A workspace has four roles, in order: viewer, member, admin, owner. Each one can do everything the role below it can.
Who can call what
Endpoints that need a role, by the lowest role that can call them: 73| Needs at least | Endpoints |
|---|
viewer | none |
member | 37 endpoints/api/app/fleet-determinism/api/app/seed-demo/api/app/test-run/api/approvals/api/approvals/[id]/api/approvals/[id]/wait/api/chargeback/teams/api/datasets/api/datasets/[dataset_id]/adversarial/api/datasets/[dataset_id]/items/api/datasets/[dataset_id]/versions/api/datasets/import/api/drift/ack/api/evals/api/evals/[eval_id]/baseline/api/evals/pairwise/api/evals/queues/[queue_id]/api/golden/approve/api/golden/enroll/api/golden/run/api/incidents/api/incidents/[id]/api/ledger/decisions/[id]/api/ledger/records/[id]/api/policies/api/policies/decide/api/policies/decide/backfill/api/policies/library/api/policies/simulate/api/prompts/api/prompts/[name]/labels/api/prompts/playground/api/regulatory/[framework_id]/[control_id]/narrative/api/replay/api/runs/[run_id]/bisect/api/runs/[run_id]/narrative/api/runs/[run_id]/reexecute
|
admin | 34 endpoints/api/alerts/api/app/agents/[agent_name]/authorization/api/app/compliance-key/api/app/coverage/api/app/external-grants/api/app/external-grants/[id]/api/app/key/api/app/ledger/api/app/legal-holds/api/app/onboarding/api/app/scim-key/api/app/security-findings-key/api/app/siem/api/app/workflow-sink/api/billing/cancel/api/billing/checkout/api/billing/portal/api/billing/resume/api/billing/status/api/datasets/[dataset_id]/approve-imported/api/datasets/[dataset_id]/items/[item_id]/review/api/evals/calibrate/api/evals/online/api/evals/pairwise/verdict/api/evals/queues/api/models/gate/api/policies/assignments/api/runs/[run_id]/api/settings/corpus-optin/api/settings/model-keys/api/settings/sso/api/settings/sso/groups/api/settings/transparency/api/settings/vertical
|
owner | 2 endpoints/api/settings/sso/domains/api/settings/sso/enforcement
|
An API key acts as the role its scope gives it| Key scope | Acts as |
|---|
trace_write | no role: cannot call the general API |
ci | member |
ingest | admin |
compliance_read | no role: cannot call the general API |
security_findings | no role: cannot call the general API |
scim | no role: cannot call the general API |
external_grant | no role: cannot call the general API |
#Roles
- viewer reads. Anything that calls a model, changes a policy or decides an approval is refused.
- member works: replays, evals, incidents and tests.
- admin manages: API keys, model keys, billing, the SSO configuration, auditor access, signing an audit-log checkpoint.
- owner adds the two SSO steps that can lock people out: verifying a domain and turning SSO enforcement on.
Invite people and change roles on the Team page: open the account menu (your workspace name, top right of the app) and select Team.
#Keys act as roles too
No key acts as owner, and billing and the SSO settings take a signed-in session only. What each scope can call is in API keys.
#Single sign-on and SCIM
OIDC single sign-on is configured by an admin in Settings › Single sign‑on, with verified domains, group-to-role mapping and optional enforcement. User provisioning uses SCIM v2 at /api/scim/v2/Users with a scim-scoped key. Both need the Enterprise plan.
On a self-hosted instance, set SSO_SECRET_KEY before anyone saves an SSO configuration (see Self‑host).