Organizations and members

{
  "roles": [
    {
      "role": "owner",
      "words": "Everything an admin does, and the owner's own decisions: owners, the organization's settings, and revoking a removed member's keys.",
      "permissions": [
        "org.read",
        "members.read"
      ]
    },
    {
      "role": "admin",
      "words": "Manages people (never an owner) and every key, webhook, enrollment and SFTP user, test or live.",
      "permissions": [
        "org.read",
        "members.read"
      ]
    }
  ],
  "permissions": [
    {
      "permission": "org.read",
      "words": "See the organization, its account and its settings."
    },
    {
      "permission": "org.update",
      "words": "Rename the organization and choose who manages keys."
    }
  ],
  "owner_rules": [
    "Only an owner invites an owner, makes a member an owner, or changes or removes an owner.",
    "An organization always keeps at least one owner: the last owner cannot be removed, leave, or be given another role."
  ]
}

{
  "data": [
    {
      "org_id": "pwo_25323f4c596673808d9aa7b4",
      "name": "Sample Dental",
      "role": "owner",
      "member_id": "pwm_4a5764717e8b98a5"
    }
  ]
}

{
  "name": "Sample Dental",
  "api_key": "pw_test_qk3x..."
}

{
  "org_id": "pwo_25323f4c596673808d9aa7b4",
  "name": "Sample Dental",
  "account_id": "pwk_500de6d41a6eacebb6e34d08",
  "owners": 1,
  "members": 1,
  "key_management": "keys_and_members",
  "created_at": "2026-10-19T15:00:00.000Z",
  "you": {
    "member_id": "pwm_4a5764717e8b98a5",
    "role": "owner",
    "permissions": [
      "org.read",
      "members.read"
    ]
  },
  "kept": "An organization is kept while it exists: its name, its members (each sign-in's email address, name and role) and its pending invitations (an email address and a role, for 7 days). Never a claim, a patient or the body of a call."
}

{
  "org_id": "pwo_25323f4c596673808d9aa7b4",
  "name": "Sample Dental",
  "account_id": "pwk_500de6d41a6eacebb6e34d08",
  "owners": 1,
  "members": 1,
  "key_management": "keys_and_members",
  "created_at": "2026-10-19T15:00:00.000Z",
  "you": {
    "member_id": "pwm_4a5764717e8b98a5",
    "role": "owner",
    "permissions": [
      "org.read",
      "members.read"
    ]
  },
  "kept": "An organization is kept while it exists: its name, its members (each sign-in's email address, name and role) and its pending invitations (an email address and a role, for 7 days). Never a claim, a patient or the body of a call.",
  "pending_invitations": 0
}

{
  "name": "Sample Dental Group"
}

{
  "org_id": "pwo_25323f4c596673808d9aa7b4",
  "name": "Sample Dental Group",
  "account_id": "pwk_500de6d41a6eacebb6e34d08",
  "owners": 1,
  "members": 1,
  "key_management": "keys_and_members",
  "created_at": "2026-10-19T15:00:00.000Z",
  "you": {
    "member_id": "pwm_4a5764717e8b98a5",
    "role": "owner",
    "permissions": [
      "org.read",
      "members.read"
    ]
  },
  "kept": "An organization is kept while it exists: its name, its members (each sign-in's email address, name and role) and its pending invitations (an email address and a role, for 7 days). Never a claim, a patient or the body of a call."
}

{
  "data": [
    {
      "member_id": "pwm_4a5764717e8b98a5",
      "email": "jane.doe@sample-dental.com",
      "name": "Jane Doe",
      "role": "owner",
      "joined_at": "2026-10-19T15:00:00.000Z",
      "invited_by": null,
      "updated_at": null,
      "you": true
    },
    {
      "member_id": "pwm_727f8c99a6b3c0cd",
      "email": "john.doe@sample-dental.com",
      "name": "John Doe",
      "role": "developer",
      "joined_at": "2026-10-19T15:00:00.000Z",
      "invited_by": "pwm_4a5764717e8b98a5",
      "updated_at": null,
      "you": false
    }
  ]
}

{
  "role": "viewer"
}

{
  "member_id": "pwm_727f8c99a6b3c0cd",
  "email": "john.doe@sample-dental.com",
  "name": "John Doe",
  "role": "viewer",
  "joined_at": "2026-10-19T15:00:00.000Z",
  "invited_by": "pwm_4a5764717e8b98a5",
  "updated_at": "2026-10-19T15:00:00.000Z",
  "you": false
}

{
  "removed": {
    "member_id": "pwm_727f8c99a6b3c0cd",
    "email": "john.doe@sample-dental.com",
    "name": "John Doe",
    "role": "viewer",
    "joined_at": "2026-10-19T15:00:00.000Z",
    "invited_by": "pwm_4a5764717e8b98a5",
    "updated_at": "2026-10-19T15:00:00.000Z"
  },
  "left": false,
  "keys_made": [],
  "keys_rotated": [],
  "keys_revoked": [],
  "keys_not_revoked": []
}

{
  "data": [
    {
      "invitation_id": "pwi_03101d2a3744515e",
      "email": "john.doe@sample-dental.com",
      "role": "developer",
      "invited_by": "pwm_4a5764717e8b98a5",
      "created_at": "2026-10-19T15:00:00.000Z",
      "expires_at": "2026-10-26T15:00:00.000Z",
      "expired": false
    },
    {
      "invitation_id": "pwi_4d5a6774818e9ba8",
      "email": "rick.roe@sample-dental.com",
      "role": "viewer",
      "invited_by": "pwm_4a5764717e8b98a5",
      "created_at": "2026-10-19T15:00:00.000Z",
      "expires_at": "2026-10-26T15:00:00.000Z",
      "expired": false
    }
  ]
}

{
  "email": "john.doe@sample-dental.com",
  "role": "developer"
}

{
  "invitation_id": "pwi_03101d2a3744515e",
  "email": "john.doe@sample-dental.com",
  "role": "developer",
  "invited_by": "pwm_4a5764717e8b98a5",
  "created_at": "2026-10-19T15:00:00.000Z",
  "expires_at": "2026-10-26T15:00:00.000Z",
  "expired": false,
  "emailed": true
}

{
  "invitation_id": "pwi_4d5a6774818e9ba8",
  "email": "rick.roe@sample-dental.com",
  "role": "viewer",
  "invited_by": "pwm_4a5764717e8b98a5",
  "created_at": "2026-10-19T15:00:00.000Z",
  "expires_at": "2026-10-26T15:00:00.000Z",
  "expired": false,
  "canceled": true
}

{
  "token": "3uv4BRIfLDlGU2BteoeUoa67yNXi7_wJFiMwPUpXZHE"
}

{
  "organization": {
    "org_id": "pwo_25323f4c596673808d9aa7b4",
    "name": "Sample Dental Group",
    "account_id": "pwk_500de6d41a6eacebb6e34d08",
    "owners": 1,
    "members": 2,
    "key_management": "keys_and_members",
    "created_at": "2026-10-19T15:00:00.000Z",
    "you": {
      "member_id": "pwm_727f8c99a6b3c0cd",
      "role": "developer",
      "permissions": [
        "org.read",
        "members.read"
      ]
    },
    "kept": "An organization is kept while it exists: its name, its members (each sign-in's email address, name and role) and its pending invitations (an email address and a role, for 7 days). Never a claim, a patient or the body of a call."
  },
  "member": {
    "member_id": "pwm_727f8c99a6b3c0cd",
    "email": "john.doe@sample-dental.com",
    "name": "John Doe",
    "role": "developer",
    "joined_at": "2026-10-19T15:00:00.000Z",
    "invited_by": "pwm_4a5764717e8b98a5",
    "updated_at": null,
    "you": true
  }
}

{
  "account_id": "pwk_500de6d41a6eacebb6e34d08",
  "data": [
    {
      "key_id": "pwk_500de6d41a6eacebb6e34d08",
      "name": "Server",
      "mode": "test",
      "last_four": "4Lvg",
      "created_at": "2026-10-19T12:00:00.000Z",
      "expires_at": null,
      "expired": false,
      "revoked_at": null,
      "rotated_at": null,
      "previous_secret_accepted_until": null,
      "current": false,
      "made_by": {
        "kind": "key",
        "id": null
      }
    }
  ]
}

// Payerworks example: organizations, members and roles. Docs: https://payerworks.com/docs/organizations
//
// Run it with Node 18 or later, with the JavaScript client (https://payerworks.com/sdk/payerworks.mjs)
// and sample-data.mjs beside this file:
//   PAYERWORKS_API_KEY=pw_test_... PAYERWORKS_BASE_URL=<the base URL shown with your key> node organizations.mjs
// A test key and invented data only. Payerworks sends nothing to a payer: every file it writes is yours.
//
// Keys call the API; members manage the account. A member signs in at payerworks.com/console with a
// password and an authenticator app, and the organization routes take that sign-in. With a key, this
// file reads the one role table and shows the refusal every other organization route gives a key.
import { pathToFileURL } from 'node:url';
import { Payerworks, PayerworksError } from './payerworks.mjs';
import { refusalOf } from './sample-data.mjs';

/** @param {Payerworks} pw */
export async function run(pw) {
  // 1. The one role table, the same for every organization: readable with a key.
  const table = await pw.getOrgRoles();

  // 2. The failure path: the organization itself answers a member's sign-in, never a key.
  const refused = await refusalOf(() => pw.getOrg(), { PayerworksError });

  return {
    roles: table.roles.map((r) => r.role),
    permissions: table.permissions.length,
    owner_rules: table.owner_rules.length,
    refused,
  };
}

// Run as a script: node <this file>, with PAYERWORKS_API_KEY and PAYERWORKS_BASE_URL set.
if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  console.log(JSON.stringify(await run(new Payerworks()), null, 2));
}

{
  "roles": [
    "owner",
    "admin",
    "developer",
    "viewer"
  ],
  "permissions": 22,
  "owner_rules": 4,
  "refused": {
    "status": 401,
    "code": "org_session_required",
    "request_id": "req_2"
  }
}