User roles and permissions control what each person can view and change in your integrator.io account. The Celigo platform has three role types — account owner, administrator (admin), and user — and users can have Manage, Monitor, or Custom access. The account owner or an admin assigns these roles.
This article defines each role, lists the permissions each role grants for every resource type, explains account-level and integration-level access, and shows how to check your own role. For the steps to invite a user or change a user's permissions, see Invite and manage users to an account or integration.
Roles
| Role | Who it's for | What the role can do |
|---|---|---|
| Account owner | The person who created the account. Each account has exactly one owner. | All permissions, in every environment in the account. Only the owner can create environments (if the subscription includes them), install integration apps, and transfer ownership. |
| Admin | Team members who run the account day to day. | Everything the owner can do except change the owner's permissions or transfer ownership. Admins edit account settings, edit all current and future integrations and resources, invite and manage users (including creating other admins, deleting users, and changing their own permissions), control the Invitations and Celigo Support access settings, and troubleshoot errors. For how admin rights carry across environments, see Invite and manage users to an account or integration. |
| User — Manage all | Builders who work across every integration in the account. | Edit all current and future integrations and resources, delete integrations, and troubleshoot flow errors. Can't view or edit account settings. Can invite users to an integration when the Invitations or Celigo Support access setting is on. |
| User — Monitor all | People who need to watch every integration without changing anything. | View all current and future integrations, run flows (including delta flows), and assign, retry, and resolve errors. Can't modify integrations, flows, or flow steps; enable or disable flows; or view account settings, connections, or API tokens. An owner or admin can also turn on Users can edit retry data so the user can edit retry data, and Allow integration workspace creation so the user can create their own integration workspace (the role then becomes Custom, with Manage access to anything the user creates, uploads, or clones). |
| User — Custom | People who should see only some integrations, such as contractors. | Manage or Monitor access to only the integrations an owner or admin selects, in any mix: manage some, monitor some, or monitor all and manage a few. If a user has both Manage and Monitor access to the same integration, Manage applies. The Monitor all options above (edit retry data, create an integration workspace) are available for Custom monitor access too. |
If you accept an invitation to another account, you join it as a user, not an owner, and that account's owner or admin sets your access. For moving an integration rather than a person, see Transfer an integration to another account.
Permissions by resource
The following table lists what each role can do with every resource type. Manage and Monitor apply at the account level (Manage all, Monitor all) or, for Custom users, to the selected integrations only.
| Resource | Account owner or admin | Manage | Monitor |
|---|---|---|---|
| Connections | Create, view, modify, delete | Create, view, modify, delete | View |
| Exports | Create, view, modify, delete | Create, view, modify, delete | View |
| Imports | Create, view, modify, delete | Create, view, modify, delete | View |
| Flows | Create, view, modify, delete | Create, view, modify, delete | View (create as well with Allow integration workspace creation) |
| Flow groups | Create, view, modify (assign or remove flows), delete | Create, view, modify (assign or remove flows), delete | View |
| Lookup caches | Create, view, modify, delete, purge | Create, view, modify, delete, purge | View |
| Async helpers | Create, view, modify, delete | Create, view, modify, delete | View |
| Custom integrations | Create, view, modify, delete | Create, view, modify, delete | View |
| Integration apps and templates | Install (account owner only), view, modify, delete | View, modify | View |
| Stacks | Create, view, modify, delete | Create, view, modify, delete | View |
| API tokens | Create, view, modify, delete | — | — |
| Users | Create, view, modify, delete; grant non-admins the Invitations and Celigo Support access permissions | Create, view, modify — when Invitations or Celigo Support access is granted | Create, view — when Invitations or Celigo Support access is granted |
| Recycle bin | Create, view, modify, delete | Create, view, modify, delete | View |
| Jobs | View | View | View |
| Revisions | Create, view | Create, view | View |
The Invitations and Celigo Support access settings are controlled by an owner or admin in Control user authentication and invitation permissions; granting Celigo Support access itself is described in Manage Celigo Support access.
Account-level and integration-level access
Manage and Monitor can be granted at two levels:
- Account level — Manage all or Monitor all applies to every integration in the account, including integrations added later.
- Integration level — A Custom user's Manage or Monitor access applies only to the integrations an owner or admin selects.
The two levels combine. A user with Monitor all can also be given Manage access to specific integrations, which makes the role Custom: the user monitors everything and manages the selected integrations. A user with Manage all already has both Manage and Monitor access everywhere, so there is nothing further to grant at the integration level.
Who can accept an invitation to another account
A user can receive and accept an invitation to another account only if all of the following are true of their own account:
- It is on a free license.
- It contains no integrations.
- No other user has accepted an invitation to it.
An owner of a licensed account, or of an account with integrations or invited users, can't be invited to another account. To give such a person access, invite them with a different email address, or have them transfer ownership of their account first.
Check your role and permissions
- Go to Account
, and then select Users.
- Find your name. The Role column shows Owner, Admin, Manage all, Monitor all, or Custom.
To see your access to a specific integration, go to the Home page, and point to Settings on an integration.
Owners and admins can change a user's role at any time — see Invite and manage users to an account or integration.