> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chronosphere.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Teams
export const AddToDashboardIcon = props => {
return ;
};
export const CollectionIcon = props => {
const drawPath = "M21 6.5c-1.66 0-3 1.34-3 3 0 .07 0 .14.01.21l-2.03.68c-.64-1.21-1.82-2.09-3.22-2.32V5.91C14.04 5.57 15 4.4 15 3c0-1.66-1.34-3-3-3S9 1.34 9 3c0 1.4.96 2.57 2.25 2.91v2.16c-1.4.23-2.58 1.11-3.22 2.32l-2.04-.68C6 9.64 6 9.57 6 9.5c0-1.66-1.34-3-3-3s-3 1.34-3 3 1.34 3 3 3c1.06 0 1.98-.55 2.52-1.37l2.03.68c-.2 1.29.17 2.66 1.09 3.69l-1.41 1.77C6.85 17.09 6.44 17 6 17c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3c0-.68-.22-1.3-.6-1.8l1.41-1.77c1.36.76 3.02.75 4.37 0l1.41 1.77c-.37.5-.59 1.12-.59 1.8 0 1.66 1.34 3 3 3s3-1.34 3-3-1.34-3-3-3c-.44 0-.85.09-1.23.26l-1.41-1.77c.93-1.04 1.29-2.4 1.09-3.69l2.03-.68c.53.82 1.46 1.37 2.52 1.37 1.66 0 3-1.34 3-3S22.66 6.5 21 6.5zm-18 4c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1-.45 1-1 1zM6 21c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1-.45 1-1 1zm5-18c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1-1-.45-1-1zm1 12c-1.38 0-2.5-1.12-2.5-2.5S10.62 10 12 10s2.5 1.12 2.5 2.5S13.38 15 12 15zm6 4c.55 0 1 .45 1 1s-.45 1-1 1-1-.45-1-1 .45-1 1-1zm3-8.5c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1-.45 1-1 1z";
return ;
};
export const CollectionNavIcon = props => {
const drawPath = "M8.4 18.2C8.8 18.7 9 19.3 9 20C9 21.7 7.7 23 6 23S3 21.7 3 20 4.3 17 6 17C6.4 17 6.8 17.1 7.2 17.3L8.6 15.5C7.7 14.5 7.3 13.1 7.5 11.8L5.5 11.1C5 11.9 4.1 12.5 3 12.5C1.3 12.5 0 11.2 0 9.5S1.3 6.5 3 6.5 6 7.8 6 9.5V9.7L8 10.4C8.6 9.2 9.8 8.3 11.2 8.1V5.9C10 5.6 9 4.4 9 3C9 1.3 10.3 0 12 0S15 1.3 15 3C15 4.4 14 5.6 12.8 5.9V8.1C14.2 8.3 15.4 9.2 16 10.4L18 9.7V9.5C18 7.8 19.3 6.5 21 6.5S24 7.8 24 9.5 22.7 12.5 21 12.5C19.9 12.5 19 11.9 18.5 11.1L16.5 11.8C16.7 13.1 16.3 14.5 15.4 15.5L16.8 17.3C17.2 17.1 17.6 17 18 17C19.7 17 21 18.3 21 20S19.7 23 18 23 15 21.7 15 20C15 19.3 15.2 18.7 15.6 18.2L14.2 16.4C12.8 17.2 11.2 17.2 9.8 16.4L8.4 18.2Z";
return ;
};
export const ServiceIcon = props => {
return ;
};
export const ServiceNavIcon = props => {
return ;
};
export const CSharpIcon = props => ;
export const PipeIcon = props => ;
A *team* defines how an organization grants permissions for sensitive
management and administrative operations to *accounts*, including
[*user accounts*](/administer/accounts-teams/user-accounts) and
[*service accounts*](/administer/accounts-teams/service-accounts).
A team's accounts have a shared responsibility for certain services. Chronosphere
Observability Platform represents those services as
[*collections*](/administer/collections), which contain resources related to the
service a collection represents, such as dashboards and monitors. A team can own
multiple collections.
All user and service accounts in a team that has the special System Administrator
(`SysAdmin`) role are *administrators*. If you're an administrator, you can
[add this role to a team](#add-a-role-to-a-team).
Teams can own collections and services, which in turn own other functions:
```mermaid actions={false} theme={null}
flowchart TD
accDescr: Ownership flow for teams and functions
Team[**Team**]
Col(Collections)
Ser(Services )
Team --> Col
Team --> Ser
Dash(Dashboards)
Mon(Monitors)
SLO(SLOs)
Col --> Dash
Col --> Mon
Col --> SLO
Dash2(Dashboards)
Mon2(Monitors)
SLO2(SLOs)
Ser --> Dash2
Ser --> Mon2
Ser --> SLO2
```
## View teams
To search for a team:
1. Click the search bar to focus on it, or use the keyboard shortcut
`Control+K` (`Command+K` on macOS).
2. Begin typing any part of the team's name.
3. Optional: Click the **Teams** filter at the top of the search results to
constrain your results to only Teams.
4. Click the search result you're interested in, or use the arrow keys to select it
and press enter, to go to that team.
### View teams and their collections
To view teams and the collections they own, in the navigation menu exit the **Admin**
menu (if needed, click ** Exit Admin**) and select
** Collections**. For details about working with collections,
see [Collections](/administer/collections).
### View a list of teams to manage
To view teams in a list that displays their members, provides an audit log of
membership changes, and includes management options for administrators:
In the navigation menu, click ** Go to Admin** and then select
**Platform > Teams**.
Use the command:
```shell theme={null}
chronoctl teams list
```
For details, see
[Accounts and Teams](/administer/accounts-teams#view-accounts-and-teams).
## Manage teams
To manage teams, you must use a user account or
[service account](/administer/accounts-teams/service-accounts) that belongs to a team
with the SysAdmin role.
To manage teams, in the navigation menu, click ** Go to Admin**
and then select **Platform > Teams**.
### Create a team
To create a new team:
1. In the navigation menu, click ** Go to Admin**
and then select
**Platform > Teams**.
2. Click **Create team**.
3. In the dialog that appears, enter a name for the new team and the access role it
should have.
4. Click **Save** to create the team.
The team now appears in the list of users and teams.
To create teams or modify team membership with Chronoctl, you must use a user account
or [service account](/administer/accounts-teams/service-accounts) that
belongs to a team with the SysAdmin role.
To create and manage a team with [Chronoctl](/tooling/chronoctl),
use the `Team` resource type. The resource can contain these fields:
| Field | Type | Description |
| ------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| `name` | String | The team name as displayed in Observability Platform. |
| `slug` | String | Optional: A unique identifier that Observability Platform uses to identify the team. If omitted, Observability Platform generates a slug. |
| `description` | String | Optional: A description displayed when viewing this team. |
| `user_emails` | Collection of strings | Contains an item for each member account's email address. |
To generate an example Team resource, run `chronoctl teams scaffold`.
If an email address in `users` doesn't already have an Observability Platform
account, the app creates a pending user account for that email address. When that
user signs in, Observability Platform then activates the account.
For example, this YAML resource creates a team named `DBAs` in Observability
Platform, with the description `Database administrators`, and which the app
identifies with the slug `dbas`. It also includes the listed accounts identified by
their email addresses as team members:
```yaml theme={null}
api_version: v1/config
kind: Team
spec:
name: DBAs
slug: dbas
description: "Database administrators"
user_emails:
- adam@example.com
- betty@example.com
```
To include service accounts, add the service account's internal email address to
the `users` list. For details, see [Service Accounts](/administer/accounts-teams/service-accounts).
To create teams or modify team membership with Terraform, you must use a user account
or [service account](/administer/accounts-teams/service-accounts) that
belongs to a team with the SysAdmin role.
To create and manage a team with [Terraform](/tooling/infrastructure/terraform),
declare the `chronosphere_team` resource type and provide a resource name. The resource
can contain these fields:
| Field | Type | Description |
| ------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| `name` | String | The team name as displayed in Observability Platform. |
| `slug` | String | Optional: A unique identifier that Observability Platform uses to identify the team. If omitted, Observability Platform generates a slug. |
| `description` | String | Optional: A description displayed when viewing this team. |
| `user_emails` | Array of strings | The email address for each member account. |
For example, this resource creates a team referred to by Terraform as `dbas`, named
`DBAs` in Observability Platform, and identified in the app with the slug `dbas`. It
also includes the listed accounts identified by their email addresses as team
members:
```terraform theme={null}
resource "chronosphere_team" "dbas" {
name = "DBAs"
slug = "dbas"
description = "Database administrators"
user_emails = [
"adam@example.com",
"betty@example.com",
]
}
```
To include service accounts, add the service account's internal email address to
the `user_emails` array. For details, see [Service Accounts](/administer/accounts-teams/service-accounts).
1. Add the definition to a Terraform file.
2. Run this command to create the resource:
```shell theme={null}
terraform apply
```
To complete this action with the Chronosphere API, use the
[`CreateTeam`](/tooling/api-info/definition/operations/CreateTeam) endpoint.
Because the Chronosphere API requires authentication, include an API token with your
`curl` request, as shown in the following example. For more details, see
[Create an API token](/tooling/api-info#create-an-api-token).
```shell /"TOKEN"/ /INSTANCE/ /METHOD/ /ENDPOINT_PATH/ theme={null}
export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"
curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
-X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"
```
Replace the following:
* *`TOKEN`*: Your API token.
* *`INSTANCE`*: The subdomain name for your organization's Observability Platform instance.
* *`METHOD`*: The HTTP method to use with the request, such as `GET` or `POST`.
* *`ENDPOINT_PATH`*: The specific endpoint you want to access.
### Edit team membership
To add users to or remove users from a team:
1. In the navigation menu, click ** Go to Admin** and then select
**Platform > Teams**.
2. [Select the team](/administer/accounts-teams#view-accounts-and-teams) to manage.
3. Click ** Edit Team**.
4. In the **Team Members** section, click **Update Membership**.
5. From the account list that appears, select the checkbox for each account you want
to add to the team, and clear the checkbox for each account you want to remove
from the team.
6. Click **Save** to edit the team's membership.
The team page updates its membership list accordingly, and the audit log adds an
entry logging the operation.
To modify teams with Chronoctl, you must use a user account or
[service account](/administer/accounts-teams/service-accounts) that
belongs to a team with the `SysAdmin` role.
You can use [Chronoctl](/tooling/chronoctl) to replace and update a team and
its membership with those defined in a YAML file.
To generate a YAML description of your current teams and accounts, see
[View Accounts and Teams](/administer/accounts-teams#view-accounts-and-teams).
Following the `DBAs` team example from [creating a team](#create-a-team),
to add a user to that team, update the YAML to include the new user's email:
```yaml theme={null}
api_version: v1/config
kind: Team
spec:
name: DBAs
slug: dbas
description: "Database administrators"
user_emails:
- adam@example.com
- betty@example.com
- charles@example.com
```
To apply the changes, use the Chronoctl `chronoctl teams update` command, which
updates teams but doesn't create them if they don't already exist:
```shell /FILE_NAME/ theme={null}
chronoctl teams update -f FILE_NAME.yaml
```
Replace *`FILE_NAME`* with the path to the YAML definition file.
You can test the changes without applying them by including the `--dry-run` flag:
```shell /FILE_NAME/ theme={null}
chronoctl teams update -f FILE_NAME.yaml --dry-run
```
To force `teams update` to create a defined team if it doesn't exist, include the
`--create-if-missing` flag:
```shell /FILE_NAME/ theme={null}
chronoctl teams update -f FILE_NAME.yaml --create-if-missing
```
To edit a team's membership using [Terraform](/tooling/infrastructure/terraform), modify the
`user_emails` array in the team's `chronosphere_team` resource, and then apply the
resource using Terraform.
To complete this action with the Chronosphere API, use the
[`UpdateTeam`](/tooling/api-info/definition/operations/UpdateTeam) endpoint.
Because the Chronosphere API requires authentication, include an API token with your
`curl` request, as shown in the following example. For more details, see
[Create an API token](/tooling/api-info#create-an-api-token).
```shell /"TOKEN"/ /INSTANCE/ /METHOD/ /ENDPOINT_PATH/ theme={null}
export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"
curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
-X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"
```
Replace the following:
* *`TOKEN`*: Your API token.
* *`INSTANCE`*: The subdomain name for your organization's Observability Platform instance.
* *`METHOD`*: The HTTP method to use with the request, such as `GET` or `POST`.
* *`ENDPOINT_PATH`*: The specific endpoint you want to access.
## Assign team roles and permissions
Observability Platform teams use *roles* to grant or restrict access to features
that create, edit, or delete resources, teams, and accounts. Roles are assigned
to teams, and all accounts that belong to a team gain the permissions granted by
that team's role.
During creation, accounts are assigned to the **Default** team, which has the `Editor`
role. The **Default** team can't be deleted, and its role can't be changed.
[Service accounts](/administer/accounts-teams/service-accounts#create-an-unrestricted-service-account)
also can't be removed from the **Default** team and therefore always have **Editor**
access.
To remove editing access from a user,
[remove the user from the **Default** team](#edit-team-membership). This limits
the user to read-only access provided they don't have edit
access through membership in another team.
The available roles are:
* `None`: Accounts on teams with this role can view pages in Observability Platform
but can't create, edit, or remove resources or accounts. Accounts that don't
belong to any team also have the `None` role by default.
* `Editor`: Accounts on teams with this role can create, view, edit, and delete
resources within Observability Platform, but can't create, edit, or delete accounts
and teams.
* `SysAdmin`: Any account that's a member of a team with the System Administrator
(`SysAdmin`) role can create, edit, and delete accounts and teams, assign accounts
to teams, and assign roles to teams. Accounts with this role are designated by a
key icon next to their name in the **Users** list.
* `User Administrator`: Accounts belonging to teams with this role can access the
System for Cross-domain Identity Management (SCIM) API, which manages accounts
that use single sign-on. This role grants no other permissions.
The `User Administrator` role can be assigned to teams only in organizations that
have SCIM integration enabled. For more information, see
[Okta user synchronization](/administer/accounts-teams/okta).
If an account belongs to multiple teams with different roles, they inherit the
highest-level permissions of each assigned team. For example, an account in a team
with the `Editor` role and a second team with the `SysAdmin` role has both sets of
privileges.
The following chart summarizes roles and permissions:
| Action | None | Editor | SysAdmin | User Admin |
| -------------------------------------------------- | :----------------------------------------: | :----------------------------------------: | :----------------------------------------: | :----------------------------------------: |
| Interact with SCIM API | | | | |
| View pages in Observability Platform | | | | |
| Add and edit user and service accounts | | | | |
| Add, edit, and remove teams | | | | |
| Change users' team membership | | | | |
| Apply service configuration changes | | | | |
| Add, edit, and remove trace control plane datasets | | | | |
| Add, edit, and remove derived labels | | | | |
| Add, edit, and remove other resources | | | | |
### Add a role to a team
To add a role to a team:
1. In the navigation menu, click ** Go to Admin** and then select
**Platform > Teams**.
2. [Select the team](/administer/accounts-teams#view-accounts-and-teams)
to manage.
3. In the **Team Information** section, click ** Edit**.
4. Click the **Role** dropdown and select the role you want to assign to the team.
5. Click **Save**.
### Remove a role from a team
To remove a role from a team:
1. In the navigation menu, click ** Go to Admin** and then select
**Platform > Teams**.
2. [Select the team](/administer/accounts-teams#view-accounts-and-teams) to manage.
3. In the **Team Information** section, click ** Edit**.
4. Click the **Role** dropdown and select the **None** role.
5. Click **Save**.
### Rename a team
To rename a team:
1. In the navigation menu, click ** Go to Admin** and then select
**Platform > Teams**.
2. [Select the team](/administer/accounts-teams#view-accounts-and-teams) to manage.
3. In the **Team Information** section, click ** Edit**.
4. Change the team's name in the **Name** field.
5. Click **Save**.
### Describe a team
Team pages can display a brief description in the **Team Information** section.
You can use this description to clarify the team's purpose, identify the people
responsible for managing it, or provide general information or context to the team's
activities.
You can also add links to URLs, whether within or external to Observability Platform,
to the **Team Information** section.
To access a team's information:
1. In the navigation menu, click ** Go to Admin** and then select
**Platform > Teams**.
2. [Select the team](/administer/accounts-teams#view-accounts-and-teams) to manage.
3. In the **Team Information** section, click ** Edit**.
To add, edit, or remove a team's description:
1. Enter the team description in the **Description** field.
2. Click **Save**.
To add links to a team's information:
1. In the **Team Links** section, click ** Add**. This
adds a row of fields to the section.
2. Enter the link text in the **Link Name** field.
3. Enter the link target in the **URL** field.
4. Repeat these steps to add more links.
5. Click **Save**.
To edit a team's links:
1. In the **Team Links** section, modify the link's **Link Name** and **URL** fields.
2. Click **Save**.
To remove links from a team's information:
1. In the **Team Links** section, click the delete
button in the rows of the links you want to delete.
2. Click **Save**.
### Delete a team
Use one of the following methods to delete a team. The **Default** team can't be
deleted.
To delete a team:
1. In the navigation menu, click ** Go to Admin** and
then select **Platform > Teams**.
2. [Select the team](/administer/accounts-teams#view-accounts-and-teams) to delete.
3. In the **Team Information** section, click ** Edit**.
4. Click **Delete team**.
5. In the confirmation dialog that appears, click **Delete**.
To delete teams with [Chronoctl](/tooling/chronoctl), use the `chronoctl teams delete`
command:
```shell /SLUG/ theme={null}
chronoctl teams delete SLUG
```
Replace *`SLUG`* with the unique slug of the team you want to delete.
For example, to delete the team with the slug `dbas`, run:
```shell theme={null}
chronoctl teams delete dbas
```
To delete a resource that's managed by [Terraform](/tooling/infrastructure/terraform):
1. Edit your Terraform configuration file to remove the pre-existing resource
definition.
2. Run this command to remove the resource from Observability Platform:
```shell theme={null}
terraform apply
```
To complete this action with the Chronosphere API, use the
[`DeleteTeam`](/tooling/api-info/definition/operations/DeleteTeam) endpoint.
Because the Chronosphere API requires authentication, include an API token with your
`curl` request, as shown in the following example. For more details, see
[Create an API token](/tooling/api-info#create-an-api-token).
```shell /"TOKEN"/ /INSTANCE/ /METHOD/ /ENDPOINT_PATH/ theme={null}
export CHRONOSPHERE_API_TOKEN="TOKEN"
export CHRONOSPHERE_DOMAIN="INSTANCE.chronosphere.io"
curl -H "API-Token: ${CHRONOSPHERE_API_TOKEN}" \
-X METHOD "https://${CHRONOSPHERE_DOMAIN}/ENDPOINT_PATH"
```
Replace the following:
* *`TOKEN`*: Your API token.
* *`INSTANCE`*: The subdomain name for your organization's Observability Platform instance.
* *`METHOD`*: The HTTP method to use with the request, such as `GET` or `POST`.
* *`ENDPOINT_PATH`*: The specific endpoint you want to access.