ConceptDevelopers

Licences & roles

What decides whether a request is allowed — licences, roles, permissions and app-level access.

Updated 14 November 20262 min read

A request is allowed when all of these say yes. The API reference lists which ones each route checks.

Signed in: see Authentication.
Licence: the organisation (and, for per-person apps, the person) has a licence for the app.
Role or permission: for admin actions and some RMM actions.
The record itself: you can see or change that ticket, list, form, file, company… (membership, sharing, ownership). Records in another organisation always look like 404 Not found.

#Licences

Licences are assigned in Admin Centre → Licences. Calling an app you have no licence for returns 403 with a message saying so.

App	Licence
RMM (and Warden as its add-on)	RMM; Warden
PSA, Projects, WiKi, Forms, To Do	one each
Drive (also Docs, Sheets, Slides for editing Office files)	Drive; Docs / Sheets / Slides
Sites, Mail, HR, Flows, Paper, Atlas, SimpleBooks	one each, per person

#Built-in roles

Roles are given to people in Admin Centre → Roles. Built-in roles can't be changed; organisations can also make their own from the permissions below.

Role	What it allows
Global Administrator (`GLOBAL_ADMIN`)	Everything in the Admin Centre, every app's admin settings
RMM Admin (`RMM_APP_ADMIN`)	All RMM permissions
RMM Technician (`RMM_TECHNICIAN`)	Devices, scripts (run), remote terminal and screen, alerts, apps, backups, databases, logs
RMM Device Manager (`RMM_DEVICE_MANAGER`)	Device management (MDM), apps, read-only devices, backups, databases and logs
RMM Script Author (`RMM_SCRIPT_AUTHOR`)	Write and run scripts
RMM Read-only (`RMM_READONLY`)	See devices and checks
Auditor (`AUDITOR`)	The audit log, read-only devices and checks
PSA Admin, Forms Admin, Wiki Admin, Sites Admin, Storage & Drive Admin, HR Admin, Flows Admin, Atlas Admin	That app's admin settings
Warden Admin (`SECURE_ADMIN`)	Warden settings, Active Directory and Group Policy

#Permissions

These are the permission names the reference uses ("Permission (any of)").

Permission	Allows
`audit.view`	View the audit log
`partner.admin`	Manage customers in the Partner portal
`psa.admin.manage`, `forms.admin.manage`, `kb.admin.manage`, `sites.admin.manage`, `drive.admin.manage`, `hr.admin.manage`, `flows.admin.manage`, `atlas.admin.manage`, `secure.admin.manage`	Administer that app (`secure` = Warden)
`warden.directory.manage`	Manage Active Directory and Group Policy from Warden
`rmm.devices.view` / `.manage`	See / change devices
`rmm.scripts.run` / `rmm.scripts.manage`	Run / write scripts
`rmm.remote.terminal`, `rmm.remote.vnc`	Remote terminal / screen
`rmm.checks.view` / `.manage`, `rmm.alerts.resolve`, `rmm.integrations.manage`	Checks, alerts, alert channels
`rmm.enrollment.manage`	Enrolment keys and sites
`rmm.apps.view` / `.manage` / `.deploy`	Application catalogue and installs
`rmm.backups.view` / `.manage` / `.restore` / `.download`	Device backups (restore and download are audited)
`rmm.databases.view` / `.manage` / `.download`	Database overview and backups
`rmm.device_management.view` / `.manage`	Device management (MDM) profiles and baselines
`rmm.logs.view` / `.manage`	Logs and log collectors
`rmm.dashboards.manage`, `rmm.hypervisor.manage`, `rmm.network_probe.manage`	Shared dashboards, hypervisor links, network discovery

#Acting for a customer (partners)

An MSP can manage a customer organisation's Admin Centre when the customer has approved them with the admin.full permission (customer's Admin Centre → Partners). This only works from a signed-in browser through Partner portal → Open admin centre, never with an API key. Every change is recorded in both organisations' audit logs. Partnership, support-access and deletion settings can only be changed by the customer's own admins.

Was this page helpful?