Roles and access
Dashboard roles
Section titled “Dashboard roles”| Role | Can |
|---|---|
| Owner | Everything, including deleting the organization (test environment only) |
| Admin | Members, keys and sources, plus everything an analyst can do |
| Analyst | Alerts, screening reviews, cases, packs and share links, and viewing evidence |
| Developer | Test keys, sources, the event explorer and validation |
| Viewer | Read everything except keys |
Owners and admins must use multi-factor authentication in production.
API key scopes
Section titled “API key scopes”API keys carry scopes instead of a role. Give each key only what it needs.
| Scope | Allows |
|---|---|
events:write | Send and validate events. The default for an ingest key. |
events:read | Read events. |
agents:read | Read agents, owners and payees. |
alerts:read, alerts:write | Read alerts, and act on them. |
cases:read, cases:write | Read cases, and change them. |
packs:write | Build and share evidence packs. |
screening:write | Run on-demand screening. |
Ingest needs an API key. A signed-in dashboard session cannot send events. See authentication.
Bank reviewers
Section titled “Bank reviewers”A reviewer needs no account. A share link opens one pack’s summary and timeline and lets them download the zip. The link expires (within 30 days), can be revoked, and every view is logged. Reviewers can verify the pack offline with the pack verifier.