> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opsmatic.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> What each organization role can do

## Overview

Every member of an organization has a **role** that determines what they can see and change. Roles range from full control (owner) to read-only (viewer), so you can safely add teammates, contractors and clients to the same organization.

## Roles at a Glance

| Capability                   | Owner | Admin | Member | External member | Viewer |
| ---------------------------- | :---: | :---: | :----: | :-------------: | :----: |
| View connections & analytics |   ✓   |   ✓   |    ✓   |        ✓        |    ✓   |
| Create / edit connections    |   ✓   |   ✓   |    ✓   |      Scoped     |    —   |
| Delete connections           |   ✓   |   ✓   |    ✓   |        —        |    —   |
| Invite / remove members      |   ✓   |   ✓   |    —   |        —        |    —   |
| Change member roles          |   ✓   |   ✓   |    —   |        —        |    —   |
| Manage billing & plan        |   ✓   |   —   |    —   |        —        |    —   |
| Delete the organization      |   ✓   |   —   |    —   |        —        |    —   |

<Note>
  Exact capabilities can evolve as the product does; this table reflects the intended model. Owner is always the highest level of access.
</Note>

## Role Descriptions

<AccordionGroup>
  <Accordion title="Owner">
    The person who created the organization. Full control over connections, members, billing and the organization itself. There is always exactly one owner responsibility on an organization.
  </Accordion>

  <Accordion title="Admin">
    Trusted operators. Manage connections and members and configure monitoring, but don't control billing or delete the organization.
  </Accordion>

  <Accordion title="Member">
    Day-to-day team members. Work with connections and analytics; can create connections in the organization (this is the minimum role required to do so via the API).
  </Accordion>

  <Accordion title="External member">
    Collaborators outside your core team — a partner or contractor — with scoped access to the organization's data.
  </Accordion>

  <Accordion title="Viewer">
    Read-only. Ideal for clients and stakeholders who should see status, uptime and reports but change nothing.
  </Accordion>
</AccordionGroup>

## How This Maps to API Keys

Organization roles govern **people** in the app. **API keys** have their own permission model (roles like `read-only` and `full-access`, and `resource: action` permissions). A member creating an API key can only grant it access they themselves have. See [Authentication](/api-reference/authentication).

## Related

<CardGroup cols={2}>
  <Card title="Managing Members" icon="user-plus" href="/organizations/managing-members">
    Invite, re-role and remove people
  </Card>

  <Card title="API Authentication" icon="key" href="/api-reference/authentication">
    Key roles and permissions
  </Card>
</CardGroup>