Users, roles and projects
Each account has one role on the instance. Projects then decide which pages and data the account can reach.
| Permission | Allows | Admin | Analyst | Viewer |
|---|---|---|---|---|
view |
Dashboards, scans, findings and reports | Yes | Yes | Yes |
scan:start |
Start scans and upload files | Yes | Yes | |
scan:cancel |
Stop running scans | Yes | Yes | |
scan:delete |
Delete scans and findings | Yes | Yes | |
finding:triage |
Change a finding’s state, severity, owner and due date | Yes | Yes | |
report:export |
Download reports and exports | Yes | Yes | |
share:create |
Create and revoke share links | Yes | Yes | |
credentials:manage |
Save cloud, Kubernetes, registry and repository credentials | Yes | Yes | |
audit:read |
Read the audit log | Yes | ||
settings:manage |
Configure the instance | Yes | ||
users:manage |
Manage users, roles and project access | Yes |
Custom roles with a narrower set of permissions can be created through the API at /api/admin/roles. A custom role cannot hold users:manage or settings:manage.
Project access
Section titled “Project access”Projects separate scans, findings, credentials and reports. The role applies across the instance. Project access decides which pages an account can use in each project.
- Go to Administration > Users & Roles.
- Open the account’s Access action.
- For each project, select the pages the account may use: Dashboard, Threat Advisor, Scan History, Findings, Pentest, SAST, DAST, SCA, Mobile, Cloud, K8s, Assets and SBOM.
- Select Save.
Saving replaces the account’s whole access map. Clearing a page removes it. Administrators reach every page. An account with no access map yet has full reach.
Administrators can switch the console between projects or select Show all projects. Other users see only their projects.
API tokens
Section titled “API tokens”Create personal API tokens under Profile > API Tokens.
| Field | Values |
|---|---|
| Note | What the token is for. |
| Access | Read (GET and HEAD only) or Read and write. |
| Expires in days | 1 to 365. Default 90. |
The token is shown once. It acts as its owner, with the owner’s role and project access. Administration endpoints need a read-and-write token belonging to an administrator. Revoking the token, or changing, disabling or resetting its owner, takes effect on the next request.