Organizations

Daytona provides organizations as a way to group resources and enable collaboration. Users can work individually in their personal organization or together in a collaborative organization.

Manage your organizations in the Daytona Dashboard ↗ or through the API.

Personal vs Collaborative

Every Daytona user starts with a personal organization for solo use and experimentation. Collaborative organizations are created manually for teams, with shared access and controls.

Switch between personal and collaborative organizations with the dropdown in the Daytona Dashboard ↗ sidebar. Each organization has its own sandboxes, API keys, and resource quotas.

Create organization

Create organizations in the Daytona Dashboard ↗ or with the API.

1. Go to Daytona Dashboard ↗
2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
3. Click Create Organization
4. Enter the organization name
5. Select a region
6. Click Create

daytona org create 'My Organization'

Operations

List organizations

List all organizations the authenticated user belongs to.

daytona org list

Select organization

Select the organization that following CLI commands run against. The CLI also restores the project you last used in that organization, or its default project. Pass an ID or an unambiguous name; with no argument, the CLI shows a picker at a terminal.

daytona org use ORGANIZATION_ID

Get by ID

Get an organization by ID.

daytona org get ORGANIZATION_ID

Current user

# The signed-in user, the credential in use, and the selected organization and project
daytona whoami

Current organization API key

Get the organization API key that authenticates the request, with the organization permissions it holds now. The response never contains the token.

curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/api-keys/current' \
  --header 'Authorization: Bearer YOUR_ORG_API_KEY'

{
  "id": "KEY_ID",
  "org_id": "ORGANIZATION_ID",
  "name": "my-org-key",
  "key_prefix": "dtno_...",
  "org_permissions": ["read:audit"],
  "created_at": "2026-09-10T12:00:00Z",
  "expires_at": null,
  "last_used_at": "2026-09-11T08:30:00Z",
  "revoked_at": null
}

Rename organization

Rename an organization. The new name follows the same rules as on create: it is trimmed, and must be 1 to 100 characters with no control characters.

daytona org update ORGANIZATION_ID --name 'New Organization Name'

Leave organization

Leave an organization.

1. Go to Daytona Dashboard ↗
2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
3. Select the organization you want to leave
4. Click Settings in the sidebar
5. Click Leave Organization
6. Confirm by clicking Leave

daytona org leave ORGANIZATION_ID

Delete organization

Delete an organization.

1. Go to Daytona Dashboard ↗
2. Expand the dropdown at the top-left corner of the sidebar to view your organizations
3. Select the organization you want to delete
4. Click Settings in the sidebar
5. Click Delete Organization
6. Confirm the deletion by typing the organization name and clicking Delete

daytona org delete ORGANIZATION_ID

Roles

Each member of an organization holds one or more roles. A role is a set of permissions, and a member's permissions are the union of the permissions of all roles they hold. Daytona provides the built-in roles below, and an organization on the Enterprise plan can also define custom roles from its own choice of permissions. The admin role is protected: the organization must always keep at least one admin, and only an admin can grant or remove it. An invitation that names no roles grants the developer role.

List roles

List all roles in an organization: the built-in roles, then the organization's custom roles by name.

# The built-in roles and the permissions each role grants
daytona role list

Get role

Get one role of an organization, built-in or custom, with the permissions it grants.

# ROLE_ID is the identifier of a built-in role, such as developer, or the UUID of a custom role
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/roles/ROLE_ID' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'

Create custom role

Define a role from your own choice of permissions. A custom role can grant only permissions you hold. Every role includes the organization read permission, and a role that grants any project permission also includes the permissions to read projects and to create project API keys. Custom roles are assigned like built-in roles, to members, service accounts, and invitations.

curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/roles' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "name": "Sandbox operator",
  "description": "Runs and manages sandboxes",
  "project_permissions": ["read:sandboxes", "write:sandboxes"],
  "organization_permissions": ["read:organization", "read:projects", "write:project_api_keys"]
}'

Update custom role

Change the name, description, or permissions of a custom role. A permission list in the request replaces the role's list. Narrowing a role revokes the API keys of its holders that exceed their new permissions. A preview reports what the same update would change without applying it. Built-in roles cannot be changed.

# Report what the update would change, without applying it
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/roles/ROLE_ID/update-preview' \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "project_permissions": ["read:sandboxes"]
}'

# Apply the update
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/roles/ROLE_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{
  "project_permissions": ["read:sandboxes"]
}'

Delete custom role

Delete a custom role. A role that a member, a service account, or a pending invitation holds cannot be deleted; remove it from them first. Built-in roles cannot be deleted.

curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/roles/ROLE_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'

List permissions

List the permissions that roles and API keys grant. Each permission has an identifier, a display name, and a display category. Project permissions apply to the resources inside a project, and organization permissions apply to the organization itself.

# Every permission; scope=project or scope=organization restricts the list to one scope
curl 'https://api.daytona.com/permissions?scope=project' \
  --header 'Authorization: Bearer YOUR_API_KEY'

Members

Daytona provides methods to manage members in an organization.

List members

List all members in an organization.

daytona member list --org ORGANIZATION_ID

Invite members

Invite a new user to an organization.

1. Go to Daytona Dashboard ↗
2. Click Invite Member
3. Enter the email address of the user you want to invite
4. Select one or more roles for the new user under Roles

daytona invite create mail@example.com --org ORGANIZATION_ID --role developer

Remove members

Remove a user from an organization.

1. Go to Daytona Dashboard ↗
2. Click Remove next to the user you want to remove
3. Confirm the removal by clicking Remove

# Preview what the member loses before removing them
daytona member remove USER_ID --org ORGANIZATION_ID --dry-run

daytona member remove USER_ID --org ORGANIZATION_ID

Update access

Update the access of a member in an organization.

1. Go to Daytona Dashboard ↗
2. Click the three-dot menu on the member row
3. Click Edit roles
4. Select the member's roles and click Save

# Replace the member's role set
daytona member update USER_ID --org ORGANIZATION_ID --role maintainer,billing

# Rehearse the change without applying it
daytona member update USER_ID --org ORGANIZATION_ID --role read-only --dry-run

Invitations

View an organization invitation from the link or token in the invitation email.

1. Open the link in the invitation email; it opens Daytona Dashboard ↗
2. Review the organization, inviter, roles, and expiry of the invitation

# Show the invitation behind the dtni_ token or the link from the invitation email
daytona invite get INVITATION_TOKEN

Accept invitation

Accept a pending organization invitation.

1. Open the link in the invitation email; it opens Daytona Dashboard ↗
2. Sign in if prompted
3. Review the organization, inviter, roles, and expiry of the invitation
4. Click Accept

daytona invite accept INVITATION_TOKEN

Once a user accepts an invitation to join an organization, they get access to the organization's resource quotas and can create an API key and sandboxes.

Decline invitation

Decline a pending organization invitation.

1. Open the link in the invitation email; it opens Daytona Dashboard ↗
2. Sign in if prompted
3. Review the organization, inviter, roles, and expiry of the invitation
4. Click Decline
5. Confirm by clicking Decline

daytona invite decline INVITATION_TOKEN

List pending

List pending invitations for an organization.

daytona invite list --org ORGANIZATION_ID

Cancel invitation

Cancel an invitation for an organization.

1. Go to Daytona Dashboard ↗
2. Scroll to the Invitations table
3. Click the three-dot menu on the invitation row
4. Click Cancel
5. Confirm by clicking Confirm

daytona invite revoke INVITATION_ID --org ORGANIZATION_ID

Limits

Get the effective organization limits and the current usage they are checked against. Each limit reports its effective cap and the usage counted against it. The member limit also counts the pending invitations that reserve a seat. A read with an API key returns the limits of the API key's organization and leaves out the member limit.

from daytona import Daytona

daytona = Daytona()

limits = daytona.v2.get_limits()
concurrent = limits.sandboxes.concurrent
print(f"Concurrent sandboxes: {concurrent.usage} of {concurrent.limit}")

Set the timeout cap

Set or clear the organization's maximum sandbox timeout. Daytona validates every sandbox timeout against this cap. The cap can be any value up to the platform maximum, and clearing it inherits the platform maximum.

# Cap every sandbox timeout in the organization at 1 hour
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "max_sandbox_timeout_seconds": 3600 }'

# Clear the cap and inherit the platform maximum
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID' \
  --request PATCH \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --data '{ "max_sandbox_timeout_seconds": null }'

Entitlements and feature flags

Entitlements are the capabilities an organization's plan grants; feature flags are platform switches evaluated per organization. Both are read-only and return every catalog key, so a client never has to guess at an absent key.

Entitlements

curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/entitlements' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'

{
  "entitlements": {
    "preview_warning_opt_out": false
  }
}

Feature flags

curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/feature-flags' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'

Preview warning

Turn the preview warning page off or on. It applies to every sandbox preview in the organization and decides whether a visitor sees the warning page first.

curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/preview-warning' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{ "disabled": true }'

OpenTelemetry configuration

Forward the logs, traces, and metrics of every sandbox in the organization to your OpenTelemetry collector. The forwarding configuration holds the OTLP/HTTP endpoint and the request headers to send. Getting the configuration requires the read:organization permission, and setting or deleting it requires the write:organization permission. For the requests and their fields, see forward sandbox telemetry.

Permissions

Organization settings and membership are governed by organization permissions, which you can grant through an organization role.

Every role includes the organization read permission, and leaving an organization requires only that permission. The audit logs record organization changes, invitations, and member changes.