Update to Twilio Developer Kit

{
  "name": "twilio-organizations-setup",
  "description": "Set up and manage Twilio Organizations for centralized account and user governance. Covers the Organization > Account > Subaccount hierarchy, roles (Owner/Admin/Standard), managed vs independent accounts, domain registration, SSO enforcement, SCIM provisioning, and Organization merging. Use this skill when managing multiple Twilio accounts or users across teams.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 233
    }
  ],
  "skill_md_contents": "---\nname: twilio-organizations-setup\ndescription: >\n  Set up and manage Twilio Organizations for centralized account and user\n  governance. Covers the Organization > Account > Subaccount hierarchy,\n  roles (Owner/Admin/Standard), managed vs independent accounts, domain\n  registration, SSO enforcement, SCIM provisioning, and Organization\n  merging. Use this skill when managing multiple Twilio accounts or users\n  across teams.\n---\n\n## Overview\n\nEvery Twilio customer automatically gets an Organization when they sign up (auto-created since May 2024 for new signups; since June 2024 for existing paying customers). An Organization is the top-level container that groups accounts, users, and security policies. The creation has no effect on existing account functionality. Most developers never need to touch it — but as soon as you have multiple accounts, teams, or compliance requirements (SSO, HIPAA), Organization setup becomes essential.\n\n**Hierarchy:** Organization > Accounts > Subaccounts\n\n| Layer | What it is | When you need it |\n|-------|-----------|-----------------|\n| **Organization** | Centralized governance: users, accounts, domains, SSO | Multiple teams or accounts, SSO, HIPAA designation |\n| **Account** | Application boundary: all Twilio products, resources, billing live here | Always — you need at least one |\n| **Subaccount** | Isolated partition under an account: separate resources, consolidated billing | Multi-tenant apps, per-customer isolation |\n\n---\n\n## Organization vs Subaccount — When to Use Which\n\n| Dimension | Organization (Managed Accounts) | Subaccounts |\n|-----------|----------------------------------|-------------|\n| **Management** | Console UI + Organizations API | REST API (`/2010-04-01/Accounts`) |\n| **Billing** | Independent per account | Consolidated to parent account |\n| **Account limit** | 10 per Organization (default) | 1 per unupgraded account; 1,000 per upgraded account (contact AE for more) |\n| **User management** | Full lifecycle: invite, roles, SSO, SCIM | None — no user concept |\n| **SSO/SCIM** | Supported | Not applicable |\n| **HIPAA designation** | Per-account toggle in Admin console | Inherits from parent (new only) |\n| **Resource isolation** | Separate accounts, separate credentials | Separate but parent can access all |\n| **Cost** | Free | Free |\n\n**Rule of thumb:** Use **Organizations** when different teams/users need separate billing and access control. Use **Subaccounts** when your application needs programmatic multi-tenant isolation with consolidated billing.\n\n---\n\n## Organization Roles\n\n| Role | Capabilities | Limit |\n|------|-------------|-------|\n| **Owner** | Full control + sole authority to delete the Organization | 1 per Organization |\n| **Administrator** | Invite/remove users, add/create accounts, modify settings | Unlimited |\n| **Standard User** | Access only to specified accounts — no org management | Unlimited (default) |\n\nThe Organization creator is automatically assigned the Owner role.\n\n---\n\n## Setting Up Your Organization\n\n### Find Your Organization\n\nAll Twilio customers have an Organization (auto-created at signup). Access it via:\n\n- **Console > Settings** (gear icon) — shows Organization settings, or\n- **Twilio Admin** link in the top-right navigation — opens the Organization admin panel\n\n### Add Accounts to Your Organization\n\n**Create a new account:**\n1. Console > Admin > Accounts\n2. Click **Create New Account**\n3. Name the account, select Twilio or Flex usage\n4. Confirm — the account starts in trial mode with fresh defaults\n\n**Import an existing account:**\n1. Console > Admin > Accounts > **Add Existing Account**\n2. Enter the account's SID (find it in Console > Account > General settings)\n3. The account owner receives an email and must confirm\n\n**Requirement:** The account owner's email must match your Organization's verified domain.\n\n### Account Types\n\n| Type | Description |\n|------|-------------|\n| **Managed** | Owned by your Organization — full lifecycle control |\n| **Independent** | External account your users can access — you do NOT control it |\n| **Pending** | Added but awaiting owner confirmation |\n\n### Transfer Account Ownership\n\nOnly between managed users in the same Organization:\n1. Console > Admin > Accounts > select account\n2. Remove current owner, enter new owner's email or User SID\n3. Save\n\n---\n\n## Domain Registration\n\nRegister your company's email domain to control how employees interact with Twilio.\n\n**Console > Admin > Domains**\n\n| Setting | Behavior |\n|---------|----------|\n| **Restricted** | Users with your domain email can't sign up unless explicitly invited |\n| **Auto-enrollment** | Users who sign up with your domain automatically join your Organization |\n| **Blocked** | Users with your domain email cannot join this Organization |\n\nDomain registration also enables Organization merging — the Prime org must have verified domains.\n\n**Important:** Common domains (gmail.com, hotmail.com, etc.) cannot be verified — you cannot invite users from common domains. Enter domains without \"www.\" (e.g., `corporate.com`, not `www.corporate.com`). You can verify the same domain under multiple Organizations (with restrictions) or use subdomains (`stage.corporate.com`).\n\n---\n\n## SSO and SCIM\n\n- **SSO:** Enforce Single Sign-On at the Organization level via your identity provider (Okta, Azure AD, etc.). See [SSO docs](https://www.twilio.com/docs/iam/organizations/sso).\n- **SCIM:** Automate user provisioning and deprovisioning via the SCIM 2.0 API. See [SCIM docs](https://www.twilio.com/docs/iam/organizations/scim).\n\nWhen SSO is enabled on a verified domain, all users with that domain email must authenticate via SSO.\n\n---\n\n## Organization Merging\n\nCombine two Organizations: the **Prime** absorbs the **Candidate**.\n\n**Requirements:**\n- Prime must have verified domains\n- Candidate Owner's email must match Prime's verified domain\n- Candidate must have NO verified domains of its own\n\n**Post-merge:** Candidate ceases to exist. All accounts and users transfer to Prime. Billing and functionality unchanged. If Prime has SSO enabled, it applies to merged users.\n\n---\n\n## HIPAA Designation\n\nRequires an executed BAA with Twilio. After BAA:\n\n1. Console > Admin > Accounts > select account\n2. Enable HIPAA flag\n3. Save\n\n**Each account must be individually flagged** — existing accounts do NOT auto-inherit. New accounts created after designation DO inherit. See `twilio-security-compliance-hipaa` for full HIPAA guidance.\n\n---\n\n## User Management\n\n**Users are separate from accounts.** A user is defined by their login (email + password) and can own or have access to many accounts.\n\n- **Users can only belong to ONE Organization** — if they need access to multiple orgs, create a dedicated user per org (e.g., `user+org1@corporate.com`)\n- **Owner's accounts are auto-added** — any account owned by the Organization Owner is automatically added to that Organization and cannot be \"independent\"\n- **New accounts by managed users are auto-added** — accounts created by any managed user (Owner, Admin, Standard) automatically join the Organization\n- **New user signup behavior** is controlled by domain settings (Restricted/Auto-enrollment/Blocked)\n\n**Admin actions for managed users:**\n- **Reset password:** Admin Center > Users > Managed Users > select user > Reset Password (logs out user, sends 24-hour reset link)\n- **Reset 2FA:** Admin Center > Users > Managed Users > select user > Reset 2FA (removes current 2FA number, prompts for new one on next login)\n- **Bulk user import:** Available via Admin Center (contact Support if not enabled on your Organization)\n\n---\n\n## CANNOT\n\n- **Cannot create accounts via API at the Organization level** — Account creation within Organizations is Console-only. Subaccount creation via REST API is separate and lives under the parent account.\n- **Cannot close or delete an Organization from Console** — There is no self-service delete. To remove an Organization, merge it into another one.\n- **Cannot transfer ownership to an independent user** — Account ownership transfers are restricted to managed users within the same Organization.\n- **Cannot merge Organizations if the Candidate has verified domains** — Remove Candidate's domain verification first, or the merge will fail.\n- **Cannot assume configurations transfer to new accounts** — New managed accounts start with fresh defaults. Product configurations, phone numbers, and settings do not inherit.\n- **Cannot manage independent accounts' lifecycle** — You can grant your users access to independent accounts, but you cannot close, suspend, or modify them.\n- **Cannot have multiple Owners per Organization** — Exactly one. Transfer ownership before the current Owner leaves the company.\n- **A user cannot belong to multiple Organizations** — One user = one Organization. Use email aliases for multi-org access.\n- **Cannot verify common email domains** — gmail.com, hotmail.com, etc. are not supported for domain verification or user invitations.\n- **Cannot invite users from unverified domains** — Domain must be verified first before you can invite users with that domain email.\n- **Billing is NOT consolidated at the Organization level** — Each managed account is billed independently. For consolidated billing, use subaccounts under a single parent account instead.\n\n---\n\n## Next Steps\n\n- **Account and subaccount setup:** `twilio-account-setup`\n- **Authentication methods (API Keys, OAuth2):** `twilio-security-api-auth`\n- **HIPAA account configuration:** `twilio-security-compliance-hipaa`\n- **Credential security:** `twilio-security-hardening`\n- **Docs:** [Organizations overview](https://www.twilio.com/docs/iam/organizations) | [Managed accounts](https://www.twilio.com/docs/iam/organizations/managed-accounts)\n"
}