Skip to main content
Every membership carries one role, and the role is resolved from your signed session — never from a header, a query parameter or a field in the request body. There is no client-side permission model to bypass.

​
The five roles

​
Auditor is deliberately not a rung

Viewer → Editor → Admin → Owner is a ladder: each holds everything below it. Auditor is not on that ladder. It sits beside it.
An Auditor can read the audit log, which an Editor cannot — and cannot edit a dashboard, which an Editor can. Neither is a subset of the other.This is the point of the role. A compliance reviewer needs to see who changed what, and specifically must not be able to change anything themselves. Giving them Admin to grant audit access would defeat the purpose; giving them Editor would not grant it at all.
The practical consequences:
  • A permission gate requiring Editor rejects an Auditor. Every mutation does, without exception.
  • A gate requiring Auditor admits Auditor, Admin and Owner — the roles that hold audit access — and rejects Viewer and Editor.

​
Who may grant which role

Two rules, both enforced by the API rather than only by the interface:
1

You may assign a role no higher than your own

An Admin can grant up to Admin. Only an Owner can grant Owner. This stops an Admin from promoting itself.
2

The Auditor role requires Admin or Owner to grant

Auditor is outside the hierarchy, so “no higher than your own” does not define it. It is restricted to the roles that already hold audit access.
An Owner cannot be demoted by an Admin. The check is on the target’s current role, not only on the role being assigned — otherwise an Admin could remove the organization’s Owner and take it over, which is an escalation even though no role above Admin was ever granted.If you need to change an Owner, sign in as an Owner.

​
What needs which role

The full permission model is per endpoint, and the API reference states the requirement on each one. The cases that come up in practice:
“I can see the license key list but there is no create button.” That is the Viewer or Editor view. Key creation is Admin — ask your organization’s Owner or an Admin to mint one, or to grant you the role. See Create a license key.

​
Roles do not restrict telemetry

A role controls what you can do, not which services you can see. Every member of an organization sees all of its telemetry.
There is no per-service or per-team read restriction. If some telemetry must not be visible to some members of your team, the boundary you need is a separate organization — see Organizations and multi-tenancy. Do not rely on Viewer to hide data; it does not.

​
Every change is recorded

Role changes, invitations, key creation and revocation, and support access are all written to the audit log with the actor, the target and the time. An Auditor, Admin or Owner can read and export it. See Audit log.

​
Next

Invite your team

How invitations work and what happens when one expires.

Single sign-on

SAML, one-time codes, and why SSO does not create accounts.

Audit log

What is recorded, how far back, and how to export it.