# Page-only actions

The API and the MCP server do not do these actions. A person does them on the MapleID pages.

| Action | Page | Note |
|---|---|---|
| Pay or change the plan | `/orgs/<organization id>/billing` | The API gives only the URL. A payment call gets 403 `human-action-required`. |
| Close the account | `/account/close` | Needs a recent sign-in. |
| Transfer ownership | `/orgs/<organization id>/members` | Owner only. Needs a recent sign-in. |
| Archive the organization | `/orgs/<organization id>` | Owner only. Needs a recent sign-in. |
| Change the role of a member | `/orgs/<organization id>/members` | Owner or admin. |
| Change the slug or the logo | `/orgs/<organization id>` | Owner or admin. |
| Create, change or disable an agent client | `/orgs/<organization id>/developers/apps` | Owner or admin. |
| Change the password or MFA | `/account` | |

An agent with the person's password can pass the sign-in check of these pages. The person accepts this risk when they give the agent their password. Your agent's AI provider receives the credentials that the agent types. MapleID does not control where that provider stores them.