User Management

Manage the people in your Horizon organization — invite them by email, change their roles, manage pending invitations, deactivate and reactivate members, and leave an organization.

User management is where owners and admins bring people into the organization, set their roles, and deactivate them when they leave.

Opening User Management

Go to Settings > Users. Only owners and admins can invite people, change roles, and deactivate or reactivate members.

The page has two views:

• Team Members lists everyone in the organization.
• Pending Invitations lists invitations that have not been accepted yet. Older invitations are under Past invitations.

Inviting Users

1. Select Invite User.
2. Enter the person’s Email.
3. Pick a Role. Every role except Owner is offered.
4. Optionally enter a Department Scope.
5. Select Send Invite.

The person receives an email inviting them to join your organization. In Pending Invitations, the Expires column shows when each invitation lapses, and Resend and Cancel act on it.

Changing a Role

Select Edit Role on the member’s row, pick the new Role, and select Save. The change takes effect at once.

Deactivating a User

Deactivating a user removes their access to the organization without deleting their account or anything they created. Only an owner or admin can deactivate a user, and an owner cannot be deactivated.

1. In Settings > Users, select Deactivate on the user’s row.
2. Read the confirmation. It lists what stops working while the user is deactivated.
3. To keep the user’s agent webhooks running, select Move webhooks to me. See Move webhooks to me.
4. Select Deactivate.

The confirmation lists two things, when the user has any:

• Agent webhooks: the webhooks the user created on your organization’s agents, each with the name of its agent. A webhook’s name links to the Webhooks tab of its agent deployment, and a switched-off webhook is marked disabled. These webhooks stop running while the user is deactivated, and reactivating the user resumes them.
• API keys: the user’s keys in your organization that are active and have not expired, with each key’s name, the first characters of the key and when it was last used. These keys stop working while the user is deactivated. Manage API keys opens Settings > API Keys.

If the user has neither, the confirmation says Nothing else is affected. If Horizon cannot check the webhooks at that moment, it says Couldn’t load webhooks. You can still deactivate the user, and any webhooks they created stop running.

When a user is deactivated:

• They lose access to the organization at once: Horizon refuses their requests.
• Any API keys created by the user stop working: requests with them get 403 MEMBER_DEACTIVATED. The keys are not revoked or deleted. See API Key Management.
• Any agent webhooks created by the user are paused: calls to them get 403 and start no run. See When the creator leaves.
• Nothing they created is deleted.

To reactivate a user, select Reactivate on their row in Settings > Users. Their role is unchanged, and their API keys work again. So do their webhooks, except any that were moved to someone else in the meantime.

Move webhooks to me

Move webhooks to me appears under the user’s webhooks in the confirmation. It moves all of them to you, so they keep running after the user is deactivated.

• They run as you from then on. On an agent whose memory belongs to each person, their runs read and write your memories on that agent, not the user’s. See Agent Memory.
• They move only to you, the person selecting the button. There is no way to choose anyone else, because a webhook’s runs read the memories of the person it runs as. If another admin should have them, that admin opens the same confirmation and moves them.
• Their URLs do not change, so whatever calls them needs no change.
• The move happens when you select the button, even if you then select Cancel instead of Deactivate. Reactivating the user later does not move the webhooks back.
• API keys cannot be moved. A key acts as the person who created it. To keep an integration working, create a key of your own in Settings > API Keys and switch the integration to it.

The confirmation then says how many webhooks moved, and how many could not be moved. Try again for those, or take each one over from its card once the user is deactivated. See Take over a paused webhook.

Take over a paused webhook

Once a user is deactivated, removed or has left, each webhook they created is paused, and its card on the Webhooks tab of its agent deployment is marked Paused: creator is no longer an active member. An owner or admin sees Take over on that card.

1. On the paused webhook’s card, select Take over.
2. Select Confirm.

The webhook runs as you from its next request, with the same URL. On an agent whose memory belongs to each person, its runs then use your memories. As with Move webhooks to me, it moves only to you, and it stays with you if the previous creator is reactivated or rejoins.

Take over is refused while the creator is still an active member, because the webhook is not paused and stays theirs. It is also refused for a webhook created before 24 September 2026, which has no creator on record, runs as no one and is never paused.

Removing a User

Settings > Users has no control that removes a user from your organization. From the dashboard, an admin ends someone’s access by deactivating them: see Deactivating a User. A membership can end in two ways:

• The person leaves, with Leave organization in Settings > General. See Leaving an organization.
• An API key removes them, with DELETE /api/v2/agent/users/:memberId in the App API. The key needs the delete permission on organization members (system.users). It cannot remove the person who created the key, the last active owner, or the organization’s last unscoped administrator. See Organization members.

Removal deletes the membership, in Horizon and in Clerk. It does not delete the person’s own sign-in account, and they can rejoin only if they are invited again or added back through the App API.

A removed user’s API keys stop working, with 401 KEY_OWNER_NOT_FOUND, and agent webhooks they created are paused. Neither is revoked or deleted: if the same person rejoins your organization, their keys work again, and so do their webhooks unless someone has moved them.

• Webhooks: an owner or admin can take over each paused webhook from its card. It then runs as them, with the same URL. See Take over a paused webhook. To keep the webhooks running without a pause, deactivate the user first and select Move webhooks to me.
• API keys cannot be moved. Create new keys as a current member, and give them to whatever used the old ones.

Leaving an organization

You can remove yourself from an organization under Leave organization in Settings > General. While the organization has only one active owner or admin, the button is unavailable.

Leave organization opens a confirmation, Leave this organization?, that lists what stops working once you leave:

• Agent webhooks you created on the organization’s agents. They run as you, so they stop running once you leave. This confirmation cannot move them. If they should keep running, ask an owner or admin to move them to themselves before you leave, with Move webhooks to me in the Deactivate confirmation for you in Settings > Users (they can then cancel without deactivating you), or to take each one over from its card after you leave.
• API keys you created in the organization that are active and have not expired. They stop working once you leave.

If Horizon cannot check your webhooks at that moment, the confirmation says so, and you can still leave. Select Leave organization in the confirmation to leave. You lose access to the organization’s data right away, and an administrator has to invite you back.