Manage user roles and permissions

Each user in your Middesk account has a role that controls what they can see and do in the Dashboard, in both Production (live) and sandbox. Admins assign a role when inviting members from the team settings page. With Directory Sync, the role comes from your identity provider.

Roles

Role	Value	Description
Read-only Member — Live only	`live_only_read_only_member`	Can view Production business reports. Can’t place orders, make changes, or access sandbox.
Member	`member`	Can view all business reports. Can’t manage team members or access API keys and API logs.
Developer	`developer`	Everything a Member can do, plus API keys, API logs, and webhooks. Can’t manage team members.
Admin	`admin`	Full access. Only Admins can manage team members and roles, and configure SSO and Directory Sync once they’re enabled for your account.
Sandbox only	`sandbox_admin`	Can only access the sandbox environment. No access to Production data, account settings, or team management.

Sandbox only is enabled per account. Contact your account manager to make it available in Invite members. Read-only Member — Live only can’t be combined with any other role.

Permission matrix

Role	View Production reports	View sandbox	Place orders	API keys and API logs	Manage team
Read-only Member — Live only	Yes	No	No	No	No
Member	Yes	Yes	Yes	No	No
Developer	Yes	Yes	Yes	Yes	No
Admin	Yes	Yes	Yes	Yes	Yes
Sandbox only	No	Yes	Sandbox test orders only	Sandbox API logs for business, order, batch, and lien requests; no API keys	No

Read-only Member — Live only can’t make changes, such as placing orders, adding businesses, or changing a business’s status or assignee. These users can still update their own profile, password, and settings.

Role values

The roles field on users in API responses is an array. It can hold a single value, such as [admin] for users managed by Directory Sync, or a cumulative list, such as [member, developer, admin] for users invited from the Dashboard. The user’s access is the broadest role listed, so don’t infer a role from whether member is present.

sandbox_admin means Sandbox only only when it’s the sole value. If the user also has another role, they get that role’s access.

With Directory Sync, map each identity provider group to exactly one of the five values. For users managed by Directory Sync, each sync replaces the user’s roles with that one value, and Middesk doesn’t provision or update users whose role isn’t one of these values. To change a synced user’s role, change it in your identity provider. The Dashboard marks these users as Managed and disables role edits.

Get a demo

Contact your account manager or contact sales to inquire about access.