Roles and permissions
Permissions are defined by the platform and by each API. Workspace roles are sets of those permissions. The same role system governs people in the dashboard, the management API and API keys calling services.
System roles
Every workspace starts with five roles:
| Role | Purpose |
|---|---|
| Owner | Everything, including billing and ownership. Cannot be edited or deleted. |
| Admin | Everything except ownership transfer. |
| Developer | API keys, service operations and usage. Default role for new API keys. |
| Billing | Plans, credit purchases, invoices and usage. |
| Viewer | Read-only access. |
System roles cannot be deleted. You can create custom roles in Dashboard → Roles and edit each permission with checkboxes.
Rules
- You can only grant permissions you hold yourself, whether by editing a role, inviting a member or creating an API key.
- Role ids belong to one workspace; they cannot be used elsewhere.
- Changing a role updates every member and API key using it within seconds.
- A role still assigned to members, invitations or keys cannot be deleted.
Permission catalog
| Group | Permission | Allows |
|---|---|---|
| User management | users.list |
See workspace members and pending invitations. |
| User management | users.invite |
Invite people to the workspace. |
| User management | users.update |
Change member roles. |
| User management | users.remove |
Remove members from the workspace. |
| Role management | roles.list |
See roles and their permissions. |
| Role management | roles.create |
Create custom roles. |
| Role management | roles.update |
Rename roles and change their permissions. |
| Role management | roles.delete |
Delete unused custom roles. |
| API keys | api_keys.list |
See API key metadata (never secrets). |
| API keys | api_keys.create |
Issue new API keys. |
| API keys | api_keys.update |
Rename keys, change roles and restrictions, rotate secrets. |
| API keys | api_keys.revoke |
Permanently revoke keys. |
| Billing | billing.read |
See balances, plans and credit transactions. |
| Billing | billing.purchase_credits |
Buy prepaid credit packs. |
| Billing | billing.manage_subscription |
Subscribe, change or cancel plans. |
| Invoices | invoices.list |
See the workspace invoice history. |
| Invoices | invoices.read |
Open and download invoices. |
| Usage | usage.read |
See request and credit usage analytics. |
| Workspace | workspace.read |
See workspace settings. |
| Workspace | workspace.update |
Change workspace name, slug and preferences. |
| Audit logs | audit_log.read |
See the workspace audit trail. |
| QR Code API | qrcode.generate |
Create QR code images through the API. |
| QR Code API | qrcode.read |
Read individual generated QR code records. |
| QR Code API | qrcode.list |
List generated QR code records. |
| QR Code API | qrcode.search |
Search generated QR code records. |
Superadmin access to the platform is separate and can never be granted through a workspace role.