What this screen is for
An organisation is what actually owns things: the plan, the seats, the domains and the tokens all hang off it. This is where you read one, and it is the only place in the product where support can change one.
The search reaches further than the name
The search box matches the organisation's name or slug, a member's email address, or a monitored domain. That is deliberate and it is the whole reason the search is worth having: a support conversation almost never starts with an organisation name. It starts with "this person emailed us" or "mail from this domain is not working", and searching only the name would answer both with "no such account".
Reading the allowances
Two numbers are shown for seats, and two for domains: what the plan sells, and what is in force. They differ when support has set an override on this one account, and the screen says so rather than leaving you to compare them.
An override belongs to one organisation. It exists so that giving one customer a sixth domain does not mean giving it to every customer on that plan, and does not mean inventing a private plan row for them - which turns the plan list into a customer list and makes every report that groups by plan start lying.
Clearing an override does not set the number to zero. It removes it, and the plan decides again.
The four changes, and what each one actually does
- Change plan
- Moves the organisation onto another tier. It takes effect on the account’s very next request - seats, domains, tokens, DNS mutation and the rate allowance are all read from the plan each time, not remembered from sign-in. Moving DOWN can put an account over its new limit; nothing is deleted, but they will not be able to add more.
- Set the seat allowance
- An override for this organisation only. Below the number of seats already in use it does not remove anybody - it stops more being invited.
- Set the domain allowance
- The same, for monitored domains.
- Suspend / reinstate
- The dangerous one. See below.
Every one of them asks you to confirm, states the consequence in words first, and takes a reason. The reason is written to the audit trail beside the old and the new value. It is for whoever opens this account next; it is never shown to the customer.
What suspending really does
A suspension stops the account working, for everybody on it, at once
Every request from every credential every member holds is refused while the organisation is suspended - the web app, their API tokens, and any MCP client they run. It is immediate; there is no grace period.
Nothing is deleted. Their domains, their check history and their tokens are all intact and all come straight back when the organisation is reinstated. A suspension is a switch, not an erasure.
The customer is told the account is suspended and to contact support. They are never shown the reason you typed.
The control is styled differently from the others on purpose, and it will not proceed without a reason. A suspension nobody can explain later becomes, by default, a mistake.
What this screen does not do
It cannot close an account. Closing has retention and billing consequences that belong in a deliberate flow, not on a support screen.
It cannot show a token value, mint a token, or revoke one. Tokens are listed as metadata - name, prefix, scopes, status, when it was last used - because a token value is not stored anywhere in the product; only a one-way hash of it is.
It cannot add or remove a member, or change anybody's role. Those belong to the customer, in their own panel.