# Permissions by role and by area

The complete overview of what **Owner**, **Manager**, and **Member** may do in each area of the portal — plus, for each area, a table of which task depends on which permission.

> **Type:** reference
> **For:** anyone who assigns a role or wants to find out why a button is blocked
> **Prerequisite:** none, since the overview applies to every organization
> **Where in the portal:** **Team › Roles**, and the permissions themselves are in the permission picker of the role editor

How to read the tables: A check mark (✓) means “may perform this task,” “read-only” means “view yes, change no,” and a dash (–) means “not through this role.” A dash is not a final no: the same task can be opened up through a direct permission or a custom role. The names in the **Permission** column are the plain-language names under which the permission picker lists the permission.

## What the three roles may do

| Area | Owner | Manager | Member |
|---|:---:|:---:|:---:|
| Open the dashboard | ✓ | ✓ | ✓ |
| Upload and maintain media | ✓ | ✓ | – |
| View scenes, playlists, and programs | ✓ | ✓ | – |
| Edit and publish scenes | ✓ | ✓ | – |
| Create or change playlists and programs | ✓ | ✓ | – |
| Delete scenes, media, playlists, programs | ✓ | ✓ | – |
| Maintain layout templates | ✓ | ✓ | – |
| View displays (list and detail page) | ✓ | ✓ | ✓ |
| Pair, name, and tag displays | ✓ | ✓ | – |
| Send display commands (refresh content, screenshot …) | ✓ | ✓ | – |
| Remove displays | ✓ | – | – |
| Create, rebuild, and dissolve video walls | ✓ | ✓ | – |
| View and remotely control devices | ✓ | ✓ | – |
| Re-pair, remove, or report devices as lost | ✓ | – | – |
| See apps | ✓ | ✓ | ✓ |
| Install, update, and uninstall apps | ✓ | – | – |
| Ask an Owner for an app or for a decision about an update | ✓ | ✓ | – |
| View analytics, create and run reports | ✓ | ✓ | – |
| Manage advertisers, ad campaigns, bookings, and creatives, and approve creatives | ✓ | ✓ | – |
| Manage the ad space of displays and the audience of locations | ✓ | ✓ | – |
| Control participation in the ad network | ✓ | – | – |
| View proofs, create and share interim proofs | ✓ | ✓ | – |
| See the team | ✓ | ✓ | – |
| Invite members, assign roles, suspend or delete accounts | ✓ | – | – |
| Roles and direct permissions | ✓ | read-only | – |
| See the package and booked seats | ✓ | ✓ | – |
| Change the package, invoices, payment methods | ✓ | – | – |
| Master data and brand of the organization | ✓ | read-only | read-only |
| Own address, company sign-in, danger zone | ✓ | – | – |
| Issue and revoke API keys | ✓ | – | – |
| Webhooks | ✓ | read-only | – |
| Read the change log | ✓ | ✓ | – |
| Changed values of an entry, request and download exports | ✓ | – | – |
| List and view exports | ✓ | ✓ | – |

Two things follow from this table and are immediately visible in the portal: The sidebar shows only the areas for which your account holds a permission, so by default a Member sees five entries. And an area you may only view is marked **Read-only.**, often with the addition “You can view these details. Changing them is reserved for owner and administrator accounts.”

## Media

| Task | Permission |
|---|---|
| View the library and folders | **List media**, **View media**, **List folders** |
| Upload media | **Upload media** |
| Edit name and tags, move or restore media | **Edit media** |
| Move a media item to the trash and delete it permanently | **Delete media** |
| Create, rename, move, and delete folders | **Create folders**, **Edit folders**, **Delete folders** |
| Create, edit, and delete saved filters | **Create smart buckets**, **Edit smart buckets**, **Delete smart buckets** |

## Scenes, playlists, and programs

| Task | Permission |
|---|---|
| Open the scene list, view a scene | **List scenes**, **View scenes** |
| Create a scene | **Create scenes** |
| Work on the draft | **Edit scenes** |
| Publish a draft, reset to an earlier version | **Publish scenes** |
| Archive or delete a scene | **Archive scenes**, **Delete scenes** |
| Create, change, and delete playlists | **Create playlists**, **Edit playlists**, **Delete playlists** |
| Create, change, and delete programs | **Create schedules**, **Edit schedules**, **Delete schedules** |

A published scene version is immutable. Resetting only replaces the draft with an earlier state, and that state does not reach the displays until the next publish. Resetting has no permission of its own. It requires **Publish scenes**, and **Edit scenes** is not enough.

The two read permissions are deliberately at the top of the table: Without them, **Scenes** does not appear in the sidebar at all. A **Member** does not hold them by default. If someone should only be allowed to read content, create the **Template “Content reader”** on the **Roles** tab. The same applies to playlists and programs, whose read permissions work in the same way.

## Displays, devices, and video walls

| Task | Permission |
|---|---|
| View the fleet, open the detail page | **List players**, **View players** |
| Pair a display | **Pair players** |
| Send commands | **Send remote commands** |
| Edit name and description | **Edit players** |
| Correct the map position or have it determined automatically again | **Edit players** |
| Manage tags | **Manage tags** |
| Assign a program, remove the assignment, set and end an override | **Edit schedules** |
| Read the playback history | **View playback history** |
| Create, rebuild, and dissolve video walls | **Manage video walls** |
| View and remotely control devices | **List devices**, **Control devices remotely** |
| Remove a display | **Remove displays** |
| Re-pair a device, reset it to factory settings, remove it from the organization, or report it as lost | **Re-pair, remove or block devices** |

There is no permission of its own for a display’s map position. It is part of the display’s master data and therefore depends on **Edit players**. Anyone who may change the name may also correct the address. **Manage tags** is separate from this, since it applies to all displays at once.

## Apps

| Task | Permission | Default for |
|---|---|---|
| View the Apps area and the store | **View apps** | Owner, Manager, Member |
| Install an app | **Install apps** | Owner only |
| Update an app | **Upgrade apps** | Owner only |
| Uninstall an app and have the data of an uninstalled app deleted | **Uninstall apps** | Owner only |
| Accept or decline an app’s new permissions | **Accept app terms** | Owner only |
| Ask the Owner to install an app or to decide about an update | **Ask owners for apps** | Owner, Manager |
| Maintain emergency service locations | comes with the **Pharmacies on duty** app | Owner, Manager |
| Correct or import emergency service entries | comes with the **Pharmacies on duty** app | Owner, Manager, import only Owner |

Installing an app adds its permissions to the permission catalog of your organization, and they are then available in the permission picker.

## Analytics and change log

| Task | Permission |
|---|---|
| See the figures on the dashboard | **View dashboard** |
| Open analytics: Overview, Displays, Content, Devices, and the free-form analysis | **Run ad hoc queries** |
| List saved views of the analysis, open them, and output them as a file | **List reports**, **View reports**, **Run reports** |
| Save a view, change it, have it delivered, or delete it | **Create reports**, **Edit reports**, **Delete reports** |
| Read all activity in the log | **View audit log** |
| Read only your own activity | **View own activity** |
| Expand the changed values of an entry | **View changed values** |
| Request an export, download other people’s exports, delete exports early | **Create audit exports**, **Download others’ exports**, **Delete exports** (Owner only) |
| List the exports and open a job | **List exports**, **View an export** (Owner, Manager) |

## Advertising and proofs

| Task | Permission |
|---|---|
| View advertisers | **View advertisers** |
| Create, change, and archive advertisers | **Manage advertisers** |
| View ad campaigns with their bookings | **View ad campaigns** |
| Create, change, and pause ad campaigns and bookings | **Manage ad campaigns and bookings** |
| Create creatives, assign them to bookings, and archive them | **Manage creatives** |
| Approve creatives or reject them with a reason | **Approve creatives** |
| Manage the ad space of displays and the audience of locations | **Manage ad space and audience** |
| Join the ad network, exclude industries, and consent to the credit note | **Control ad network participation** (Owner only) |
| View and download closings and proofs | **View proofs** |
| Create interim proofs, issue and revoke links for advertisers | **Create and share proofs** |

Approving a creative is a permission of its own, separate from managing it: Only with it does a creative reach a display. Participation in the ad network is an agreement between the organization and Szenera and therefore lies solely with the Owners. In the permission picker, the advertising permissions are listed under **Advertising**, and the two proof permissions under **Reports**.

## Billing

| Task | Permission |
|---|---|
| Open billing, see the contract | **View contract** (Owner, Manager) |
| Order: package, displays, video walls, billing period, player | **Change contract** (Owner only) |
| View invoices, retrieve the document and the e-invoice | **View invoices**, **Download invoices** (Owner only) |
| View and manage payment methods | **View payment methods**, **Manage payment methods** (Owner only) |

## Organization and settings

| Task | Permission |
|---|---|
| View the master data of the organization | **View organization profile** (all three roles) |
| Change master data | **Edit organization profile** (Owner only) |
| Change logo, favicon, and colors | **Edit branding** (Owner only) |
| Request or remove your own address | **Manage custom domain** (Owner only) |
| Manage providers, domains, and enforcement of company sign-in | **Configure single sign-on** (Owner only) |
| Delete the organization permanently | **Delete organization** (Owner only) |

## API keys and webhooks

| Task | Permission |
|---|---|
| View, issue, and revoke keys | **List API keys**, **Create API keys**, **Revoke API keys** (Owner only) |
| View the configured addresses with their events | **List webhooks** (Owner, Manager) |
| Read deliveries with time, response, and failure reason | **List deliveries** (Owner, Manager) |
| Create, change, and delete an address | **Create webhooks**, **Edit webhooks**, **Delete webhooks** (Owner only) |
| Resend a failed delivery | **Retry deliveries** (Owner only) |

That is why the roles table shows “read-only” for the Manager next to **Webhooks**: The Manager sees the configured addresses and their deliveries, while creating, changing, and deleting stays with the Owner. A Manager who needs both gets the three permissions through a custom role.

## Team

| Task | Permission |
|---|---|
| View the member list and detail page | **List members**, **View members** |
| Change a member’s display name | **Edit members** |
| Invite a member | **Invite members** |
| View and withdraw invitations | **List invitations**, **Revoke invitations** |
| View and decide on join requests | **View join requests**, **Decide join requests** |
| Assign or change a role | **Assign roles** |
| Suspend, reactivate, delete an account | **Suspend accounts**, **Reactivate accounts**, **Delete accounts** |
| View, create, change, and delete roles | **List roles**, **View roles**, **Create roles**, **Edit roles**, **Delete roles** |
| View, grant, and revoke direct permissions | **List direct permissions**, **Create direct permissions**, **Revoke direct permissions** |

## How permissions are named outside the portal

Besides its plain-language name, every permission carries a fixed key made up of area, object, and operation, such as `identity.user.invite`. You do not encounter it in the portal, where the plain-language name appears everywhere. It becomes visible as soon as you work through the API or the command line: A rejected request names the missing permission in its error data, in the field `missing`, and anyone who creates or changes a role that way specifies its scope as a list of these keys. For the tasks around team, roles, and direct permissions:

| Permission | Key |
|---|---|
| **List members** | `identity.user.list` |
| **View members** | `identity.user.read` |
| **Edit members** | `identity.user.update` |
| **Invite members** | `identity.user.invite` |
| **List invitations** | `identity.invitation.list` |
| **Revoke invitations** | `identity.invitation.revoke` |
| **View join requests** | `identity.join-request.list` |
| **Decide join requests** | `identity.join-request.decide` |
| **Assign roles** | `identity.user.assign-roles` |
| **Suspend accounts** | `identity.user.suspend` |
| **Reactivate accounts** | `identity.user.reactivate` |
| **Delete accounts** | `identity.user.delete` |
| **List roles** | `access.role.list` |
| **View roles** | `access.role.read` |
| **Create roles** | `access.role.create` |
| **Edit roles** | `access.role.update` |
| **Delete roles** | `access.role.delete` |
| **List direct permissions** | `access.grant.list` |
| **Create direct permissions** | `access.grant.create` |
| **Revoke direct permissions** | `access.grant.revoke` |

All other permissions follow the same pattern: `scene.publish` for **Publish scenes**, `fleet.player.update` for **Edit players**, `webhook.create` for **Create webhooks**. Permissions that come into your catalog with an app carry that app’s own area in the key.

## Related

- [Who can do what in the portal?](/docs/organization/about-roles-and-permissions)
- [Manage members: change role, block, remove](/docs/organization/manage-members)
- [No access, a grayed-out button, a locked area](/docs/help/access-troubleshooting)