Skip to content

IDV Platform RBAC Permissions

This article explains how scopes, operations, and entity IDs define permissions in the IDV Platform Role-Based Access Control (RBAC) system.

Scopes List

The following scopes are available in IDV Platform:

Scope Description
session Access to sessions
pool Access to pools
person Access to person profiles
pool_job Access to pool jobs
workflow Access to workflows
view Access to saved views
group Access to groups
roles Access to roles and permissions
banlist Access to banlists
device Access to devices
user Access to users
analytics Access to analytics
live_room Access to live session rooms
secret Access to secrets and credentials
audit Access to audit logs
device_log Access to device logs
deeplink Access to deeplinks
docreader Access to document reader
faceapi Access to face services
translations Access to workflow translations
assets Access to workflow assets
apikey Access to API keys
ephemeral_device Access to temporary devices
transfer_resources Import/export resources
features Access to feature flags
files_upload Access to temporary file uploads
status_page Access to status page
license_usage_file Download license usage archives
iam_application Access to IAM applications
iam_person_application Access to IAM person applications
config Access to service configuration
admin_password_reset Issue admin password reset tokens
case Access to cases
virtual_session Access to virtual sessions
wf_shard Access to workflow shards
risk_predictor Access to risk predictors
entity_search Access to entity search

Operations List

The following table lists the permission operations supported by IDV Platform. The operations you can select for a specific permission depend on its scope. For example, the group scope supports create, list, read, update, and delete.

Operation Description
create Create an entity
list View a collection of entities
read View entity details
update Modify an entity
delete Remove an entity
subscribe Manage subscriptions
change_status Change status
download Download files
reload Reload data
assign Create an assignment

Entity-Level Access Control

The IDV Platform RBAC allows granular entity ID selection for the following scopes:

  • session
  • workflow
  • person
  • pool
  • case
  • group
  • roles
  • banlist
  • iam_application

For these scopes, you can configure access in one of two ways:

  • Restrict access: Specify one or more granular entity IDs.
  • Grant full access: Use the wildcard * to allow access to all entities.

For all other scopes, access is global (all-or-nothing). You cannot select individual entity IDs, and the wildcard * is applied implicitly. The wildcard includes all current and future entities within the scope for the specified operations.

Creator Ownership

Creator Ownership grants users access to entities they create, independently of the permissions inherited through groups and roles.

Users can perform all operations supported for their created entities, even if their roles do not grant the corresponding permissions.

Note

Creator Ownership does not override self-management restrictions, protections for immutable system objects, rules that prevent the deletion or deactivation of the last active Admin, or other mandatory business rules.

For example, roles and groups cannot be deleted while they have assignments, even if the user created them.

For more information about RBAC rules and restrictions, see RBAC General Rules and Constraints, Admin Role Restrictions, General Rules and Constraints for Default Roles, and Default Group Restrictions.

Operation Rules and Restrictions

The list, read, and create operations have specific access rules and restrictions.

The following table explains how these operations, individually and in combination, control access to Back Office UI sections and to entities through the UI and API.

Operation/Access Rule Description Access to UI Access to Own Entities Access to Others' Entities
list Grants access to the UI section (tab) and collection endpoint. Yes Can see previously created entities. Cannot see without read.
read Determines which specific entities a user can read (by entity IDs or *). Section is inaccessible without list. Can read via direct API. Only those explicitly allowed via read.
create Allows users to create entities. Through Creator Ownership, they receive access to all supported operations on the entities they create. Section is inaccessible without list. Full access, including update and delete. Grants no access.
list + read Gives full basic access to entities via the UI. Yes Full access thanks to Creator Ownership. Viewing allowed for entities permitted via read.
list + create Allows users to create new entities and manage them via the UI. Yes Full access to all supported operations, even without read. Cannot see without read.
create without list Allows users to create new entities and manage them through the API. No Full access via the API, but not through the UI section. No
Creator Ownership The creator automatically receives full access to the created entity, regardless of current permissions. Requires list All supported operations, including delete. Not applicable

Scopes and Operations Reference

Each scope supports a specific set of operations. When adding a permission to a role, you can select which operations from that set users are allowed to perform.

Operations can apply to all entities within a scope using *, or to specific entities using their IDs where granular entity-level access is available. For example, group:read:* grants read access to all groups, while group:read:6acce03152e41e5c60907ae3 limits read access to a specific group.

The following table lists the scopes, their available operations, and examples of permissions. For scopes with granular entity-level access, examples include both the wildcard (*) and a specific entity ID represented by <entity_id>.

Scope Operations Permission Example
session create, list, read,
update, delete, subscribe,
change_status, download		 session:read:*
session:read:<entity_id>
pool create, list, read,
update, delete		 pool:read:*
pool:read:<entity_id>
person create, list, read,
update, delete, subscribe,
change_status, download		 person:read:*
person:read:<entity_id>
pool_job create, list, read,
update, delete, subscribe		 pool_job:read:*
workflow create, list, read,
update, delete, reload		 workflow:read:*
workflow:read:<entity_id>
view create, list, read,
update, delete		 view:read:*
group create, list, read,
update, delete		 group:read:*
group:read:<entity_id>
roles create, list, read,
update, delete, assign		 roles:read:*
roles:read:<entity_id>
banlist create, list, read,
update, delete, download		 banlist:read:*
banlist:read:<entity_id>
device create, list, read,
update, delete, subscribe		 device:read:*
user create, list, read,
update, delete		 user:read:*
analytics read analytics:read:*
live_room create, read live_room:read:*
secret create, list, read,
update, delete		 secret:read:*
audit create, list, read,
update, delete, subscribe		 audit:read:*
device_log create, read device_log:read:*
deeplink create, read deeplink:read:*
docreader create, read, update,
delete		 docreader:read:*
faceapi create, read, update,
delete		 faceapi:read:*
translations create, list, read,
update, delete		 translations:read:*
assets create, list, read,
update, delete		 assets:read:*
apikey create, list, read,
update, delete		 apikey:read:*
ephemeral_device create, list, read,
update, delete, subscribe		 ephemeral_device:read:*
transfer_resources create, read transfer_resources:read:*
features update features:update:*
files_upload create, read files_upload:read:*
status_page read status_page:read:*
license_usage_file read license_usage_file:read:*
iam_application create, list, read,
update, delete		 iam_application:read:*
iam_application:read:<entity_id>
iam_person_application create, list, read,
update, delete		 iam_person_application:read:*
config create, list, read,
update, delete		 config:read:*
admin_password_reset update admin_password_reset:update:*
case create, list, read,
update, delete, change_status		 case:read:*
case:read:<entity_id>
virtual_session create, read, update virtual_session:read:*
wf_shard create, list, read,
update, delete		 wf_shard:read:*
risk_predictor create, list, read,
update, delete		 risk_predictor:read:*
entity_search list entity_search:list:*

For instructions on configuring permissions for a role, see Configure Role Permissions.

Common Actions and Required Permissions

The following table provides Platform Administrators with a quick reference to the permissions required to perform common actions through the API and UI in IDV Platform. Some UI actions need additional permissions to access the relevant sections or retrieve related data.

Info

The list and read operations serve different purposes. The list operation grants access to the corresponding Back Office UI section, while read allows users to view specific entities. Without list, users cannot access the corresponding UI section, even if they have read, update, or other permissions.

Action Permissions API Permissions UI Notes
View Users user:list:*, user:read:* or Creator Ownership user:list:*, user:read:* or Creator Ownership The API requires user:list:* to retrieve user lists and search for users.
View User Details user:read:* or Creator Ownership user:list:*, user:read:* or Creator Ownership user:list:* is not required when accessing user details through a direct link.
View Groups group:list:*, group:read:* or specific IDs (group:list:<group_id>, group:read:<group_id>) or Creator Ownership group:list:*, group:read:* or specific IDs (group:list:<group_id>, group:read:<group_id>) or Creator Ownership
View Group Details group:read:* or specific IDs (group:read:<group_id>) or Creator Ownership group:list:*, group:read:* or specific IDs (group:list:<group_id>, group:read:<group_id>) or Creator Ownership
View Roles roles:list:*, roles:read:* or specific IDs (roles:list:<role_id>, roles:read:<role_id>) or Creator Ownership roles:list:*, roles:read:* or specific IDs (roles:list:<role_id>, roles:read:<role_id>) or Creator Ownership
View Role Details roles:read:* or specific IDs (roles:read:<role_id>) or Creator Ownership roles:list:*, roles:read:* or specific IDs (roles:list:<role_id>, roles:read:<role_id>) or Creator Ownership; entity_search:list:* Entities are displayed by name when available; otherwise, their IDs are shown.
Create a Role roles:create:* roles:list:*, roles:create:*, entity_search:list:* entity_search:list:* determines which specific entity IDs are available to the user for each scope.
Create a Group group:create:* group:list:*, group:create:*
Create a User user:create:* user:list:*, user:create:*
Edit a Role roles:update:* or specific IDs (roles:update:<role_id>) or Creator Ownership roles:list:*, roles:update:* or specific IDs (roles:list:<role_id>, roles:update:<role_id>) or Creator Ownership; entity_search:list:*
Edit a Group group:update:* or specific IDs (group:update:<group_id>) or Creator Ownership group:list:*, group:update:* or specific IDs (group:list:<group_id>, group:update:<group_id>) or Creator Ownership
Manage Members (Add Users to a Group) group:update:* or specific IDs (group:update:<group_id>); user:read:* or Creator Ownership group:list:*, group:read:*, group:update:* or specific IDs (group:list:<group_id>, group:read:<group_id>, group:update:<group_id>); user:list:*, user:read:* or Creator Ownership Users cannot modify their own group memberships.
Assign a Role to a Group (from Group Details) roles:assign:*, roles:read:* or specific IDs (roles:read:<role_id>); group:read:* or specific IDs (group:read:<group_id>) roles:list:*, roles:assign:*, roles:read:* or specific IDs (roles:list:<role_id>, roles:read:<role_id>); group:list:*, group:read:* or specific IDs (group:list:<group_id>, group:read:<group_id>) Users cannot assign roles to groups they belong to.
Delete a Group group:delete:* or specific IDs (group:delete:<group_id>) or Creator Ownership group:list:*, group:read:* or specific IDs (group:list:<group_id>, group:read:<group_id>); group:delete:* or specific IDs (group:delete:<group_id>) or Creator Ownership A group can be deleted only if it has no assignments.
Delete a Role roles:delete:* or specific IDs (roles:delete:<role_id>) or Creator Ownership roles:list:*, roles:read:* or specific IDs (roles:list:<role_id>, roles:read:<role_id>); roles:delete:* or specific IDs (roles:delete:<role_id>) or Creator Ownership Only custom roles can be deleted, and only if they are not assigned to any groups.
Duplicate a Role roles:create:* or Creator Ownership roles:list:*, roles:create:*, roles:read:* or Creator Ownership; entity_search:list:* The user must have permission to create a role and access the source role. The permissions configured for the new role cannot exceed the user's own permissions.
Activate a User user:update:* or Creator Ownership user:list:*, user:update:*, user:read:* or Creator Ownership Available from the … menu in the Users list. Users cannot activate their own accounts.
Deactivate a User user:update:* or Creator Ownership user:list:*, user:update:*, user:read:* or Creator Ownership Available from the … menu in the Users list. Users cannot deactivate their own accounts.

For API endpoints, request parameters, and response schemas related to access management, see the OpenAPI Documentation.

Next Step

Learn how users receive permissions and how their access is managed in IDV Platform in Users.