People and access
Organisations, teams and access
Group repositories in organisations, invite people, make teams, give roles on repositories, and keep members in step with your identity provider.
Organisations
An organisation owns repositories on behalf of a group: a company, a class, a club. Start one from New repository → Or start an organisation. You become its first owner.
Its page has these tabs:
- Overview: its repositories and recent changes, and your teams.
- Insights: review across all its repositories (see Insights).
- Members and Teams.
- Settings (owners only): its name, base role, provisioning and audit log.
Members
Members are owners or members. Owners manage the organisation and are admins of all its repositories.
Inviting people
On the Members tab, owners can:
- Invite by email. The person gets a link that opens sign-up for that address only, even when sign-up is otherwise closed. Without a mail server, Fettlecode shows the link for you to copy and send. Pending invitations can be revoked.
- Add someone who already has an account, by username.
The base role
Settings → Base role gives every member a role on every repository in the organisation: No access, or read, triage, write, maintain or admin. Use it for "everyone here can read everything", then give more to teams.
Teams
On the Teams tab, owners create a team with a short name (such as web) and add people by username. Give a team a role on a repository in that repository's Settings → Who has access. Mention a team as @org/team in a CODEOWNERS file.
Roles on a repository
| Role | Can |
|---|---|
| Read | Clone and browse, send changes for review, comment, approve, and mark files reviewed |
| Triage | Also abandon other people's changes |
| Write | Also push to branches (within the branch rules) and submit changes |
| Maintain | Also manage branch rules and tags |
| Admin | Also manage who has access, visibility and every setting |
A person's role is the highest they get from: being an instance admin; owning the repository or its organisation; the organisation's base role; a role given to them directly; their teams' roles; and read on any public repository.
Give people roles in a repository's Settings → Who has access, by username or team.
Provisioning with SCIM
Your identity provider (Okta, Entra ID, Authentik, Keycloak and others) can add, update and deactivate an organisation's members, and keep its teams in step with its groups.
- In the organisation's Settings → Provisioning (SCIM), make a token, named for your identity provider. Copy it: it's shown once.
- In your identity provider's SCIM app, enter the SCIM base URL shown there and the token.
People it adds sign in with single sign-on. Deactivating someone in the identity provider removes their access here.