Permissions are written product.resource:action, or resource:action for things shared across the whole workspace. A role is a bundle of them. In the role editor you set None, Read or Write per resource, and tick extra chips for special actions; this page lists the keys behind those controls.
Write includes Read in a saved role, so the tables list :write as "change", on top of reading. Extra actions such as :assign, :schedule and :trigger are separate keys you grant deliberately. Platform-level platform:* keys belong to Natiq staff and are never grantable in an organization.
See Roles and permissions for how to put them together.
Workspace
The role editor groups these under Workspace.
| Key | What it allows |
|---|---|
admin:read | Open Settings and see Users, Invitations, Roles and permissions, Storage and Brand settings. The Settings icon in the rail is shown to people with this key. |
admin:write | Change what those tabs show: invite users, revoke invitations, activate and deactivate accounts, add and remove roles, create, edit and delete custom roles, and manage storage profiles. |
admin:audit | Open the Audit log tab. Deliberately separate: admin:read doesn't include it. Without admin:read, the Settings icon isn't shown in the rail, so open Settings from a link. |
org:read | Read the organization's profile. Without it, Natiq skips loading the profile. |
org:write | Save Brand settings. Without it, Brand settings is read-only. |
contacts:read | Open Contacts. |
contacts:write | Create and change contacts. |
contact_attributes:read | See the custom contact attributes you've defined. |
contact_attributes:write | Create and change contact attributes. |
channels:read | Open Connect and see the connected channels. |
channels:write | Add and change channels. |
Inbox
The role editor labels this group Live agent.
| Key | What it allows |
|---|---|
liveagent.conversations:read | Open the Inbox. |
liveagent.conversations:write | Work conversations. |
liveagent.tickets:read | See tickets. Every agent also reads the priority cases through this key. |
liveagent.tickets:write | Work tickets. Every agent holds it. It also gives access to the Personal tab in inbox settings (your own reply signature). |
liveagent.tickets:assign | Assign and redistribute tickets. |
liveagent.inboxes:read | See queues, and filter tickets and reports by queue. Also needed to read the auto-resolve settings. |
liveagent.inboxes:write | Change queues and the auto-resolve settings. |
liveagent.teams:read | Open the Agents and Teams tabs in inbox settings. |
liveagent.teams:write | Change agents and teams. |
liveagent.routing:read | See routing and assignment policies. |
liveagent.routing:write | Change routing and assignment policies. |
liveagent.labels:read | See labels. |
liveagent.labels:write | Create and change labels. |
liveagent.canned:read | See canned replies. |
liveagent.canned:write | Create and change canned replies. |
liveagent.macros:read | See macros, and build your own personal macros. |
liveagent.macros:write | Share a macro with the whole organization. |
liveagent.automation:read | See automation rules. By default only the admin roles hold the pair. |
liveagent.automation:write | Create and change automation rules, and change the priority cases. |
liveagent.reports:read | Open the inbox reports. |
liveagent.report_drilldown:read | Open the tickets behind a figure in a report. |
liveagent.sla:read | See SLA policies. |
liveagent.sla:write | Create and change SLA policies. |
liveagent.sla_breach:read | See SLA breach alerts. If a breach would notify nobody else, everyone with this key is told. Holders are also alerted when an external bot stops responding. |
Campaigns
| Key | What it allows |
|---|---|
campaigns.campaign:read | Open Campaigns and see campaigns. |
campaigns.campaign:write | Create and change campaigns. |
campaigns.campaign:schedule | Schedule a campaign to send. Separate from :write: editing a campaign and deciding when it goes out are different privileges. |
campaigns.templates:read | See message templates. Also opens WhatsApp, where templates live. |
campaigns.templates:write | Create and change templates. |
campaigns.reports:read | See campaign reporting. |
Agent Builder
The role editor labels this group Builder.
| Key | What it allows |
|---|---|
builder.bots:read | Open Agent Builder and Knowledge. |
builder.bots:write | Create, edit and publish agents and their flows. |
builder.bots:trigger | Fire a flow run — Run now, a dry run or a test session. Not part of :write. |
builder.bots:schedule | Put a flow on a clock. Not part of :write. |
builder.routes:read | See an agent's queue routes. |
builder.routes:write | Change queue routes. |
builder.analytics:read | See the aggregated analytics for an agent. |
builder.conversations:read | See the conversations behind those figures, and their transcripts. A separate grant from the aggregates. |
Accessibility
The role editor labels this group Widget.
| Key | What it allows |
|---|---|
a11y.widget:read | Open Accessibility. |
a11y.widget:write | Change the accessibility widget's settings. |
WhatsApp
The role editor labels this group Whatsapp. It holds the Flows resource.
| Key | What it allows |
|---|---|
whatsapp.flows:read | Open WhatsApp and see WhatsApp Flows and what customers submitted. |
whatsapp.flows:write | Build and publish WhatsApp Flows. |
Your own account needs no permission
Signing out a device, reading your own sign-in history and changing your language or appearance are open to everybody. See Review your sessions and sign-in history.