​

organization

orc organization lists your Organizations, switches the CLI target, and manages organization settings, members, and invitations. You can change the organization name and Brand / Agency settings, update members’ organization roles, and send or revoke invitations.

Before running the command, authenticate with orc auth login. Switching organizations requires membership in the target organization and an available Workspace. API keys operate within the authenticated organization’s scope. To change your own display name, use orc profile.

use saves the CLI selection. It keeps the current Workspace if it belongs to the target organization; otherwise, it selects an available Workspace in the target organization. Directory Workspace links that do not belong to the target organization are removed.

List the IDs, names, and organization roles of your organizations.

Pass the organization ID from organization list to organization use. Organization names and slugs are not accepted. There is no interactive selection when the ID is omitted.

Switch organizations and check the selected organization and Workspace.

Switching retrieves your organization memberships and available Workspaces, validates the selected Workspace through the API, then saves it in the current CLI profile. If no Workspace is available in the target organization, the command returns an error without changing the selection. To select another Workspace, use list and use in orc workspace.

Select a Workspace in the same organization and optionally link it to the current directory.

Workspaces are resolved in this order: --workspace, ORCHESTOR_WORKSPACE_ID, the directory link, then the saved default. To specify a target for one API operation, use --workspace <workspace-id>. Switching organizations removes directory links that do not belong to the target organization. If ORCHESTOR_WORKSPACE_ID points outside the target organization, unset the environment variable before running the command again.

Saves the CLI selection using an organization ID. Keeps the current Workspace if it belongs to the target organization; otherwise, selects an available Workspace. Nothing is saved until membership checks and API validation succeed.

Save the CLI selection using an organization ID.

Displays the settings of the organization resolved from the current Workspace and your organization role. You can check the organization name, organization_type, slug, website_url, and member_count.

Display the organization settings resolved from the current Workspace and your organization role.

Updates the organization’s name, type, slug, and website_url. type is brand or agency. Omitted fields are preserved, and website_url can be cleared with null. Do not specify both type and the compatibility field organization_type.

Body field: name

Type: string. Optional.

Body field: slug

Type: string. Optional.

Body field: organization_type; enum: brand|agency

Type: string. Optional.

The agency Organization's own website URL. Brand Organizations may leave this null because the managed brand URL belongs to Workspace setup.; (use "null" or "reset" to clear)

Type: string. Optional.

Body field: type; enum: brand|agency

Type: string. Optional.

Update the organization’s name, type, slug, and website_url.

Lists invitation IDs, recipients, org_role, workspace_assignments, expiration, and status for the current organization. Filter with --state pending|accepted|expired|revoked. For the next page, pass the response’s next_cursor to --cursor; use --limit to set the number of items per page.

enum: pending|accepted|expired|revoked

Type: string. Optional.

List invitation IDs, recipients, org_role, workspace_assignments, expiration, and status for the current organization.

Invites one person using email and role in the request body. role is owner, admin, or member. The compatibility field org_role is also supported, but it cannot be specified alongside role with a different value. Only an owner can invite an owner. Recipients who are already members or have an active invitation are rejected.

Retry identity for operations that support idempotency. Use a unique key for each new operation, and reuse it only when retrying the same HTTP method, path, query values and exact request body. JSON whitespace changes can count as a different body. Keys contain 1–255 characters after trimming and expire after 24 hours. A completed JSON response is replayed without repeating the operation. A different request using the same key returns 409 idempotency_error. An in-progress request returns 409 idempotency_in_progress with Retry-After: 2. Whether this header is required depends on the operation.

Type: string. Optional.

(required) Body field: email; max 255 chars

Type: string. Optional.

Body field: org_role; enum: owner|admin|member

Type: string. Optional.

Body field: workspace_assignments; JSON array of objects (use --stdin for large resources)

Type: string. Optional.

Body field: role; enum: owner|admin|member

Type: string. Optional.

Invite one person using email and role in the request body.

Revokes a pending invitation using its ID from invites list. Invitations with accepted, expired, or revoked status cannot be revoked. To remove a member who has accepted an invitation, use members delete.

Revoke a pending invitation using its ID from invites list.

Lists the IDs, names, and organization roles of your organizations. Human accounts receive only active memberships; API keys receive the authenticated organization’s scope.

List the IDs, names, and organization roles of your organizations.

Lists user_id, first_name, last_name, and role for members with active membership in the current organization. The list is not limited to a single Workspace.

List user_id, first_name, last_name, and role for active members of the current organization.

Changes an organization role using the user_id from members list and role in the request body. role is owner, admin, or member. Only an owner can manage an owner, and demoting the last owner is rejected.

(required) Body field: role; enum: owner|admin|member

Type: string. Optional.

Change an organization role using user_id from members list and role in the request body.

Removes membership in the current organization and the associated Workspace access. Does not delete the account itself. Only an owner can remove an owner, and the last owner cannot be removed. The command asks you to confirm the target.

Remove membership in the current organization and its associated Workspace access.

The id from list is the organization ID to pass to use. The workos_organization_id from current represents the same organization identifier.

Check organizations and the current target.

Omitted name and type fields are preserved. type is brand or agency.

Prepare an organization settings update body.

For updates, --dry-run displays a request preview without calling the update API. It does not guarantee that server-side permission checks will succeed.

Inspect the organization settings request before updating.

Organization roles are owner, admin, and member. They are separate from Workspace roles.

Prepare a body to change an organization role.

Specify user_id from members list. Do not use a Workspace member ID or invitation ID.

Find the user ID in the member list and change the role.

Each operation invites one person. Granting an organization role and assigning Workspace access are separate inputs.

Specify the invitation recipient and organization role.

Creating an invitation is rejected if the recipient is already a member or has an active invitation. Check the API response for the successful invitation’s ID, status, and expiration.

Create an invitation and check pending invitations.

Organization roles are owner, admin, and member. Only an organization owner can invite, modify, or remove an owner. An admin can manage member and admin roles, but cannot grant or manage owner. Demoting or removing the last organization owner is rejected.

members delete removes membership in that organization and disables the Workspace access associated with the membership. It does not delete the account itself or membership in other organizations. When using workspace_assignments in an invitation, specify workspace_id and workspace_role in each item. Workspace roles are owner or member; Workspaces in other organizations cannot be assigned.

Specify an organization invitation and access to a Workspace in the same organization.

Lists, current organization details, and member lists are available within your authenticated membership scope. Updating organization settings requires the organization owner or admin role and workspace:settings permission. Invitation operations require the organization owner or admin role and workspace:invite permission. Updating or removing members requires the organization owner or admin role. Being a Workspace owner does not automatically grant organization management permissions.

The following global options can be used with orc organization:

For details and examples, see global options.

Check that you are specifying id from organization list and that an available Workspace exists in the target organization. Unset ORCHESTOR_WORKSPACE_ID if it points to another organization. You cannot switch beyond an API key’s organization scope. Sign in with a human account and run the command again.

Check role in organization current. Workspace management permissions and organization management permissions are separate. An admin cannot grant or manage owner, and the last owner cannot be removed. Use user_id from members list to identify a member.

You cannot create a duplicate invitation when the recipient is already a member or an active invitation remains. Check the status with invites list --state pending. Only pending invitations can be revoked. To remove a member who has accepted an invitation, use members delete.

DELETE operations require confirmation. For automated execution, verify the target ID and organization, then specify --yes. You can first inspect the target request with --dry-run.