Organizations

Every table, row, run, integration, wiki page, member, and credit belongs to exactly one organization, and each org's data sits in its own tenant database schema. Nothing crosses that line except a billing link (below).

Projects

Within an org, tables and workflows can be grouped into projects. The default project is general.

oxygen projects list --json                                # every folder with its tableCount
oxygen projects create "Outbound Q1" --json
oxygen tables move leads-us leads-eu leads-uk --project outbound-q1 --json   # one or several tables, one call
oxygen projects rename outbound-q1 --name "Pipeline Q1" --json
oxygen projects delete pipeline-q1 --json                 # dry-run preview
oxygen projects delete pipeline-q1 --live --confirm --expected-table-ids "<table-id-1>,<table-id-2>" --json

projects list reports each folder's active table count as tableCount, so empty and oversized folders are visible without listing every folder's tables one at a time. tables move takes one or several table ids or slugs and moves them into the folder in one call; with several, each table is reported separately under results, a bad reference fails only that one, and the response deep-links to the folder.

A project is a grouping for navigation, not a separate billing or permission boundary. Rename changes its name and slug without renaming the physical database schema. Deleting a folder also deletes its tables: they disappear from normal listings immediately and enter the standard 14-day recovery period. You do not need to move them first. Restoring a table also restores its folder. CRM-backed tables remain protected, and the default general project cannot be renamed or deleted.

A bare delete previews every affected table without changing anything. For a nonempty folder, copy those table IDs into --expected-table-ids when confirming with --live --confirm. Changed folder contents require a fresh preview. Empty folders need only --live --confirm. The web confirmation handles the table IDs for you and lists the affected tables before deletion.

Projects also carry workspace tags: oxygen projects tag <project> --tags <csv>.

Each project is tinted in the Tables rail so folders are distinguishable at a glance. The colour is assigned automatically from the workspace's project order; set your own with oxygen projects color <project> --color <name> (gray means no tint), and --color auto restores the automatic one.

Switching orgs

oxygen orgs list --json
oxygen orgs use <slug>
oxygen whoami --json

oxygen whoami returns the active org with its plan_tier, entitled, shared_billing, billing_owner_organization_id, and monthly_credit_cap, plus your membership and the API key in use. --summary-json prints the same identity with no credential-shaped fields, for health probes and logs.

Multi-org users

Agencies typically use one org per client. Org switching is per CLI profile or MCP session, so check the active org before importing client data or running paid work.

If an MCP client returns organization_selection_required, ask it to call oxygen_orgs_list and then oxygen_orgs_select for the intended workspace, or give that app a default workspace (below) so it stops asking.

Connected apps

Each app you connect to OXYGEN with OAuth (ChatGPT, Claude, Codex or any other MCP client) keeps its own default workspace: the workspace it works in without asking. Changing one app never changes another app or the CLI. Choosing a workspace inside the app, where its assistant calls oxygen_orgs_select, changes the same setting, so the latest choice wins.

• Web: the Connected apps page lists every connected app, when it was last used, and a default-workspace picker for each. Ask each time clears the default.

• CLI:

  oxygen connectors list --json
  oxygen connectors set ChatGPT --default-workspace "Acme GTM"   # use the id when two apps share a name
  oxygen connectors set <id> --clear-default-workspace           # ask each time again

• MCP: oxygen_connector_list and oxygen_connector_update; connection: "current" is the app you are talking to.

• ChatGPT: the OXYGEN app's settings page in ChatGPT shows the same default-workspace picker.

An app appears after its first request to OXYGEN. Connected apps belong to you rather than to a workspace, so a workspace API key (oxy_live_…) cannot read or change them; use your own sign-in (oxygen login).

Events an app is subscribed to

An app connected with OAuth, such as ChatGPT, can subscribe to OXYGEN events: a reply was classified, a Sequence enrollment ended, a meeting was processed, a record changed stage, a run settled, or a run is waiting for approval. OXYGEN then sends that app an id-only notice for each matching event (ids, statuses, counts and a link to OXYGEN, never message text, names or contact details). A subscription lasts at most 24 hours unless the app renews it.

You can see what each app is subscribed to, in which workspace and with which filters, and every recent delivery with its status, attempts and failure reason (never its content). Revoking a subscription stops those events at once, and the app cannot renew it.

• Web: the Connected apps page, the app's Events column.

• CLI:

  oxygen connectors events get ChatGPT --json                       # subscriptions and recent deliveries
  oxygen connectors events revoke ChatGPT --subscription <id> --json
  oxygen connectors events revoke ChatGPT --subscription all --workspace "Acme GTM"

• MCP: oxygen_connector_events_get and oxygen_connector_events_revoke.

oxygen connectors list shows how many live subscriptions each app holds (event_subscriptions.active). Revoking changes nothing else about the app; to disconnect the app itself, remove it in that app's own settings.

Daily credit ceiling

An app that reacts to OXYGEN events can run with nobody watching, so while an app holds event subscriptions in a workspace, every paid call it makes there counts against its daily credit ceiling: the most credits it may spend in any rolling 24 hours. A call that would go past the ceiling is refused before anything runs, with how much was spent and when room opens again. The call's own max_credits still applies inside the ceiling. OXYGEN cannot tell a call ChatGPT makes on its own from one you watch, so the ceiling counts every paid call of a subscribed app.

The default is your plan's trigger default, 10% of the plan's monthly credits (oxygen limits show reports it as connected_app_daily_credit_ceiling). You can set a lower or higher ceiling per app; above the default also needs your explicit approval, the same as an Agent run ceiling.

• Web: the Connected apps page, the Daily credit ceiling column, with what the app spent in the last 24 hours.

• CLI:

  oxygen connectors get ChatGPT --json                                   # credit_ceiling: the ceiling, what it spent, what is left
  oxygen connectors set ChatGPT --credit-ceiling 300
  oxygen connectors set ChatGPT --credit-ceiling 5000 --approve-above-default
  oxygen connectors set ChatGPT --clear-credit-ceiling                    # back to the plan default

• MCP: oxygen_connector_update with credit_ceiling (and approve_above_default).

• ChatGPT: the app's settings page in ChatGPT shows the ceiling read-only; it can only be changed in OXYGEN.

Billing ownership

Each org owns its own credit balance by default. A workspace with no plan of its own can be covered by a plan you already pay for in another org instead of buying a second subscription.

oxygen orgs billing-owners --json                          # which of your orgs may pay, and why the rest may not
oxygen orgs billing-link --owner <org> --json              # omit --owner when exactly one is eligible
oxygen orgs billing-link --owner <org> --monthly-credit-cap 50000 --json
oxygen orgs billing-unlink --json

Credit billing moves; data access does not — a billing owner gains no read of the linked workspace. It does see what each linked workspace spends: oxygen billing usage --group-by workspace --json from the paying org totals the credits per workspace (usage per client workspace). billing-link targets the active org unless you pass --organization. Omitting --monthly-credit-cap leaves any existing cap untouched rather than clearing it.

Linking needs admin in both organizations, and the workspace being linked must not already have its own subscription.

The workspace uses its billing owner's credits and plan. Read oxygen billing estimate --json: when sender_billing is credit_reservations, the owner's credits fund connected accounts, sending and supported publishing, even if plan_tier is free, but adding a sending account needs the owner's paid plan. oxygen billing seats --json then reports status: seats_retired; adding dollar seats is refused. Your own provider keys and Instagram, TikTok, YouTube and Facebook publishing still need a paid plan. On the legacy sending_seats model, the owner's paid plan and purchased or grandfathered seats cover connections, and seats are managed on the owner. The response names the model in force. OAuth connections to your own tools are open on every plan.

Members

oxygen orgs member-role <email> --role admin|member        # admin only

Inviting people is still done in workspace settings; this only moves an existing member between the two workspace roles. Demote an admin to member before granting them the restricted client role — an admin's role overrides the restriction.

Related

• Workspace context — what to put in your org once it's created.
• Billing — credit balance and subscription per org.