# Team access and partner support

> Manage partner members, roles, permissions, active sessions, MFA policy, and SLA-governed support cases.

MyStocks separates **human console access** from **machine API access**. Human members receive roles and
permissions through the partner organization. Service credentials continue to use API scopes. A console
request is permitted only when its current member permission, underlying credential scope, organization
security policy, and environment policy all allow the operation.

## Default roles

| Role | Intended responsibility |
| --- | --- |
| Organization Owner | Ownership, team, security, credentials, operations, and all evidence |
| Administrator | Team, integration, customer, and operational administration |
| Developer | API credentials, webhooks, sandbox, audit diagnostics, and technical support |
| Operations | Accounts, orders, reconciliation, corporate actions, and voting |
| Compliance | KYC, restrictions, compliance evidence, and audit review |
| Treasury | Funding, payouts, float, FX, and reconciliation |
| Finance | Billing, invoices, fees, tax, and financial reports |
| Support Agent | Customer and support-case assistance without money movement |
| Auditor | Read-only operational, security, report, and audit evidence |
| Viewer | General read-only dashboard access |

Enterprise organizations may create custom roles from the published permission catalogue. The server is
deny-by-default: hiding a dashboard control is not used as authorization.

## Member lifecycle

Use **Team & Access** in the partner dashboard to invite a verified email, assign a role, suspend access,
restore access, or review active sessions. Invitations expire after seven days. A member accepts an invite
by signing in with the invited, verified email. Suspending or removing a member revokes every active console
session immediately.

The final active Organization Owner cannot be removed or demoted. Only an Owner can grant the Owner role.
Existing single-user partner accounts are automatically migrated: the current credential owner becomes the
initial Organization Owner on their next successful console session.

## Sessions and MFA

Console sessions expire after one hour and are backed by a separately revocable session record. Team
administrators can inspect session email, IP, user agent, creation time, expiry, and last activity, then revoke
any non-current session. Role and permission changes are read from the current member record on every API
request, so access reductions do not wait for token expiry.

An Organization Owner can require MFA for privileged roles: Owner, Administrator, Treasury, and Compliance.
When enabled, a privileged member cannot mint a console session unless Firebase Authentication confirms a
second factor.

## Partner support centre

The **Help & Support** dashboard provides organization-scoped cases with:

- P0–P3 severity and tier-specific acknowledgement deadlines;
- API request, order, sub-account, and transaction references;
- production or sandbox environment classification;
- partner-visible conversation history and HTTPS attachment references;
- `WAITING_ON_PARTNER` and `WAITING_ON_MYSTOCKS` ownership states;
- acknowledgement and next-update clocks;
- MyStocks assignment, escalation, resolution, and closure evidence.

P0 cases are automatically marked for escalation. Never include API keys, authentication tokens, identity
documents, or unredacted payment credentials in a support message or attachment.

## Console-only endpoints

These endpoints require a short-lived partner-console session. Raw API credentials cannot administer human
access or create cases on behalf of a person. Every mutation requires an `Idempotency-Key`.

| Endpoint | Required permission |
| --- | --- |
| `GET /team` | `members.read` |
| `POST /team/invites` | `members.invite` |
| `PATCH /team/members/{memberId}` | `members.manage` |
| `GET /team/roles` | `roles.read` |
| `POST /team/roles` | `roles.manage` |
| `GET /sessions` | `security.read` |
| `DELETE /sessions?id=...` | `security.manage` |
| `GET /support` | `support.read` |
| `POST /support` | `support.create` |
| `POST /support/{ticketId}/messages` | `support.create` |

See [Enterprise security](/partners/docs/enterprise-security), [SLA](/partners/docs/sla), and
[Key management](/partners/docs/key-management).