Skip to main content

Roles

Roles are named groups that users belong to. Use roles to control who can access your data and perform specific operations.

Built-in Roles​

Every API includes these system roles that cannot be modified:

RoleDescription
_EVERYONEPublic access — no authentication required
_AUTHENTICATED_USERAny logged-in user
_CREATORThe user who created the record

Custom Roles​

Create custom roles to match your application's permission model.

Creating a Role​

  1. Sign in to the Developer Portal
  2. Navigate to your API
  3. Go to Users & Roles → Roles
  4. Click Create Role
  5. Enter a role name (e.g., "editor", "viewer", "moderator")

Managing Members​

Add users to a role:

  1. Open the role details
  2. Go to the Members tab
  3. Click Add Members
  4. Select users to add

Remove users from a role:

  1. Open the role details
  2. Go to the Members tab
  3. Click the delete icon next to the user

Role Assignment​

Users can have roles at two levels:

Global Roles​

Assigned at the API level. Global roles apply across all collections and views.

Use cases:

  • Admin users who need full access
  • Moderators who need broad permissions
  • Service accounts with specific capabilities

Local Roles​

Assigned within specific collections through data relationships. Local roles provide row-level access based on user data.

Use cases:

  • Project members who can only access their assigned projects
  • Team leads who can manage their team's data
  • Users who can only access their own records

Role Priority​

When evaluating access:

  1. Global roles are checked first
  2. If no global role grants access, local roles are checked
  3. Access is granted if any matching role permits the operation

Best Practices​

  • Start restrictive — Begin with minimal permissions and add as needed
  • Use descriptive names — "content_editor" is clearer than "role1"
  • Prefer roles over individual access — Easier to maintain
  • Document your roles — Keep track of what each role is meant for