Skip to content

Organizations

View as Markdown

Daytona provides organizations as a way to group resources and enable collaboration. Users can work individually in their personal organization or together in a collaborative organization.

Manage your organizations in the Daytona Dashboard ↗ or through the API.

Personal vs Collaborative

Section titled “Personal vs Collaborative”

Every Daytona user starts with a personal organization for solo use and experimentation. Collaborative organizations are created manually for teams, with shared access and controls.

FeaturePersonal organizationCollaborative organization
CreationAutomatic on signupManually by a user
MembersSingle user onlyMultiple users (invite-based)
Access ControlNo roles or permissionsRoles with fixed permission sets
BillingTied to individual userShared across team members
Use CasePersonal testing, small projectsCompany/team development and production
Quota ScopePer userShared across all members
DeletableNoYes (by admins)

Switch between personal and collaborative organizations with the dropdown in the Daytona Dashboard ↗ sidebar. Each organization has its own sandboxes, API keys, and resource quotas.

Create organization

Section titled “Create organization”

Create organizations in the Daytona Dashboard ↗ or with the API.

  1. Go to Daytona Dashboard ↗
  2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
  3. Click Create Organization
  4. Enter the organization name
  5. Select a region
  6. Click Create
Terminal window
daytona org create 'My Organization'

Operations

Section titled “Operations”

List organizations

Section titled “List organizations”

List all organizations the authenticated user belongs to.

Terminal window
daytona org list

Select organization

Section titled “Select organization”

Select the organization that following CLI commands run against. The CLI also restores the project you last used in that organization, or its default project. Pass an ID or an unambiguous name; with no argument, the CLI shows a picker at a terminal.

Terminal window
daytona org use ORGANIZATION_ID

Get by ID

Section titled “Get by ID”

Get an organization by ID.

Terminal window
daytona org get ORGANIZATION_ID

Current user

Section titled “Current user”
Terminal window
# The signed-in user, the credential in use, and the selected organization and project
daytona whoami

Current organization API key

Section titled “Current organization API key”

Get the organization API key that authenticates the request, with the organization permissions it holds now. The route accepts organization API keys only; a signed-in user token returns 403. The response never contains the token.

Terminal window
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/api-keys/current' \
  --header 'Authorization: Bearer YOUR_ORG_API_KEY'
{
  "id": "KEY_ID",
  "org_id": "ORGANIZATION_ID",
  "name": "my-org-key",
  "key_prefix": "dtno_...",
  "org_permissions": ["read:audit"],
  "created_at": "2026-09-10T12:00:00Z",
  "expires_at": null,
  "last_used_at": "2026-09-11T08:30:00Z",
  "revoked_at": null
}

Rename organization

Section titled “Rename organization”

Rename an organization. The new name follows the same rules as on create: it is trimmed, and must be 1 to 100 characters with no control characters.

Terminal window
daytona org update ORGANIZATION_ID --name 'New Organization Name'

Leave organization

Section titled “Leave organization”

Leave an organization.

  1. Go to Daytona Dashboard ↗
  2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
  3. Select the organization you want to leave
  4. Click Settings in the sidebar
  5. Click Leave Organization
  6. Confirm by clicking Leave
Terminal window
daytona org leave ORGANIZATION_ID
  • daytona org leave asks for confirmation.
  • daytona org leave revokes the API keys you minted in the organization.
  • daytona org leave forgets the project keys and platform tokens that the CLI cached for the organization.

Delete organization

Section titled “Delete organization”

Delete an organization.

  1. Go to Daytona Dashboard ↗
  2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
  3. Select the organization you want to delete
  4. Click Settings in the sidebar
  5. Click Delete Organization
  6. Confirm the deletion by typing the organization name and clicking Delete
Terminal window
daytona org delete ORGANIZATION_ID
  • daytona org delete asks for confirmation before deleting.
  • You cannot delete a personal organization.

Limits

Section titled “Limits”

Get the effective organization limits and the current usage they are checked against. Each limit reports its effective cap and the usage counted against it. The member limit also counts the pending invitations that reserve a seat.

Terminal window
# The argument is optional; omit it to use the selected organization
daytona org limits ORGANIZATION_ID
  • daytona org limits requires the read:organization permission.

Set the timeout cap

Section titled “Set the timeout cap”

Set or clear the organization’s maximum sandbox timeout. Daytona validates every sandbox timeout against this cap. The cap can be any value up to the platform maximum, which is 86400 seconds by default; clearing it inherits the platform maximum. The organization reports the cap as max_sandbox_timeout_seconds.

Terminal window
# Cap every sandbox timeout in the organization at 1 hour
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "max_sandbox_timeout_seconds": 3600 }'


# Clear the cap and inherit the platform maximum
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "max_sandbox_timeout_seconds": null }'
FieldTypeDescription
max_sandbox_timeout_secondsintegerSets the cap in seconds, up to the platform maximum. A value of null clears the cap. A value above the platform maximum returns 400.
  • The response is the updated organization.
  • Setting the cap accepts only a signed-in user token and requires the write:organization permission.

Entitlements and feature flags

Section titled “Entitlements and feature flags”

Entitlements are the capabilities an organization’s plan grants; feature flags are platform switches evaluated per organization. Both are read-only and return every catalog key, so a client never has to guess at an absent key. Requires read:organization, which every role includes.

Entitlements

Section titled “Entitlements”
Terminal window
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/entitlements' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
{
  "entitlements": {
    "preview_warning_opt_out": false
  }
}

Feature flags

Section titled “Feature flags”
Terminal window
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/feature-flags' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'

Preview warning

Section titled “Preview warning”

Turn the preview warning page off or on. It applies to every sandbox preview in the organization and decides whether a visitor sees the warning page first.

Terminal window
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/preview-warning' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{ "disabled": true }'
FieldTypeDescription
disabledbooleanTurns the preview warning off when true and on when false.
  • PATCH /orgs/ORGANIZATION_ID/preview-warning requires the write:organization permission.
  • The preview warning has no GET route.
  • The current value is the preview_warning_disabled field of the organization that the list and get routes return.

Telemetry forwarding

Section titled “Telemetry forwarding”

Get the configuration

Section titled “Get the configuration”

Get the telemetry forwarding configuration. Daytona forwards the organization’s sandbox logs, traces, and metrics to the OTLP/HTTP endpoint in this configuration. The response lists the names of the configured request headers; header values are write-only and never returned.

Terminal window
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/otel-config' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
{
  "endpoint": "https://otel.example.com",
  "header_names": ["Authorization"],
  "created_at": "2026-09-10T12:00:00Z",
  "updated_at": "2026-09-10T12:00:00Z"
}

Set the configuration

Section titled “Set the configuration”

Set telemetry forwarding. Each write replaces the whole configuration, including headers.

Terminal window
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/otel-config' \
  --request PUT \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "endpoint": "https://otel.example.com",
  "headers": { "Authorization": "Bearer YOUR_COLLECTOR_TOKEN" }
}'
FieldTypeDescription
endpointstringRequired. Must use https, be at most 2048 bytes, and resolve only to public IP addresses; localhost and local host names are refused. The collector appends /v1/logs, /v1/traces, or /v1/metrics to the endpoint for each signal.
headersobjectHolds at most 16 entries and at most 16 KiB of names and values in total. Header names are 1 to 128 bytes and unique regardless of case. Header values are 1 to 4096 bytes of visible ASCII, space, or tab. You cannot set transport headers such as Host, Content-Type, and Content-Length. You also cannot set User-Agent or any Proxy-* header. To keep a stored header value without resending the value, pass ******** as the value.

Delete the configuration

Section titled “Delete the configuration”

Delete the telemetry forwarding configuration. Sandbox telemetry stops being forwarded.

Terminal window
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/otel-config' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
  • The request returns 204 No Content, also when no configuration is set.

macOS settings

Section titled “macOS settings”

The macOS settings control auto-reserve for macOS sandboxes. With auto-reserve on, a macOS create in a region where the organization holds no live Mac reservation buys a 24-hour reservation that renews while a sandbox runs on it. Auto-reserve is on by default, and the organization caps how many auto-reserved reservations it holds at once.

Get the settings

Section titled “Get the settings”

Get the organization’s macOS settings.

Terminal window
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/macos-settings' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
{
  "macos_auto_reserve": true,
  "macos_auto_reserve_max_reservations": 2,
  "macos_auto_reserve_disabled_at": null,
  "macos_auto_reserve_disabled_by": null
}

The response has the following fields:

FieldDescription
macos_auto_reserveShows whether auto-reserve is on.
macos_auto_reserve_max_reservationsThe most auto-reserved reservations the organization holds at once.
macos_auto_reserve_disabled_atRecords when auto-reserve was last turned off. The value is null while auto-reserve is on.
macos_auto_reserve_disabled_byRecords who last turned auto-reserve off. The value is null while auto-reserve is on.
  • GET /orgs/ORGANIZATION_ID/macos-settings requires the read:organization permission.

Set the settings

Section titled “Set the settings”

Turn auto-reserve on or off, or change the cap on auto-reserved reservations. Fields left out of the request keep their stored values.

Terminal window
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/macos-settings' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{ "macos_auto_reserve": true, "macos_auto_reserve_max_reservations": 4 }'
FieldTypeDescription
macos_auto_reservebooleanTurns auto-reserve on or off. If omitted, the stored value stays unchanged. Turning auto-reserve off while it is already off keeps the original macos_auto_reserve_disabled_at and macos_auto_reserve_disabled_by. Turning auto-reserve on clears both fields.
macos_auto_reserve_max_reservationsintegerSets the most auto-reserved reservations the organization holds at once. If omitted, the stored value stays unchanged. The value must be at least 1. A cap below 1 returns 400.
  • PATCH /orgs/ORGANIZATION_ID/macos-settings requires the write:organization permission.
  • Set at least one field in the request.

Roles

Section titled “Roles”

Each member of an organization holds one or more roles. A role is a fixed set of permissions, and a member’s permissions are the union of the permissions of all roles they hold. The admin role is protected: the organization must always keep at least one admin, and only an admin can grant or remove it. An invitation that names no roles grants the developer role.

RoleDescription
adminFull control of the organization, its members, and everything in it
maintainerFull control of everything inside the organization’s projects, with no authority over the organization itself
developerRun and manage sandboxes, invoke functions, and view everything a sandbox can use
read-onlyView every project resource, and change none of them
memberSign in and see the organization, with no access to any resource
auditorRead the organization’s audit log, without the ability to turn it off
billingSee what the organization spends and manage how it pays
spending-viewerSee what the organization spends, and nothing about how it pays
sso-adminConfigure single sign-on for the organization
infrastructure-adminManage the organization’s own regions and runners
sandboxes-managerCreate, change, and delete sandboxes
snapshots-managerCreate, change, and delete snapshots and images
registries-managerCreate, change, and delete private container registries
secrets-managerCreate, change, and delete project secrets
functions-managerDeploy, invoke, change, and delete serverless functions

List roles

Section titled “List roles”

List all roles in an organization.

Terminal window
# The fixed role catalog and the permission each role grants
daytona role list

Members

Section titled “Members”

Daytona provides methods to manage members in an organization.

List members

Section titled “List members”

List all members in an organization.

Terminal window
daytona member list --org ORGANIZATION_ID

Invite members

Section titled “Invite members”

Invite a new user to an organization.

  1. Go to Daytona Dashboard ↗
  2. Click Invite Member
  3. Enter the email address of the user you want to invite
  4. Select one or more roles for the new user under Roles
Terminal window
daytona invite create mail@example.com --org ORGANIZATION_ID --role developer
FlagTypeDescription
--rolestringA comma-separated list of role slugs.
  • When the deployment sends no email, daytona invite create prints the invitation link instead.

Remove members

Section titled “Remove members”

Remove a user from an organization.

  1. Go to Daytona Dashboard ↗
  2. Click Remove next to the user you want to remove
  3. Confirm the removal by clicking Remove
Terminal window
# Preview what the member loses before removing them
daytona member remove USER_ID --org ORGANIZATION_ID --preview


daytona member remove USER_ID --org ORGANIZATION_ID

Update access

Section titled “Update access”

Update the access of a member in an organization.

  1. Go to Daytona Dashboard ↗
  2. Click the three-dot menu on the member row
  3. Click Edit roles
  4. Select the member’s roles and click Save
Terminal window
# Replace the member's role set
daytona member update USER_ID --org ORGANIZATION_ID --role maintainer,billing


# Rehearse the change without applying it
daytona member update USER_ID --org ORGANIZATION_ID --role read-only --dry-run

Invitations

Section titled “Invitations”

View an organization invitation from the link or token in the invitation email.

  1. Open the link in the invitation email; it opens Daytona Dashboard ↗
  2. Review the organization, inviter, roles, and expiry of the invitation
Terminal window
# Show the invitation behind the dtni_ token or the link from the invitation email
daytona invite show INVITATION_TOKEN

Accept invitation

Section titled “Accept invitation”

Accept a pending organization invitation.

  1. Open the link in the invitation email; it opens Daytona Dashboard ↗
  2. Sign in if prompted
  3. Review the organization, inviter, roles, and expiry of the invitation
  4. Click Accept
Terminal window
daytona invite accept INVITATION_TOKEN

Once a user accepts an invitation to join an organization, they get access to the organization’s resource quotas and can create an API key and sandboxes.

Decline invitation

Section titled “Decline invitation”

Decline a pending organization invitation.

  1. Open the link in the invitation email; it opens Daytona Dashboard ↗
  2. Sign in if prompted
  3. Review the organization, inviter, roles, and expiry of the invitation
  4. Click Decline
  5. Confirm by clicking Decline
Terminal window
daytona invite decline INVITATION_TOKEN

List pending

Section titled “List pending”

List pending invitations for an organization.

Terminal window
daytona invite list --org ORGANIZATION_ID

Cancel invitation

Section titled “Cancel invitation”

Cancel an invitation for an organization.

  1. Go to Daytona Dashboard ↗
  2. Scroll to the Invitations table
  3. Click the three-dot menu on the invitation row
  4. Click Cancel
  5. Confirm by clicking Confirm
Terminal window
daytona invite revoke INVITATION_ID --org ORGANIZATION_ID