Organization administration

Access roles and responder seats

Organization administrators can invite members, promote or demote administrators, and remove members. Invitations are single-use and expire.

Firewatch stores two independent membership settings:

• Access role: an Administrator can manage organization configuration; a Member has normal product access.
• On-call access: a Responder can own services, join schedules, receive overrides, and participate in shift trades; a Stakeholder can view and collaborate without being eligible for paging.

An administrator can be either a responder or stakeholder. This keeps a billing or security administrator free when they never participate in on-call. Firewatch Cloud counts responder memberships as paid seats; stakeholder memberships are free.

Members can invite free stakeholders. Only administrators can add a responder, invite another administrator, or change on-call access.

Before changing a responder to a stakeholder, remove their service ownership, schedule participation, overrides, and pending shift trades. Firewatch rejects the change while any routing reference remains.

Firewatch blocks removals that would leave active product records without a valid owner or responder. Resolve those references before trying again.

Only administrators can change roles, merge users, configure organization integrations, edit alert templates, or manage API keys.

Merge duplicate users

Use Organization → Members → Merge duplicate when two active accounts represent the same person after an identity-provider change or duplicate registration.

Choose:

• the source account that will be retired; and
• the target account whose profile and email will remain.

Enter the target email exactly to confirm. Firewatch then:

• preserves the stronger administrator role;
• transfers non-duplicate service ownership and schedule participation;
• transfers schedule overrides, external-login records, passkeys, and claims;
• transfers the Slack mapping when it does not conflict;
• adopts the source’s verified phone only when the target lacks one;
• retains responder access when either merged account was a responder;
• redirects existing merged-user references to the target; and
• disables and audits the source account.

Both accounts must be active, email-confirmed members of only the current organization. The source cannot be the administrator’s current session. Resolve pending invitations and source-account shift trades first, and keep the combined passkey count at ten or fewer.

Merging is not a reversible UI operation. Confirm the retained account and email carefully.

Slack workspace

When the deployment has a Slack app configured, open Organization → Integrations and select Add to Slack. A Slack administrator must approve the requested bot scopes.

Synchronization compares current, verified Firewatch member emails with Slack and stores immutable Slack user IDs. Firewatch:

• does not import the Slack directory as Firewatch users;
• does not guess using display names; and
• sends alerts by direct message, not by mentioning a person in a shared channel.

Unmatched members continue to receive their other available channels. Re-run synchronization after membership or Slack-email changes.

Slack interaction requests are validated with Slack’s timestamped signature. Acknowledge and resolve buttons update Firewatch, then the worker updates the original alert message and adds lifecycle context.

Alert templates

Open Organization → Alert templates to customize plain-text email subject and body, SMS, voice, Slack, and webhook wording.

Templates use only the variables shown in the page. They cannot execute code, read secrets, or emit arbitrary email HTML. Firewatch validates length and syntax before saving and safely creates the email HTML alternative.

Use Restore defaults to remove the organization customization.

Outbound webhooks

An organization can configure up to ten signed delivery endpoints. The signing secret appears only at creation or rotation. Pausing an endpoint retains its configuration without sending new deliveries.

Rotation invalidates the previous secret immediately. See Outbound alert webhooks for signature verification and destination restrictions.

API keys

Organization API keys authenticate machine integrations such as alert adapters. The full secret is shown only when created; Firewatch stores a non-reversible validation value.

Keep keys in a secret manager, use separate keys for separate senders, and revoke a key when its owner or purpose changes. An organization API key is not a global Firewatch administrator credential.

Self-hosted provider settings

Self-hosted administrators can revisit Admin settings after the initial setup. The page detects email, Twilio, and Slack status and generates the environment changes selected by the administrator.

The UI does not write the host’s .env file. Copy the generated values into deployment secret storage, run docker compose up -d, then re-check the status. Firewatch Cloud does not expose provider credentials to customer administrators.