Teams & RBAC
Organize your team with role-based access control, project-level permissions, and a complete audit trail of all actions.
Creating a Team
Teams allow multiple users to collaborate on the same sh0 instance. The first user (created during installation) is automatically the team owner with full admin privileges.
- Navigate to Settings → Team in the dashboard.
- Your default team is created automatically. You can rename it here.
- Add a team description and avatar (optional).
Inviting Members
Admins can invite new members to the team by email. The invited user will receive an email with a link to set up their account.
- Go to Settings → Team → Members.
- Click Invite Member.
- Enter the email address and select a role (Admin, Developer, or Viewer).
- Click Send Invitation.
curl -X POST https://your-server:9000/api/team/invite \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"email": "[email protected]",
"role": "developer"
}'Pending invitations are shown in the Members list with an Invited badge. You can resend or revoke an invitation at any time.
Role Types
sh0 provides three built-in roles with increasing levels of access:
| Role | Description | Use Case |
|---|---|---|
| Admin | Full access to all resources, settings, team management, and billing. | CTOs, DevOps leads, infrastructure owners |
| Developer | Can create, deploy, and manage apps. Cannot access team settings or server configuration. | Software engineers, DevOps team members |
| Viewer | Read-only access. Can view apps, logs, and metrics but cannot modify anything. | Stakeholders, QA team, auditors |
Permissions Matrix
Here is the complete breakdown of what each role can do:
| Action | Admin | Developer | Viewer |
|---|---|---|---|
| View apps & dashboards | Yes | Yes | Yes |
| View logs & metrics | Yes | Yes | Yes |
| Create & deploy apps | Yes | Yes | No |
| Manage environment variables | Yes | Yes | No |
| Manage domains & SSL | Yes | Yes | No |
| Access terminal | Yes | Yes | No |
| Manage team members | Yes | No | No |
| Server settings & nodes | Yes | No | No |
| Billing & license | Yes | No | No |
Project-Level Access
In addition to global roles, you can restrict a user's access to specific projects. This is useful when different team members work on different applications.
- Go to the project's Settings → Access tab.
- Click Add Member and select a team member.
- Choose the access level for this project (Full Access, Deploy Only, View Only).
Audit Log
sh0 records every significant action performed by team members. The audit log provides a complete timeline of who did what and when.
Tracked events include:
- Login and logout events
- App creation, deployment, and deletion
- Environment variable changes
- Domain additions and removals
- Team member invitations and role changes
- Settings modifications
- Database operations (backup, restore, delete)
curl https://your-server:9000/api/team/audit-log?page=1&per_page=50 \
-H "Authorization: Bearer YOUR_TOKEN"Removing Members
Admins can remove team members from Settings → Team → Members. Removing a member:
- Immediately revokes all their active sessions.
- Removes their access to all projects and resources.
- Does not delete any resources they created (apps, databases, etc.).
- Preserves their actions in the audit log for accountability.
curl -X DELETE https://your-server:9000/api/team/members/usr_abc123 \
-H "Authorization: Bearer YOUR_TOKEN"