Team access and partner support

MyStocks separates human console access from machine API access. Human members receive roles and permissions through the partner organization. Service credentials continue to use API scopes. A console request is permitted only when its current member permission, underlying credential scope, organization security policy, and environment policy all allow the operation.

Default roles

Enterprise organizations may create custom roles from the published permission catalogue. The server is deny-by-default: hiding a dashboard control is not used as authorization.

Member lifecycle

Use Team & Access in the partner dashboard to invite a verified email, assign a role, suspend access, restore access, or review active sessions. Invitations expire after seven days. A member accepts an invite by signing in with the invited, verified email. Suspending or removing a member revokes every active console session immediately.

The final active Organization Owner cannot be removed or demoted. Only an Owner can grant the Owner role. Existing single-user partner accounts are automatically migrated: the current credential owner becomes the initial Organization Owner on their next successful console session.

Sessions and MFA

Console sessions expire after one hour and are backed by a separately revocable session record. Team administrators can inspect session email, IP, user agent, creation time, expiry, and last activity, then revoke any non-current session. Role and permission changes are read from the current member record on every API request, so access reductions do not wait for token expiry.

An Organization Owner can require MFA for privileged roles: Owner, Administrator, Treasury, and Compliance. When enabled, a privileged member cannot mint a console session unless Firebase Authentication confirms a second factor.

Partner support centre

The Help & Support dashboard provides organization-scoped cases with:

• P0–P3 severity and tier-specific acknowledgement deadlines;
• API request, order, sub-account, and transaction references;
• production or sandbox environment classification;
• partner-visible conversation history and HTTPS attachment references;
• WAITING_ON_PARTNER and WAITING_ON_MYSTOCKS ownership states;
• acknowledgement and next-update clocks;
• MyStocks assignment, escalation, resolution, and closure evidence.

P0 cases are automatically marked for escalation. Never include API keys, authentication tokens, identity documents, or unredacted payment credentials in a support message or attachment.

Console-only endpoints

These endpoints require a short-lived partner-console session. Raw API credentials cannot administer human access or create cases on behalf of a person. Every mutation requires an Idempotency-Key.

See Enterprise security, SLA, and Key management.