For AI agents: this page in Markdown: https://www.pubnub.com/docs/security/admin-portal-roles.md. Documentation index: https://www.pubnub.com/llms-full.txt.
Admin Portal roles
The Admin Portal uses role-based access control for members of a PubNub organization. A role sets what a member can see and change in the Admin Portal, such as apps, keysets, secret keys, usage, and Functions. Roles don't affect what your app's clients can do on channels. Access Manager controls that through tokens.
You assign a role when you invite an organization member.
Account Owner
Every organization has one Account Owner: the user who created the organization. The Account Owner has the same access as Account Admin and cannot be removed, reassigned, or managed through the Members tab.
Roles
| Role | Permissions |
|---|---|
| Account Admin | Full control over the account. Can create, update, and delete secrets. |
| Account Viewer | View all apps and keysets (secret keys excluded). Observe account-wide usage. Cannot modify apps, keysets, or account settings. |
| App Admin | All App Viewer permissions. All Functions Developer permissions. Modify app and its keysets. Create, view, and edit Functions Deployments at the app level. |
| App Viewer | All Functions Viewer permissions. Access app. View keys (secret key excluded). Observe app usage. View Functions Deployments at the app level. |
| Key Admin | All Key Viewer permissions. All Functions Developer permissions. Modify keyset. Create, update, and delete secrets. Create, view, and edit Functions Deployments at the keyset level. |
| Key Viewer | All Functions Viewer permissions. Access keyset information (secret key excluded). Observe keyset usage. View Functions Deployments at the keyset level. |
| Business Insights | View Insights dashboards and edit dashboard settings. No access to app or keyset settings. Formerly named PubNub Insights. |
| BizOps Dashboard Operator | Manage members, memberships, channels, channel memberships, and presence rules for a keyset. No access to other Admin Portal sections. Formerly named BizOps Objects Operator. |
| Illuminate Admin | View, create, and edit Business Objects, Dashboards, and Decisions in Illuminate. No access to other Admin Portal sections. |
| Functions Developer | Create, edit, and delete packages and Functions across the entire account. Cannot be assigned alongside Account Admin. |
| Functions Viewer | View Functions code and deployments across the entire account. Cannot be assigned alongside Account Admin. |
Mutually exclusive roles
A member can hold more than one Admin Portal role, except for the combinations in this table.
| Role | Cannot be combined with |
|---|---|
| Account Admin | App Admin, App Viewer, Account Viewer, Key Admin, Key Viewer, Business Insights, BizOps Dashboard Operator, Functions Viewer, Functions Developer, Illuminate Admin |
| Account Viewer | Account Admin, App Admin, App Viewer, Key Admin, Key Viewer |
| App Admin | Account Admin, App Viewer (same app), Key Admin (same app), Key Viewer (same app) |
| App Viewer | Account Admin, App Admin (same app), Key Viewer (same app) |
| Key Admin | Account Admin, App Admin (same app), Key Viewer (same keyset) |
| Key Viewer | Account Admin, App Admin (same app), App Viewer (same app), Key Admin (same keyset) |
| Business Insights | Account Admin |
| BizOps Dashboard Operator | Account Admin |
| Functions Developer | Account Admin, Functions Viewer |
| Functions Viewer | Account Admin, Functions Developer |
| Illuminate Admin | Account Admin |
Related pages
- Invite organization members. Invite a member and assign one of these roles.
- Audit log. See who added or revoked a role, and when.
- Permission model. The Access Manager permissions your app's clients receive through tokens.