role and status filters (paginated)
• POST /v1/organizations/:orgId/members: add or update a member with a role
• DELETE /v1/organizations/:orgId/members/:userId: remove a member (content preserved)
• POST /v1/organizations/:orgId/members/:userId/status: set active, suspended, or archived (reason required for non-active)
• POST /v1/organizations/:orgId/members/:userId/reset-password: trigger the member’s self-service reset
• POST /v1/organizations/:orgId/members/:userId/reset-2fa: un-enroll the member’s second factor and revoke sessions
• GET /v1/organizations/:orgId/members/:userId/activity: the member’s recent org-scoped activity
• POST /v1/organizations/:orgId/member-invites: create an invitation; emails it by default (send_email, default true), reports whether the email went out, and returns the single-use acceptance link once
• GET /v1/organizations/:orgId/member-invites: list invitations with their status and expiry (the token is never returned)
• POST /v1/organizations/:orgId/member-invites/:inviteId/link: issue a new acceptance link, returned once; every earlier link for the invitation stops working
• POST /v1/organizations/:orgId/member-invites/:inviteId/resend: email the invitee a new acceptance link; earlier links stop working, and the link is returned only when the email did not go out
• POST /v1/organizations/:orgId/member-invites/:inviteId/revoke: revoke a pending invitation

See the API Reference for complete request and response documentation.