# Public staff directory

Share a read-only list of your active staff, for example on your website, through a secret link.

The public staff directory lets you show who's on your team outside Crew, such as on your
organization's website, without giving anyone access to Crew. It's off until a Super User turns it on.

## What it shares

Only **active** members, sorted by name, with:

- their **name** and **title** (role);
- their **department** and **unit**;
- their **initials** and **avatar colour** (for drawing a simple avatar);
- their **status**.

Plus your organization's **name**, **icon** and the number of members listed.

**Never shared:** contact details (email or phone), bios, Discord accounts, notes, disciplinary
records, certifications, or anyone who is on leave or terminated.

## Turning it on

1. Open **Settings → Security & data → Public staff directory** (Super Users; needs a recent sign-in).
2. Click **Enable public sharing**. Crew creates a secret link, shown as the **Public directory
   URL**.
3. Copy the link and use it in your website or tool.

**Regenerate link** replaces the secret: the old link stops working immediately. **Disable** turns
sharing off.

## Using it

The link returns JSON:

```json
{
  "org": { "name": "Lumen Collective", "icon": "https://cdn.discordapp.com/icons/…", "memberCount": 41 },
  "members": [
    {
      "displayName": "Maya Chen",
      "title": "Team Lead",
      "departmentName": "Support",
      "unitName": null,
      "initials": "MC",
      "avatarColor": "#3f5ce6",
      "status": "active"
    }
  ]
}
```

There are two ways to call it:

- **From a server (recommended):** `GET https://crew.noyralabs.com/public/<server ID>` with the
  secret in a header: `Authorization: Bearer <token>`. The token never appears in URLs or logs, and
  responses aren't cached.
- **From a browser:** `GET https://crew.noyralabs.com/public/<server ID>/<token>`. This works from
  any website (cross-origin requests are allowed) and is cached for 60 seconds.

> [!WARNING]
> With the browser form, the token is in your page, so anyone who views your page's source can see
> it and fetch the list too. That's fine for a list you're happy to publish, but prefer the server
> form when you can. Regenerate the link if it ends up somewhere it shouldn't.

Requests are rate-limited per visitor. An unknown, disabled or archived directory answers `404`.

Source: https://docs.noyralabs.com/crew/staff-directory