Users, user organizations and grants FAQ
Can one person have two users in my organization?
Section titled “Can one person have two users in my organization?”Not under one email address. Each email address belongs to at most one user, across every site you run, so a person who signs in on two of your sites with the same address is one user. A person who uses another organization’s sites is a separate, unrelated user there.
Two different email addresses are two users, and the console has no action that merges them.
Someone reads our site every day. Why are they not on the Users screen?
Section titled “Someone reads our site every day. Why are they not on the Users screen?”They have never been identified. Until someone signs in, registers, buys or joins a list with their email address, EdgeKit keeps their state as an anonymous device, and anonymous browsing never creates a user. See When a user row is created.
A user registered on one of our sites. Can they use another?
Section titled “A user registered on one of our sites. Can they use another?”Yes, as the same user. A site attachment records where a user has been seen; it is not a boundary. A grant reaches every site its product covers, whether or not the user is attached to that site.
Why does a user’s name look like the start of their email address?
Section titled “Why does a user’s name look like the start of their email address?”When EdgeKit creates a user from an email address alone, for example when staff seat them in a user organization, when
they join a newsletter list, or at a checkout that sent no name, it uses the part of the address before the @ as the
name until the user gives one. Staff can correct
it in the user’s User section.
Why is a user Unverified when they have paid?
Section titled “Why is a user Unverified when they have paid?”A payment proves a card, not a mailbox. A user that EdgeKit creates from an address someone typed, at checkout, for a newsletter list or for a staff seat, starts unverified. Auto-join domains add only users whose address is verified.
Can staff change a user’s email address for them?
Section titled “Can staff change a user’s email address for them?”Yes, with the Owner or Admin role, as a correction. The new address is stored unverified, every sign-in session the
user holds is revoked at once (a browser that holds their cookies can lag behind; see
How quickly an ended session stops working),
and an address another user already has is refused with That address is already in use..
See Correct a user’s email address.
How do I erase a user?
Section titled “How do I erase a user?”Your server calls POST /v1/id/upstream/erase with an API key and the user’s subject at your identity provider. The
user is anonymised in place: the name, the email address and the traits they wrote are removed and every sign-in
session is revoked, while the id, the site attachments and the grants stay. Repeating the request is safe. See
Erased users.
The request needs an identity provider: without one it answers 503, This tenant has no identity provider.. A user
with no link to your identity provider has no subject to name, so it answers 404 for them. The console cannot erase
a user.
What happens if an erased person comes back?
Section titled “What happens if an erased person comes back?”They get a new user when they next register or buy. The new user is not linked to the erased one, and the erased user’s grants do not move to it.
Can an API key pinned to one site erase a user on another site?
Section titled “Can an API key pinned to one site erase a user on another site?”Yes. The key must be pinned to the site named in x-edgekit-site-id, but the erasure applies to the user across your
whole organization. A user belongs to your organization, not to one site.
How do I give a user free access?
Section titled “How do I give a user free access?”Not from the console. It has no action that creates a grant, and Identity › Audience › Grants is read-only. A grant is created when a user buys an offer at checkout.
Can I revoke a grant or delete a user organization from the console?
Section titled “Can I revoke a grant or delete a user organization from the console?”No. A grant’s screen and a user organization’s Grants tab show Revoke and Delete organization, and neither can be used today. A grant moves when your billing provider’s state for it changes: see How a grant is created.
Why is a grant expired when its stored status is active?
Section titled “Why is a grant expired when its stored status is active?”Expiry is a date, not a status. A grant past its expiry is expired with nothing written to it, so its stored status
still says active. The Grants screen and GET /v1/grants show the folded state.
What is the difference between a suspended and a revoked grant?
Section titled “What is the difference between a suspended and a revoked grant?”A suspended grant gives no access now and keeps its term end; it goes back to active when, for example, a
past-due invoice is paid. A revoked grant was ended by your billing provider before its term ran out, or while
it was suspended, and stays revoked; restoring access takes a new grant.
A user has access through their employer. Why does Users show no grant?
Section titled “A user has access through their employer. Why does Users show no grant?”The Grants column on the Users screen counts only grants the user holds directly. A grant held by a user
organization is the organization’s, and reaches the user through their seat. It is listed on the organization’s
Grants tab, and GET /v1/grants returns it to the user with the organization named.
Does access from our identity provider appear as a grant?
Section titled “Does access from our identity provider appear as a grant?”No. At a site whose sign-in runs only through your identity provider, the access it asserts arrives with each request
as external.* facts. EdgeKit never writes it as a grant and never combines it with grants for you; your rules decide
how to use it. See EdgeKit ID.
Can a company or a campus get access by its IP range, with nobody signed in?
Section titled “Can a company or a campus get access by its IP range, with nobody signed in?”No. A user organization’s access reaches only its members, through their seats, and a member is a user. EdgeKit does not recognise a device by its IP range. Members join by invitation, by an auto-join email domain, or by a staff seat.
How many members can a user organization have?
Section titled “How many members can a user organization have?”At most 50, whatever was sold. Below that, the seat limit applies when your seat overage policy is block. See
Seats and the seat limit.
What happens when a user organization is full?
Section titled “What happens when a user organization is full?”Under block, the default, an invitation accept is refused, a staff seat is refused with
This organization is full at N seats., and a user who registers at an auto-join domain is created with no seat.
People refused a seat at accept or auto-join are recorded for the organization’s owners and admins. Under
allow_and_flag, invitations and auto-joins go past the seat limit up to 50 members, and each one past it is recorded
as access.seat_overage on Identity › Audience › Observability.
Does an outstanding invitation hold a seat?
Section titled “Does an outstanding invitation hold a seat?”No. The seat limit is checked when the invitation is accepted. An invitation expires after 48 hours, and a user organization can hold at most 50 pending invitations at once.
Can our users create a user organization themselves?
Section titled “Can our users create a user organization themselves?”No. Staff open one from Identity › Audience › Organizations, seat its first admin, and that admin invites the rest from your site.
Does adding an auto-join domain add the people who already registered?
Section titled “Does adding an auto-join domain add the people who already registered?”No. Auto-join runs once, when a user is created with a verified address at that domain. People who registered before you added the domain, or whose address was unverified when they registered, are not added.
Does changing a member’s role change what they can read?
Section titled “Does changing a member’s role change what they can read?”No. A role decides what the member can manage in the user organization. The organization’s grants reach every seat, whatever the role.
How quickly does removing a member take effect?
Section titled “How quickly does removing a member take effect?”The seat is freed at once. Decide can keep reading the organization’s access from the removed member’s access cookie for up to an hour; see How quickly an ended session stops working. Their own grants are not affected.
Can the last owner leave a user organization?
Section titled “Can the last owner leave a user organization?”Not through your site: the last owner cannot leave. Staff can change roles from the console with no such check, so a user organization can be left with no owner.
Can EdgeKit staff see our users?
Section titled “Can EdgeKit staff see our users?”Only while support access is on for your organization. Every read and change EdgeKit staff make is recorded in your
organization’s own database as support.read or support.write; your own staff’s are recorded as staff.read or
staff.write. See Every staff read and change is recorded.
Who in our organization can see users?
Section titled “Who in our organization can see users?”Everyone in your organization’s console can open Users, Organizations and Grants. Only the Owner and Admin roles can change a user or a user organization. Observability needs the Observability permission, which every built-in role holds.
How do I find out who changed a user?
Section titled “How do I find out who changed a user?”Identity › Audience › Observability names the actor on each change, including the staff member for a console change, for the last 30 days. Every staff read and change is also recorded in your organization’s own database, though no console screen lists those records today.
Why is there no sign-out row for a user whose sessions ended?
Section titled “Why is there no sign-out row for a user whose sessions ended?”Observability records a sign-out only when the user signs out through your site. When EdgeKit ends sessions itself, after a staff email correction or an erasure, no row is written.