Skip to main content

​
Team Collaboration

Invite team members to work in your KnoxCall workspace. Everyone has one of four fixed roles, the same in every workspace, and an Editor can additionally be allowed to reveal secret values.

​
Overview

Team features:
  • 👥 Invite team members (up to your plan’s limit)
  • 🔐 Four roles — Viewer, Editor, Admin and Owner — plus Can reveal secret values for Editors
  • 📧 Email invitations with secure links
  • 📊 Audit log tracking of member actions
Perfect for:
  • Dev teams managing API integrations
  • Ops teams monitoring traffic
  • Security teams auditing access

​
Team Roles

Every workspace has four roles. The dashboard shows them as Viewer, Editor, Admin and Owner everywhere a role appears.

​
Owner

Exactly one per workspace. Everything an Admin can do, plus:
  • Make someone an Admin (by invitation or by changing their role), with a fresh two-factor verification. Only the Owner can grant Admin.
  • Change the plan and the payment method (the billing portal), apply coupons, and see invoices. Admins can change the workspace’s tax ID too.
  • Transfer ownership, and delete the workspace
  • Always sees secret values
  • Is emailed whenever an Admin is demoted or leaves the workspace: when a person demotes or removes them, when your identity provider deprovisions them through SCIM, and when their KnoxCall account is erased. Each email says which it was.

​
Admin

Everything an Editor can do, plus:
  • Invite, remove and change the role of Editors and Viewers
  • Demote or remove another Admin, with a fresh two-factor verification — the Owner is emailed every time
  • Turn Can reveal secret values on for an Editor, with a fresh two-factor verification (the Editor and the Owner are emailed)
  • Create API keys, OAuth apps and agents
  • Set up single sign-on, encryption keys, vaults, PKI and database-credential connections
  • Change Integrations, Sending domains and Deployment
  • Change the workspace’s tax ID (Settings → Billing)
  • Read request-log bodies, decrypt, detokenize, issue certificates and mint database credentials in the dashboard
  • See audit log change details
  • Test a route from the dashboard
  • Always sees secret values
❌ Cannot do:
  • Make someone an Admin (the Owner only)
  • Change the plan or the payment method, apply coupons, see invoices, or delete or transfer the workspace (the Owner only)
Use cases:
  • Engineering leads
  • DevOps engineers
  • Technical founders

​
Editor

Builds and runs integrations: ✅ Can do:
  • Create, edit and delete routes, clients, environments, workflows, webhooks and alerts
  • Set and rotate secret values — write-only: setting a value never shows it
  • Change the workspace’s email branding and email templates (the dashboard shows them under Settings → Integrations, which only Admins and the Owner open)
  • View logs and analytics
❌ Cannot do:
  • Invite, remove or change the role of anyone
  • Create API keys, OAuth apps or agents
  • Set up SSO, encryption keys, vaults or PKI
  • Change Integrations (other than email branding and email templates), Sending domains or Deployment
  • Change the plan, the payment method or the tax ID, apply coupons, or delete the workspace
  • View secret values — unless an Admin or the Owner has turned on Can reveal secret values for them (below)
Without Can reveal secret values, an Editor cannot view secret values in the dashboard — that is a limit on viewing, not on sending. An Editor can edit routes and workflows, and both inject your secrets into the requests they send, so editing a route or workflow that uses a secret can send that secret to a different host. Give the Editor role to people you trust with the credentials those routes and workflows use.
Use cases:
  • Backend developers
  • Integration engineers
  • QA engineers

​
Can reveal secret values (an Editor setting)

An Admin or the Owner can allow one Editor to see secret values. On the Team page it is the Can reveal secrets column: a checkbox for each Editor, Always for Admins and the Owner, Never for Viewers. With it on, that Editor can:
  • Reveal a secret’s value (the show/hide control on a secret)
  • View or download a certificate secret (with or without its private key)
  • Reveal a secret shared from another workspace
  • Run workflow tests that use stored credentials
  • See a workflow’s webhook trigger URL
It does not reach anything else an Admin can see (vault detokenization, transit decryption, request and webhook payloads, imported-credential review). Every reveal asks for a fresh second factor, for everyone — the Owner, an Admin, or an Editor with this setting: an authenticator code, a passkey or a security key (never an emailed code), once per reveal. Each reveal is recorded in the audit log as plaintext.reveal before the value is shown, with an optional reason you can type when you reveal. Reveals are rate-limited per person, and while the limiter is unavailable they are refused rather than allowed. This controls who can VIEW values. Anyone who can edit a route or workflow that uses a secret can still direct it to a host they control.
  • Turning it on needs an Admin or the Owner and a fresh verification with a security key or authenticator code; the Editor and the Owner are both emailed. Nobody can turn it on for themselves.
  • Turning it off needs no verification: an Admin, the Owner, or the Editor themselves can do it at any time. An Editor who has it turns it off under Settings → Account (Stop revealing secret values).
  • Changing a person’s role turns it off. In the Change role dialog you can tick it again for an Editor in the same step; that is saved as a second change, after the new role, and asks for the verification.
  • Viewers can never have it; Admins and the Owner do not need it.
  • Single sign-on and SCIM provisioning never turn it on, and an invitation never carries it — it is granted after the person has joined.
  • The command line (knoxcall CLI) never shows plaintext, whatever the role.
The Developer role is retired: every Developer became an Editor with Can reveal secret values turned on, so nobody lost access, and it can no longer be assigned.

​
Viewer

Read-only access: ✅ Can do:
  • View routes, clients, environments, workflows, webhooks and alerts, and secret names (never their values)
  • View request-log metadata and analytics
❌ Cannot do:
  • Create, edit or delete anything
  • View secret values
  • Test routes
  • Configure settings, or open the Team, Billing, Referrals, Integrations, Sending domains and Deployment settings (Admins and the Owner only)
Use cases:
  • Product managers
  • Customer success
  • External auditors

​
Compare roles

One table, the same one the dashboard shows on the Team page, the invite page and each member’s page. Plaintext stays in the dashboard. Signing in with the CLI gives you your role’s permissions, but the CLI never returns secret values or decrypted data, whatever your role. Revealing a secret value or downloading a certificate secret asks for your security key or authenticator code every time, and every reveal writes an audit row.

​
Inviting Team Members

​
Step 1: Navigate to Team Page

  1. Click Settings in sidebar
  2. Select Team
  3. See current team members

​
Step 2: Invite Member

  1. Click + Invite member
  2. Enter email address:
  3. Select role:
  4. Click Send invitation
Only the Owner can invite an Admin, and doing so asks for a fresh two-factor verification. An Admin invitation sent by anyone else before this rule existed is cancelled when it is accepted, and its sender is emailed. Invitations carry a role only. Can reveal secret values can be ticked once the person has joined.

​
Step 3: Invitation Sent

Email sent to invited user:

​
Step 4: User Accepts

New user:
  1. Clicks “Accept Invitation”
  2. Creates KnoxCall account
  3. Gains access to the workspace
Existing user:
  1. Clicks “Accept Invitation”
  2. Logs in with existing account
  3. Workspace added to their account
  4. Can switch between workspaces

​
Managing Team Members

​
Viewing Team

Team page shows:
  • Member name and email
  • Role (Owner, Admin, Editor, Viewer)
  • Can reveal secrets (a checkbox for Editors; Always for Admins and the Owner; Never for Viewers)
  • Joined date
  • Pending invitations, with their role

​
Changing Member Role

  1. Navigate to Settings → Team
  2. Open the member’s row actions (⋯) and choose Change role
  3. Pick Viewer, Editor or Admin — for an Editor, tick Can reveal secret values if they should see values
  4. Click Save role
Making someone an Admin, or moving an Admin to another role, asks for your security key or authenticator code, and moving an Admin emails the Owner. Ticking reveal asks too, so moving an Admin to Editor with it ticked asks twice. The Owner’s role changes only by transferring ownership. Effect: Immediate (the member’s next request reflects the new role)

​
Removing Team Member

  1. Navigate to Settings → Team
  2. Open the member’s row actions (⋯) and choose Remove
  3. Confirm removal
What happens:
  • The member loses access to the workspace immediately
  • Audit logs still show their past actions
  • Removing an Admin asks for a fresh verification, and the Owner is emailed

​
Resending Invitation

If an invitation expired or the email was lost: cancel it and invite the same address again. Invitation expiration: 7 days

​
Canceling Invitation

Before user accepts:
  1. Navigate to Settings → Team
  2. Find the pending invitation
  3. Choose Cancel invite
  4. The invitation link becomes invalid

​
Audit Logging

All team member actions are logged: View team member activity:
  1. Navigate to Monitoring → Audit Logs
  2. Filter by user email
  3. See all changes made by that member
Example log entries:
Use cases:
  • Compliance audits
  • Troubleshooting configuration issues
  • Security investigations

​
Best Practices

​
1. Principle of Least Privilege

Assign minimum necessary role: ✅ Good:
❌ Bad:

​
2. Regular Access Reviews

Monthly:
  • Review team member list
  • Remove inactive members
  • Verify roles, and who can reveal secret values, are still appropriate
  • Check for ex-employees

​
3. Use Service Accounts for Automation

Don’t share personal accounts for CI/CD: ❌ Bad: Use john@example.com credentials in CI ✅ Good: Register a dedicated OAuth client for CI/CD (or use workload identity federation — zero stored secrets) Team members = humans only

​
4. Document Team Structure

Maintain team roster:

​
5. Onboarding/Offboarding Process

New team member:
  1. Invite to the KnoxCall workspace
  2. Share documentation links
  3. Walkthrough key routes/secrets
  4. Add to on-call rotation (if applicable)
Team member leaving:
  1. Remove from the KnoxCall workspace
  2. Rotate any shared secrets they had access to
  3. Review their audit logs (last actions)
  4. Update on-call rotation

​
Multiple Workspaces

If user belongs to multiple workspaces: Switch workspaces:
  1. Click the workspace dropdown (top-left)
  2. Select a different workspace
  3. UI updates to that workspace
Each workspace:
  • Separate team with separate roles
  • User may be an Admin in one, a Viewer in another
  • Permissions apply per workspace
Example:

​
Troubleshooting

​
Issue: “Invitation not received”

Causes:
  • Email in spam folder
  • Typo in email address
  • Email server rejecting
Fix:
  1. Check spam folder
  2. Verify correct email
  3. Cancel the invitation and invite again
  4. Try different email provider

​
Issue: “Can’t remove team member”

Causes:
  • Trying to remove yourself (not allowed)
  • Trying to remove the Owner (transfer ownership first)
Fix:
  • Have an Admin or the Owner remove you
  • The Owner transfers ownership, then the former Owner (now an Admin) can be removed

​
Issue: “Permissions not working”

Cause: The dashboard still shows the role you had when the page loaded Fix:
  1. Reload the page
  2. If it persists, log out and log back in
  • Audit Logs: Track team member actions
  • Tenant Management: Overall workspace settings
  • API Keys: Alternative authentication (not tied to a user), each with one of four permission presets

​
Next Steps

Audit Logs

Track team activity

Tenant Settings

Configure tenant

Routes

Start configuring routes

Secrets

Manage credentials

📊 Statistics

  • Level: beginner
  • Time: 5 minutes

🏷️ Tags

team, collaboration, permissions, access-control