Role Management Scopes

When creating a custom role to be assigned to a new or an existing user, you can predefine access permissions for this role by selecting the relative scopes. The following table describes the permissions each scope provides.

Scope	Description
`activities`	Allows viewing notifications and managing the notification feed
`api-keys`	Allows creating personal API keys
`auth-objects`	Provides unrestricted access to authentication objects management
`auth-objects:read`	Allows to view the basic configuration of authentication objects
`auth-objects:test`	Allows testing an authentication object during its configuration
`auth-objects:write`	Allows managing authentication objects that have been created by a user
`auth-providers`	Allows configuring SSO providers (okta, Google, ADFS)
`billing`	Allows viewing billing summary
`comments`	Allows viewing and managing comments in scans and issues that a user has access to
`comments:read`	Allows viewing comments in scans and issues that a user has access to
`comments:write`	Allows managing (editing, deleting) comments in scans and issues that a user has access to
`entry-points:read`	Allows viewing all entry points discovered during a scan
`files:read`	Allows reading files from the storage and verifying targets
`files:write`	Allows managing files in the storage, for example, uploading or deleting them
`groups:admin`	Provides unrestricted access to all organization groups, including the possibility to assign a role to a group and view all group members
`groups:manage`	Allow managing groups, for example creating a new group or editing an existing group
`groups:read`	Allows viewing information about groups that a user has been added to
`groups:delete`	Allows deleting groups
`integrations:read`	Allows viewing a list of available and enabled integrations
`integrations:write`	Allows enabling connection and associating other repositories to be used for a scan (ticketing systems)
`integration.repos:read`	Allows viewing associated repositories, for example, GitHub repositories, Slack channels, or Jira boards
`integration.repos:manage`	Allows filtering the severity level of issues to be opened in integrated services
`issues:manage`	Allows managing detected issues, for example assigning a user to an issue, marking an issue as resolved, or retesting an issue
`issues:read`	Allows viewing detected issues
`logs`	Allows viewing the activities log
`org`	Provides unrestricted access to organization management (including permission to delete the organization)
`org:read`	Allows viewing basic information about an organization. This scope is required for running a scan
`org:write`	Allows editing basic information about an organization and managing its basic settings, for example, enforcing MFA
`org.api-keys`	Allows creating organization API keys (tokens)
`org.memberships:manage`	Allows managing organization members, for example adding a member to an organization, deleting a member from an organization, or viewing a member’s profile
`org.memberships:read`	Allows viewing members of an organization.
`payments`	Allows managing user’s payments
`payment-methods`	Allows managing payment methods
`plans`	Allows viewing information about offered plans
`products`	Allows viewing information about offered products
`projects:admin`	Provides unrestricted access to project management
`projects:delete`	Allows deleting projects
`projects-issues:write`	Allows users to manage project issues: to change severity, status, and assignee
`projects:manage`	Allows managing projects, for example creating a new project or editing an existing one
`projects:read`	Allows displaying available projects. This scope is required for running a scan
`project.api-keys`	Allows creating project-level API keys
`repeaters:read`	Allows viewing organization’s repeaters
`repeaters:write`	Allows creating, editing, and deleting a repeater, as well as testing repeater connection to a network
`reports:read`	Allows viewing scan reports
`reports:write`	Allows managing configuration of PDF reports
`roles:read`	Allows viewing a list of roles
`roles:write`	Allows creating and editing custom roles. The default roles (for example, “Admin”, “Owner”, etc.) are read-only
`scans`	Provides unrestricted access to scan management
`scans:delete`	Allows deleting scans
`scans:manage`	Allows managing scans, for example, editing scan settings or retesting a scan
`scans:read`	Allows viewing existing scans
`scans:run`	Allows running scans
`scans:stop`	Allows stopping scans
`scans-templates`	Provides unrestricted access to scan templates management
`scans-templates:read`	Allows viewing existing scan templates
`scans-templates:write`	Allows creating, editing, and deleting custom scan templates
`scan-labels:manage`	Allows editing labels in scans that are already running or have been finished
`scripts:read`	Allows viewing repeater’s scripts
`scripts:write`	Allows creating, editing, and deleting scripts
`subscriptions`	Allows managing plan subscriptions for an organization
`user`	Selected by default for all roles
`user:read`	Allows viewing user’s personal details
`user:write`	Allows users to edit their personal details, for example, change names, emails, and passwords