The Console currently employs the following roles:

• Application Administrator
• Console Access Manager
• Console Access Viewer
• Customer Care Portal Agent
• Customer Care Portal Agent Manager
• Customer Care Portal Editor
• Customer Care Portal Agent Viewer
• Application Configuration Admin
• Application Configuration Manager
• Application Configuration Viewer
• User Profile Admin
• User Profile Manager
• User Profile Viewer
• Property Configuration Manager
• Registration Experience Manager

Note that the names shown in parentheses are the names you'll see in the Roles field if you Export agent data:

In other words. while the role might show up in Console as the Registration Experience Manager role, when you export agent roles that role will be listed as flow_manager. Similarly, the Application Admin role appears in the download as the admin role, the Customer Care Portal Editor role appears as the ccp_agent_update_only role, and so on.

For example, before putting together your agent infrastructure, you should have a clear understanding of the permissions granted to each of these roles. In addition, you might want to familiarize yourself with the following two topics:

• Restrict agent activity by profile type
• Assign multiple roles to an agent

Here’s a brief overview of the Console roles and the permissions granted to each one.

Application Admin (admin)

Application Administrators have full control over everything that can be done in the Console, and have access to all the pages within the Console. Administrators have access to all user profile management activities, can make application configuration changes, and are allowed to manage application permissions for other Console users.

📘

However, there is one thing that an Administrator cannot do: Administrators cannot modify their own role or their own set of permissions. That prevents you from inadvertently losing permissions or locking yourself out of the Console.

The Application Admin role:

• Allows you to invite Console users to access this application
• Allows you to remove Console users' access to this application
• Allows you to search for Console users with access to this application
• Allows you to view Console users with access to this application
• Allows you to update Console users' access to this application
• Allows you to create Console user groups
• Allows you to delete Console user groups
• Allows you to search for Console user groups
• Allows you to view Console user groups
• Allows you to update Console user groups
• Allows you to read audit logs for a specific profile
• Allows you to view profile counts
• Allows you to create profiles in Customer Care Portal
• Allows you to delete profiles in Customer Care Portal
• Allows you to search for profiles
• Allows you to view profiles in Customer Care Portal
• Allows you to update profiles in Customer Care Portal
• Allows you to create API clients
• Allows you to delete API clients
• Allows you to view API clients
• Allows you to view API client secrets
• Allows you to reset API client secrets
• Allows you to update API client permissions
• Allows you to read audit logs for Console user actions for an entire application
• Allows you to read audit logs for Console user actions for a specific user
• Allows you to create full user records
• Allows you to delete full user records
• Allows you to view full user records
• Allows you to update full user records
• Allows you to promote flows
• Allows you to create flows
• Allows you to delete flows
• Allows you to view flow information
• Allows you to update flows
• Allows you to grant all roles to Console users
• Allows you to grant Customer Care Portal agent roles to Console users
• Allows you to create entity types
• Allows you to delete entity types and schema attributes
• Allows you to view the schema
• Allows you to create and update schema attributes in all entity types
• Allows you to view API client settings
• Allows you to update API client settings
• Allows you to view global settings
• Allows you to update global settings

Console Access Manager (access_manager)

Console Access Managers have the ability to manage application permissions for other Console users; this includes inviting new users, updating access levels, and even removing access permissions for a user. However, this role does not have access to user profile data and cannot make any configuration changes: Console Access Managers can only access the Manage Agents section.

The Console Access Manager role:

• Allows you to invite Console users to access this application
• Allows you to remove Console users' access to this application
• Allows you to search for Console users with access to this application
• Allows you to view Console users with access to this application
• Allows you to update Console users' access to this application
• Allows you to search for Console user groups
• Allows you to view Console user groups
• Allows you to read audit logs for Console user actions for an entire application
• Allows you to read audit logs for Console user actions for a specific user
• Allows you to grant all roles to Console users
• Allows you to grant Customer Care Portal agent roles to Console users

Console Access Viewer (access_viewer)

Console Access Viewers have the ability to view the application permissions assigned to other Console users, but they cannot manage permissions or access to Console. This role does not have access to user profile data and cannot make configuration changes: Console Access Managers can only access the Manage Agents section.

The Console Access Viewer role:

• Allows you to search for Console users with access to this application
• Allows you to view Console users with access to this application
• Allows you to search for Console user groups
• Allows you to view Console user groups
• Allows you to read audit logs for Console user actions for an entire application
• Allows you to read audit logs for Console user actions for a specific user

Customer Care Portal Agent (ccp_agent)

This role is available only if an application has the Customer Care Portal feature enabled. If Customer Care Portal is enabled then, using the customized profile management forms on the Create User Profiles and Edit User Profile pages, Customer Care Portal Agents can create and delete profiles, update existing profiles, and send password reset and verification emails. This role only has access to the Manage Profiles section, and access to specific profiles may be restricted further based on entity type and profile attribute. A Customer Care Portal Agent does not have access to the Full Record pages that expose all the attributes of a user profile, nor do they have access to application configuration pages. In addition, Customer Care Portal Agents cannot view application permissions for other Console users.

The Customer Care Portal Agents role:

• Allows you to read audit logs for a specific profile
• Allows you to view profile counts
• Allows you to create profiles in Customer Care Portal
• Allows you to delete profiles in Customer Care Portal
• Allows you to search for profiles
• Allows you to view profiles in Customer Care Portal
• Allows you to update profiles in Customer Care Portal

Customer Care Portal Agent Manager (ccp_agent_manager)

This role is available only if an application has the Customer Care Portal feature enabled. If Customer Care Portal is enabled then, using the customized profile management forms on the Create User Profiles and Edit User Profile pages, Customer Care Portal Agent Managers can create and delete profiles, update existing profiles, and send password reset and verification emails. Agent Managers also have the ability to manage Customer Care Portal permissions for other Console users; this includes inviting new users, updating access levels, and removing access entirely. In addition, Agent Managers can view, but not manage, users with non-Customer Care Portal roles. Users holding this role have access to the Manage Agents and Manage Profiles sections, but do not have access to the Full Record pages that expose all the user profile attributes, and cannot make any application configuration changes.

The Customer Care Portal Agent Manager role:

• Allows you to invite Console users to access this application
• Allows you to remove Console users' access to this application
• Allows you to search for Console users with access to this application
• Allows you to view Console users with access to this application
• Allows you to update Console users' access to this application
• Allows you to create Console user groups
• Allows you to delete Console user groups
• Allows you to search for Console user groups
• Allows you to view Console user groups
• Allows you to update Console user groups
• Allows you to read audit logs for a specific profile
• Allows you to view profile counts
• Allows you to create profiles in Customer Care Portal
• Allows you to delete profiles in Customer Care Portal
• Allows you to search for profiles
• Allows you to view profiles in Customer Care Portal
• Allows you to update profiles in Customer Care Portal
• Allows you to read audit logs for Console user actions for an entire application
• Allows you to read audit logs for Console user actions for a specific user
• Allows you to grant Customer Care Portal agent roles to Console users

Customer Care Portal Editor (ccp_agent_update_only)

This role is available only if an application has the Customer Care Portal feature enabled. If Customer Care Portal is enabled then, using the customized profile management forms on the Create User Profiles and Edit User Profile pages, Customer Care Portal Editors can update existing profiles and send password reset and verification emails. This role only has access to the Manage Profiles section, and access to specific profiles may be restricted further based on entity type and profile attribute. Portal Editors do not have access to the Full Record pages that expose all the user profile attributes, and cannot access the Create User Profile page. Portal Editors cannot make any application configuration modifications, and they cannot view application permissions for other Console users.

The Customer Care Portal Editor role:

• Allows you to read audit logs for a specific profile
• Allows you to view profile counts
• Allows you to search for profiles
• Allows you to view profiles in Customer Care Portal
• Allows you to update profiles in Customer Care Portal

Customer Care Portal Agent Viewer (ccp_agent_viewer)

This role is available only if an application has the Customer Care Portal feature enabled. If Customer Care Portal is enabled then, using the customized profile management forms on the Create User Profiles and Edit User Profile pages, Customer Care Portal Agent Viewers can view existing profiles. This role only has access to the Manage Profiles section, and access to specific profiles may be further restricted based on entity type and profile attribute. Agent Viewers do not have access to the Full Record pages that expose all the user profile attributes, to the Create User Profile page, or to any application configuration pages. In addition, Agent Viewers cannot view application permissions for other Console users.

The Customer Care Portal Agent Viewer role:

• Allows you to read audit logs for a specific profile
• Allows you to view profile counts
• Allows you to search for profiles
• Allows you to view profiles in Customer Care Portal

User Profile Admin (profile_admin)

User Profile Admins can create, modify, and delete user records using the Full Record pages in the Manage Profiles section. This role only has access to the Manage Profiles section, and access to specific profiles may be further restricted based on entity type and profile attribute. User Profile Admins do not have access to application configurations and cannot view application permissions for other Console users.

The User Profile Admin role:

• Allows you to read audit logs for a specific profile
• Allows you to view profile counts
• Allows you to search for profiles
• Allows you to create full user records
• Allows you to delete full user records
• Allows you to view full user records
• Allows you to update full user records
• Allows you to view the schema

User Profile Manager (profile_manager)

User Profile Managers can modify existing user records using the Full Record pages in the Manage Profiles section. This role only has access to the Manage Profiles section, and access to specific profiles may be further restricted based on entity type and profile attribute. User Profile Managers do not have access to any application configurations and cannot view application permissions for other Console users.

The User Profile Manager role:

• Allows you to read audit logs for a specific profile
• Allows you to view profile counts
• Allows you to search for profiles
• Allows you to view full user records
• Allows you to update full user records
• Allows you to view the schema

User Profile Viewer (profile_viewer)

User Profile Viewers can view existing user records using the Full Record pages in the Manage Profiles section. This role only has access to the Manage Profiles section, and access to specific profiles may be further restricted based on entity type and profile attribute. The User Profile Viewer role does not have access to application configurations and cannot view application permissions for other Console users.

The User Profile Viewer role:

• Allows you to read audit logs for a specific profile
• Allows you to view profile counts
• Allows you to search for profiles
• Allows you to view full user records
• Allows you to view the schema

Application Configuration Admin (config_admin)

Application Configuration Admins have full control over application configuration changes; this includes creating and deleting properties and accessing client secrets. This role does not have access to user profile data and cannot view application permissions for other Console users. Application Configuration Admins have access to the Mange Applications, Manage Properties, and Manage Schemas sections.

The Application Configuration Admin role:

• Allows you to view profile counts
• Allows you to create API clients
• Allows you to delete API clients
• Allows you to view API clients
• Allows you to view API client secrets
• Allows you to reset API client secrets
• Allows you to update API client permissions
• Allows you to read audit logs for Console user actions for an entire application
• Allows you to read audit logs for Console user actions for a specific user
• Allows you to promote flows
• Allows you to create flows
• Allows you to delete flows
• Allows you to view flow information
• Allows you to update flows
• Allows you to create entity types
• Allows you to delete entity types and schema attributes
• Allows you to view the schema
• Allows you to create and update schema attributes in all entity types
• Allows you to view API client settings
• Allows you to update API client settings
• Allows you to view global settings
• Allows you to update global settings

Application Configuration Manager (config_manager)

Application Configuration Managers can manage changes to existing application configurations, including global settings, property permissions and settings, and schemas. This role cannot create or delete properties, access client secrets, access user profile data, or view application permissions for other Console users. Configuration Managers have access to the Mange Applications, Manage Properties, and Manage Schemas sections.

The Application Configuration Manager role:

• Allows you to view profile counts
• Allows you to view API clients
• Allows you to update API client permissions
• Allows you to promote flows
• Allows you to create flows
• Allows you to view flow information
• Allows you to update flows
• Allows you to view the schema
• Allows you to create and update schema attributes in all entity types
• Allows you to view API client settings
• Allows you to update API client settings
• Allows you to view global settings
• Allows you to update global settings

Application Configuration Viewer (config_viewer)

Application Configuration Viewers have read-only access to application configurations. Role-holders cannot make any configuration changes, access user profile data, or view application permissions for other Console users. Role-holders have access to the Mange Applications, Manage Properties, and Manage Schemas sections.

The Application Configuration Viewer role:

• Allows you to view profile counts
• Allows you to view API clients
• Allows you to view flow information
• Allows you to view the schema
• Allows you to view API client settings
• Allows you to view global settings

Property Configuration Manager (property_manager)

Property Managers have the ability to manage property settings and have read-only access to schemas and global settings. This role cannot access user profile data or view application permissions for other Console users. Property Managers have access to the Mange Applications, Manage Properties, and Manage Schemas sections.

The Property Configuration Manager role:

• Allows you to view profile counts
• Allows you to view API clients
• Allows you to view flow information
• Allows you to view the schema
• Allows you to view API client settings
• Allows you to update API client settings
• Allows you to view global settings

Registration Experience Manager (flow_manager)

Registration Experience Managers can use the Console's Registration Builder to manage flows, entity types, and schema attributes.

The Registration Experience Manager role:

• Allows you to view profile counts
• Allows you to view API clients
• Allows you to promote flows
• Allows you to create flows
• Allows you to view flow information
• Allows you to update flows
• Allows you to view the schema
• Allows you to view API client settings
• Allows you to update API client settings
• Allows you to view global settings
• Allows you to update global settings