Roles & permissions

Every person in your organization has a role, and the role decides what they can see and change in HostWebhook — page by page and action by action. You manage roles in Settings → Team, in the Roles tab.

The built-in roles

Four roles come with every organization. They can't be edited, so “Admin” means the same thing in every account; to make one of your own, duplicate one of them.

Roles of your own

A role of your own is a list of permissions with a name — “Partner”, “Support”, “Accounting”. Create it from New role, or duplicate a built-in one and adjust it. Roles of your own are available from the Pro plan; the built-in roles work on every plan with a team (Starter and up — Free is a single person).

What the levels mean

View is reading. Edit adds creating, changing and running. Full adds deleting and the sensitive actions, like revealing a secret or purging a queue. The table at the end of this page says which level brings each permission.

What people see

With None in an area, its page disappears from the menu, and opening it by its link shows that the role doesn't include it. With View only, the page shows a “View only” notice. The server applies the same rules to every request, so hiding a page in the dashboard is a convenience, not the protection.

Who manages roles

The owner, and anyone whose role includes Create and edit roles (Team area). One rule applies everywhere: nobody can give a permission they don't have. So someone without Billing can't create a role with Billing, give it to anyone, or invite with it — not even to themselves. They also can't change the role of, or remove, someone who has permissions they don't have. Nobody can change their own role.

Deleting a role that people have asks which role they get instead. Pending invitations with a deleted role become Viewer.

Delegating billing

The plan belongs to the organization and is paid from the owner's account. Anyone whose role includes the payment permissions can manage it for the organization:

• Change, cancel or pause the plan — including buying one. The card entered becomes the organization's card.
• Payment method and invoices — see and update the card, read the invoices.
• Turn extra usage on or off, and its cap.

Billing emails — charges, failed payments, cancellations — and the usage alerts at 80% and 100% go to the owner and to everyone with a payment permission. Admin doesn't include these permissions: give them through a role of your own.

Roles and credential folders

Credential folders keep their own permissions on top of the role. A folder without its own permissions follows the role: Manage folders and their permissions works like an Admin there, Create and reconnect credentials like a Member, and View credentials like a Viewer.

A person's exception wins over their role — it can give more access, or less, down to No access. The owner always has full access.

Workspace folders

Group workspaces in folders and subfolders, and tag folders to search and filter. Permissions live on top folders; subfolders use theirs.

• A person's exception wins over their role (it can also be No access).
• The owner always has full access.
• A folder without permissions follows each person's role.

All permissions

27 areas, 84 permissions. The level is the lowest level of its area that includes it.