Admin roles
An admin account holds one or more roles. owner and admin may do everything; the others open parts of the console. A request is allowed when the account holds any role the route’s rule names.
| Role | Meaning |
|---|---|
owner |
Everything, including admin accounts. The first admin is an owner. |
admin |
Everything, like owner. |
security_admin |
Identities, keys and grants; any mutation without a narrower rule. |
source_admin |
Data sources, connectors, source roles, catalog and ingestion. |
policy_admin |
Policy rules. |
approval_reviewer |
Reviewing queued writes: approve and reject. |
auditor |
Read-only access to the console, audit and usage. |
Reading
Section titled “Reading”| Path prefix | Roles besides owner and admin |
|---|---|
/ |
approval_reviewer, auditor, policy_admin, security_admin, source_admin |
/openapi.json |
security_admin |
/docs |
security_admin |
/redoc |
security_admin |
/dashboard/overview |
approval_reviewer, auditor, policy_admin, security_admin, source_admin |
/dashboard/source-wizard |
security_admin, source_admin |
/dashboard/data-sources |
security_admin, source_admin |
/dashboard/connectors |
security_admin, source_admin |
/dashboard/access-control |
security_admin |
/dashboard/policies |
policy_admin, security_admin |
/dashboard/policy-analytics |
policy_admin, security_admin |
/dashboard/audit-costs |
auditor, security_admin |
/dashboard/audit-costs/export.csv |
auditor, security_admin |
/dashboard/write-safety |
approval_reviewer, security_admin |
/dashboard/proxy |
auditor, security_admin |
/dashboard/proxy-monitor |
auditor, security_admin |
/dashboard/ingestion |
security_admin, source_admin |
/dashboard/workers |
security_admin, source_admin |
/dashboard/discovery |
auditor, security_admin, source_admin |
/dashboard/catalog |
auditor, policy_admin, security_admin, source_admin |
/dashboard/categories |
auditor, security_admin, source_admin |
/dashboard/entities |
auditor, security_admin, source_admin |
/dashboard/alerts |
security_admin |
/api/data-sources |
security_admin, source_admin |
/api/connectors |
security_admin, source_admin |
/api/identities |
security_admin |
/api/source-roles |
security_admin |
/api/policies |
policy_admin, security_admin |
/api/approvals |
approval_reviewer, security_admin |
/api/ingestion |
security_admin, source_admin |
/api/catalog |
auditor, policy_admin, security_admin, source_admin |
Changing
Section titled “Changing”Rules for POST, PUT, PATCH and DELETE. A change under /dashboard or /api with no rule below needs security_admin.
| Path prefix | Roles besides owner and admin |
|---|---|
/dashboard/source-wizard |
security_admin, source_admin |
/dashboard/data-sources |
security_admin, source_admin |
/api/data-sources |
security_admin, source_admin |
/dashboard/connectors |
security_admin, source_admin |
/api/connectors |
security_admin, source_admin |
/dashboard/discovery/rescan |
security_admin, source_admin |
/dashboard/policies |
policy_admin, security_admin |
/api/policies |
policy_admin, security_admin |
/dashboard/access-control |
security_admin |
/api/identities |
security_admin |
/api/source-roles |
security_admin |
/api/admin-auth/oidc |
security_admin |
/api/approvals |
approval_reviewer, security_admin |
/dashboard/write-safety |
approval_reviewer, security_admin |
/dashboard/alerts |
security_admin |
/api/alerts |
security_admin |
/dashboard/ingestion |
security_admin, source_admin |
/api/ingestion |
security_admin, source_admin |