Organizations

Hierarchy, security and invitation methods.

GroupOrganization hierarchy and administration

RuntimesTypeScript core, React admin mediation, Python/Go server

Updated2026-09-15

Status and entity boundary

Proposed target SDK catalog based on the verified current public SDK surface. An Organization is the authorization and resource boundary containing users, wallets, policies and activity history. A parent may create and look up suborganizations. This hierarchy is distinct from integration application configuration and from the existing Streams customer/project/environment hierarchy.

Generated stamp* request builders and older endpoint-version aliases are not additional business methods. Smart-contract account creation, account abstraction, delegated on-chain execution and EIP-7702 upgrades are outside v1.

Identity, hierarchy and configuration#

Method	Meaningful input	Result or effect
`getWhoami`	organization context or parent lookup context	current user ID/name plus resolved organization ID/name
`getOrganizationConfigs`	`organizationId`	organization features and root approval configuration
`getSubOrgIds`	parent `organizationId`, optional filter and pagination	matching suborganization IDs
`getVerifiedSubOrgIds`	parent `organizationId`, verified-contact filter and pagination	matching verified suborganization IDs
`createSubOrganization`	`requestId`, name, root users, root approval threshold, feature flags and optional initial wallet	durable creation result with suborganization and root-user identities
`deleteSubOrganization`	`requestId`, exact suborganization target and guarded export/deletion choice	explicit terminal deletion disposition
`updateOrganizationName`	`requestId`, `organizationId`, new name	guarded name update

createSubOrganization is the verified public creation method. There is no generic createOrganization method in the inspected SDK client. A suborganization is not an application record and must not be created merely to satisfy an application-configuration screen.

Root approval and feature controls#

Method	Meaningful input	Result or effect
`updateRootQuorum`	`requestId`, member user IDs and numeric approval threshold	new organization root-approval configuration after approval by the current root set
`setOrganizationFeature`	`requestId`, feature name and value	guarded feature setting
`removeOrganizationFeature`	`requestId`, feature name	guarded removal of one setting

updateRootQuorum configures off-chain organization administration signing. Its threshold is the number of authorized members whose approvals are required for protected organization actions. It does not deploy a smart contract, create a multisignature blockchain account, change a wallet's on-chain bytecode or add account-abstraction behavior.

Changing the root set cannot authorize itself using only the proposed new membership. The current valid root authority approves the exact old version, proposed members, threshold, request identity and expiry. A member cannot approve twice under aliases, and removing the final usable authority or violating recovery policy fails closed.

Network-access controls#

Method	Meaningful input	Result or effect
`getIpAllowlist`	`organizationId`, optional API public key target	effective allowlist and rules
`setIpAllowlist`	`requestId`, exact organization or key target, enabled/error behavior and CIDR rules	guarded create or replacement
`removeIpAllowlist`	`requestId`, exact organization or key target	explicit fallback to the documented parent or unrestricted state only after authorization

An API-key-specific list may override an organization-level list only under an accepted precedence contract. Invalid CIDR, ambiguous target, stale version, policy denial or unavailable evaluation cannot silently widen access.

Invitation methods#

createInvitations and deleteInvitation are verified advanced organization-access methods. Creation takes a stable request identity and one or more explicit invite definitions and returns the created invitation identities through the operation result. Deletion names one exact invitation. No list-invitations call was present in the inspected SDK client, so this catalog does not invent one.

Confidential provider credentials#

Organization OAuth client credentials use the five canonical admin methods defined in Frontend authentication: get, list, create, update and delete. This page does not duplicate their field contract. They remain organization scoped and secure-backend only; neither organization membership nor a browser admin screen may expose, decrypt or provision the client secret. They are distinct from user-linked OAuth provider records.

Runtime and authority#

Organization reads may be exposed to an authenticated TypeScript browser only within the caller's granted organization scope. React may mediate an admin UI, but the backend remains authoritative. Hierarchy mutation, root approval, feature, invitation and network-access controls are privileged server operations or explicitly confirmed admin actions. Python and Go expose server bindings. Server credentials never enter browser configuration, examples or logs.

TypeScript browser	TypeScript server	React adapter	Python server	Go server
Scoped reads only when explicitly granted	Privileged hierarchy/security administration target	Admin UI may call authorized core reads/actions; no dedicated hook is implied	Privileged server target	Privileged server target

const organization = await sdk.getOrganizationConfigs({ organizationId });
const changed = await admin.updateOrganizationName({ organizationId, requestId, organizationName });

organization = await sdk.get_organization_configs(
    GetOrganizationConfigsInput(organization_id=organization_id)
)
changed = await admin.update_organization_name(UpdateOrganizationNameInput(
    organization_id=organization_id,
    request_id=request_id,
    organization_name=organization_name,
))

organization, err := sdk.GetOrganizationConfigs(ctx, &GetOrganizationConfigsInput{
    OrganizationID: organizationID,
})
if err != nil { return err }
changed, err := admin.UpdateOrganizationName(ctx, &UpdateOrganizationNameInput{
    OrganizationID: organizationID,
    RequestID: requestID,
    OrganizationName: organizationName,
})

Every mutation follows the shared requestId and operation-recovery contract. A root approval is an authorization state for the administrative action, not proof that the action executed. getOperation recovers execution disposition; Approvals exposes participant decisions when human or multi-party review is needed.

Acceptance#

Positive: all thirteen verified core/security methods and two invitation methods are listed with organization scope and distinct results.
Positive: parent/suborganization, user, application configuration and wallet are distinguishable resource concepts.
Negative: no browser session self-elevates into root administration; root approval is not represented as on-chain multisignature behavior; removing a feature or allowlist cannot broaden access through an undocumented fallback.

See Users, Application configuration, Policies, and Approvals.