Skip to main content

​
Roles

​
Permission matrix

​
Managing members

​
Invite a member

Go to Settings > Team > Invite Member. Enter the email and select a role.

​
Change a role

Owners and Admins can change roles. You can change or remove only members whose role is strictly below your own. An Admin can manage Managers, Members, and Viewers, but not another Admin. Owners can manage anyone, including other Owners, and only an Owner can promote a member to Owner. The last Owner cannot be demoted or removed without transferring ownership first.

​
Require a second approver for changes

An Owner can protect sensitive changes. When someone attempts a protected change, Conto holds it and creates a governance approval request. A second Owner or Admin must approve the request before the change applies. Managers, Members, and Viewers cannot configure governance approvals or decide requests. You can protect:
  • API key creation, rotation, and revocation
  • Policy creation, update, and deletion
  • Policy-rule creation, update, and deletion
  • Automatic freeze settings updates for an agent
Pending requests expire after 24 hours. The requester cannot approve their own request, so a single-owner organization needs a second Owner or Admin.

​
Set up protected changes

1

Open the Governance tab

As an Owner, sign in to the dashboard and open the Governance tab in organization settings.
2

Choose protected actions

Toggle on the actions that should pause for review, then choose Save Governance Rules.
3

Optional: add webhook visibility

If your compliance, audit, or ticketing system needs a copy of governance events, add a WEBHOOK notification channel and subscribe it to governance.approval.requested and governance.approval.decided. See governance approval webhooks.
4

Test one protected change

Try a protected action such as updating a policy or rotating an API key. The dashboard shows Waiting for approval, the request appears in the approval inbox, and the change is not applied.

​
Review a request

Owners and Admins review pending requests in the Governance settings tab or on the Governance tab of Alerts & Approvals, and approve or reject them there. Each request shows:
  • The protected action, such as POLICY_UPDATE or API_KEY_ROTATE
  • The target resource and resource ID
  • The requester and request timestamp
  • The serialized request payload
  • Expiration time
  • Decision history and optional reviewer comment
A rejected or expired request is not applied. Conto records each request and decision in audit logs.

​
Apply an approved change

After approval, the requester opens the Governance tab of Alerts & Approvals and chooses Apply change under Ready to apply within 15 minutes. Conto keeps the change with the request, so the requester can apply it from any browser or device where they are signed in. Only the requester can apply it. Other Owners and Admins see the request but no Apply change button. A new or rotated API key is shown once, to the person who applies the change. If the window closes or the change no longer matches, make the change again to request a new approval. Through the API, a protected call returns HTTP 202 with requiresGovernanceApproval: true and the pending request in approvalRequest, including its id. After approval, the same user or API key resends the identical request with the x-governance-approval-id header set to that id within 15 minutes. The approval applies once. A changed payload, an expired window, or a request that is not approved returns HTTP 409.

​
Governance API

The dashboard uses these endpoints:
  • GET /api/governance/approval-settings
  • PATCH /api/governance/approval-settings
  • GET /api/governance/approval-requests
  • POST /api/governance/approval-requests/{id}/decide
An organization API key with org:read can read the approval settings and list approval requests. Changing the settings needs a signed-in owner in the dashboard. Deciding a request needs a signed-in owner or admin other than the requester.

​
Managing your own sessions

Every signed-in user can review and revoke their own active browser sessions, whatever their organization role.
  • GET /api/sessions lists active sessions with a revocable session ID, current-session marker, recognizable device label, IP address, sign-in time, and last-active time.
  • DELETE /api/sessions/{id} signs out one session owned by the current user.
  • POST /api/sessions/terminate-all signs out every other active session while keeping the current browser signed in.
The session response does not include authentication tokens, user IDs, device fingerprints, or audit metadata. If you do not recognize a device or IP address, revoke that session and rotate any credentials that may have been exposed.

​
API key scopes

Only Owners create organization API keys. For key types, presets, and scopes, see keys and scopes.