Roles & Permissions
Role-based access control and how to assign roles.
StatusDashboard uses role-based access control to limit what each teammate can do in the admin console. Every user holds at least one role; admins assign roles at invite time and can change them later from Users.
Effective permissions are the union of all assigned roles. API keys inherit the key owner's roles. The sections below define each role and map capabilities across the product.
Roles
StatusDashboard uses role-based access control (RBAC). Each user is assigned one or more roles at invite time, and those roles can be changed at any point by an admin.
| Role | Description |
|---|---|
| Admin | Full access to organization settings, users, billing, security, events, event templates, uptime reports, status dashboards, subscribers, integrations, and product support tickets. |
| Event | Manage incidents, maintenance, informational events, and event templates, with read access to components, severities, workflows, and segments used inside event forms. Can open and reply on product support tickets. Cannot manage status dashboards, subscribers, integrations, org settings, billing, users, or uptime reports. |
| Subscriber | Manage email, SMS, and WhatsApp subscribers and outbound integration endpoints; maintain suppression lists; view delivery history and logs; list status dashboards and components for targeting; open and reply on product support tickets. Cannot manage events, event templates, dashboard configuration, org settings, billing, users, SSO, the audit log, or inbound webhook keys. |
A user can hold multiple roles simultaneously. The effective permissions are the union of all assigned roles. Every user must hold at least one role.
Permissions by role
Capability names use two verbs:
- View — read-only access (list, get, history, logs).
- Manage — write access (create, update, delete, and other mutations).
Navigation shows the full product structure for every role. Pages enforce permissions on load: if you open something your role cannot use, you see the standard access denied message rather than being redirected elsewhere.
API keys inherit the owner's tenant roles. A key can only call endpoints the owner's roles allow. Billing changes require signing in as a user; platform API keys cannot manage billing even when the key owner is an admin.
Account & overview
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| View own profile | ✓ | ✓ | ✓ |
| View organization overview | ✓ | ✓ | ✓ |
| View organization account | ✓ | ✓ | ✓ |
| Manage account settings | ✓ |
Organization & billing
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| View billing | ✓ | ||
| Manage billing | ✓ | ||
| View users | ✓ | ||
| Manage users | ✓ |
Manage billing requires an interactive admin console session. API keys cannot subscribe, change plans, or update payment methods.
Security
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| Manage personal API keys | ✓ | ✓ | ✓ |
| Manage SSO providers | ✓ | ||
| View audit log | ✓ |
Events
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| View events | ✓ | ✓ | |
| Manage events | ✓ | ✓ | |
| Manage event timeline and notes | ✓ | ✓ | |
| View post-mortems | ✓ | ✓ | |
| Manage post-mortems | ✓ | ✓ | |
| View and manage event templates | ✓ | ✓ |
Applying a template when creating an event is part of event management.
Event configuration
Severities, workflows, and segments appear in event forms for operators. Configuration pages under Settings require admin.
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| Use severities and workflows in events | ✓ | ✓ | |
| Manage severities | ✓ | ||
| Manage workflows | ✓ | ||
| Use segments in events | ✓ | ✓ | |
| Manage segments and tags | ✓ |
Components & status dashboards
Subscriber access to status dashboards is limited to listing dashboards and their component maps (for subscriber targeting). Dashboard configuration is admin-only. Event operators do not need dashboard access.
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| View components | ✓ | ✓ | ✓ |
| Manage components | ✓ | ||
| View status dashboards | ✓ | ✓ | |
| Manage status dashboards and settings | ✓ |
Manage status dashboards and settings covers all per-dashboard admin tabs, including branding, domains, subscriptions toggles, content, custom code, SSO, network (IP allowlist), widget, digital signs, API access, whitelabel, and support configuration.
Reports
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| Generate uptime reports | ✓ |
Subscribers
Customer and end-user notification channels: email, SMS, and WhatsApp. Suppression lists are managed alongside each channel's subscriber list.
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| Manage email subscribers | ✓ | ✓ | |
| Manage SMS subscribers | ✓ | ✓ | |
| Manage WhatsApp subscribers | ✓ | ✓ | |
| Manage email suppression list | ✓ | ✓ | |
| Manage SMS suppression list | ✓ | ✓ | |
| Manage WhatsApp suppression list | ✓ | ✓ |
Integrations
Outbound endpoints (Slack channels, Teams, Google Chat, and outbound webhooks) can be managed by the subscriber role. Inbound webhook signing keys are admin-only.
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| Manage outbound integration endpoints | ✓ | ✓ | |
| Manage integration suppression lists | ✓ | ✓ | |
| View inbound webhook keys and quota | ✓ | ||
| Manage inbound webhook signing keys | ✓ | ||
| View inbound webhook logs | ✓ |
Notification delivery
Delivery history charts and per-message logs for every channel.
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| View email delivery history and logs | ✓ | ✓ | |
| View SMS delivery history and logs | ✓ | ✓ | |
| View WhatsApp delivery history and logs | ✓ | ✓ | |
| View Slack delivery history and logs | ✓ | ✓ | |
| View Teams delivery history and logs | ✓ | ✓ | |
| View Google Chat delivery history and logs | ✓ | ✓ | |
| View webhook delivery history and logs | ✓ | ✓ |
Support
Product support tickets in the admin console are separate from per-dashboard Support tab configuration (admin-only under status dashboard settings).
| Capability | Admin | Event | Subscriber |
|---|---|---|---|
| View and reply on product support tickets | ✓ | ✓ | ✓ |
| Create product support tickets | ✓ | ✓ | ✓ |
Assigning roles
Roles are assigned when inviting a new user and can be updated at any time from the Users list.
At least one admin is required. Every organization must have at least one user with the admin role at all times. You cannot remove the admin role from the only remaining admin.