# User permissions

User permissions let you manage what your Dashboard users can access and what actions they can take.
If you have multiple entities, you can also specify which entities each user has access to.

There are various pre-defined roles that have a fixed set of permissions.
You can also create custom roles with specific permissions to meet your needs.
Roles can apply to individual users or groups of users.

This page also provides guidance on how to manage your users.

---

## Pre-defined roles

The Dashboard has the following pre-defined roles that have a fixed set of permissions:

**Account application only**

Manages the onboarding process:

- Account activation – Manage applications for new entities and sub-entities
- Personally identifiable information (PII) – View customer PII (such as name, card number and email)
- Sub-entities – Download files associated with sub-entities

**Account owner**

Owns the account:

- Account:
    - Manage account structure
    - Manage processing settings (website URLs, payment methods, processing channels and account structure)
    - Manage team security settings including single sign-on
    - Transfer ownership
    - View sensitive business stakeholder details
- View all client-level [support requests](https://www.checkout.com/docs/business-operations/use-the-dashboard/manage-support-requests.md)
- All other permissions

While the Account owner has full access and can perform all tasks, they can only perform tasks requiring an [authorized or delegated signatory](https://support.checkout.com/hc/en-us/articles/19724483783186) if they are also a signatory.

**Admin**

Manages all areas and edits settings of the Dashboard for own entities:

- Account:
    - Manage processing settings (website URLs, payment methods, processing channels and account structure)
    - View account settings (business stakeholders, billing descriptors, processing channels, bank settlements, business contacts and payment methods)
    - View sensitive business stakeholder details
- Account rules:
    - Create, edit, or delete rules
    - View the list of rules
- Business account – View all sub-account balances and add funds
- Compliance:
    - Manage compliance requests
    - View compliance requests
- Developers:
    - Create new keys
    - Edit Issuing authorization relay settings
    - View the list of keys
- Disputes:
    - Accept disputes and submit evidence
    - View unanswered and all disputes lists
- Fraud management
    - Create, edit, or delete rules
    - Decline high-risk payments
- Funds management:
    - Access spending credentials for all cards
    - Create new, rename, and change limits for all cards
    - View last four digits, transactions, and card name for all cards
    - View spending credentials and transactions for cards assigned to them
- Homepage & analytics – View homepage, KPIs, and Analytics section
- Identities:
    - Process identities checks and manage configurations
    - View identities checks and data
- Invoices – View and download monthly fees invoices
- Issuing:
    - Create and edit cards and cardholders; Simulate transactions
    - View all transactions, cards, cardholders, and card products
    - View card number and CVC2
- Network tokens:
    - Access to download the reports from Network Tokens Dashboard page
    - Manage access from the Network Tokens Dashboard page - Enable, Disable, Add, Modify configurations for NT
    - Read access to the Network Tokens Dashboard page
- Notifications:
    - Create, edit and delete workflow notifications
    - View secret keys
    - View the list of workflow notifications
- Payments:
    - Capture payments
    - Manage payment documents
    - Refund payments
    - View and manage billing descriptors
    - View and search for payments
    - View, approve or reject pending refund requests triggered by account rules
    - View payment details
    - Void payments
- Payments creation:
    - Create payments (Payment Links and manual payments)
    - View all Payment Links
- Personally identifiable information (PII) – View customer PII (such as name, card number and email)
- Reports – View and generate payment reports
- Settlements:
    - Change bank account details and balance minimums, and add stablecoin wallets
    - View and search for settlements
    - View settlements details and download the transaction breakdown report
- Sub-entities:
    - Download files associated with sub-entities
    - Onboard and edit sub-entity details
    - View list of own sub-entities only
- Transfers:
    - Execute wallet transfers
    - Make transfers
    - View list of transfers
- User management:
    - Create, edit, and delete custom roles
    - Create, edit, and delete users on the account
    - View the list of users on the account
- Vault:
    - Access to download the reports from Vault Dashboard page
    - Manage access from the Vault Dashboard page - Create, Delete, Edit Instruments
    - Read access to the Vault Dashboard page

**Compliance operator**

Manage requests for information about payments that have been flagged for regulatory compliance checks.

- Account - View account settings (business stakeholders, billing descriptors, processing channels, bank settlements, business contacts and payment methods)
- Compliance:
    - Manage compliance requests
    - View compliance requests
- Notifications:
    - Create, edit and delete workflow notifications
    - View the list of workflow notifications
- Payments:
    - View and search for payments
    - View payment details
- Payments creation – View all Payment Links
- Personally identifiable information (PII) – View customer PII (such as name, card number and email)

**Developer**

Manages workflows and views access keys and payments data:

- Account - View account settings (business stakeholders, billing descriptors, processing channels, bank settlements, business contacts and payment methods)
- Developers:
    - Create new keys
    - Edit Issuing authorization relay settings
    - View the list of keys
- Homepage & analytics – View homepage, KPIs, and Analytics section
- Issuing – View all transactions, cards, cardholders, and card products
- Notifications:
    - Create, edit and delete workflow notifications
    - View secret keys
    - View the list of workflow notifications
- Payments:
    - View and search for payments
    - View payment details
- Personally identifiable information (PII) – View customer PII (such as name, card number and email)
- Reports – View and generate payment reports

**Disputes manager**

Views payments data and manages disputes:

- Account - View account settings (business stakeholders, billing descriptors, processing channels, bank settlements, business contacts and payment methods)
- Disputes:
    - Accept disputes and submit evidence
    - View unanswered and all disputes lists
- Homepage & analytics – View homepage, KPIs, and Analytics section
- Issuing – View all transactions, cards, cardholders, and card products
- Network tokens – Read access to the Network Tokens Dashboard page
- Payments:
    - View and search for payments
    - View payment details
- Personally identifiable information (PII) – View customer PII (such as name, card number and email)
- Reports – View and generate payment reports
- Sub-entities – View list of own sub-entities only
- Vault – Read access to the Vault Dashboard page

**Disputes operator**

Manages disputes only:

- Account - View account settings (business stakeholders, billing descriptors, processing channels, bank settlements, business contacts and payment methods)
- Disputes:
    - Accept disputes and submit evidence
    - View unanswered and all disputes lists
- Issuing – View all transactions, cards, cardholders, and card products
- Payments – View payment details
- Personally identifiable information (PII) – View customer PII (such as name, card number and email)
- Vault – Read access to the Vault Dashboard page

**Identity and access management (IAM) admin**

Manages team permission and security settings including single sign-on (SSO) configuration for all entities:

- Account
    - Manage team security settings including single sign-on
    - View account settings (business stakeholders, billing descriptors, processing channels, bank settlements, business contacts and payment methods)
- Personally identifiable information (PII) – View customer PII (such as name, card number and email)
- User management:
    - Create, edit, and delete custom roles
    - Create, edit, and delete users on the account
    - Manage team security settings including single sign-on
    - View the list of users on the account

**Read only**

Views payments data only for all entities:

- Account - View account settings (business stakeholders, billing descriptors, processing channels, bank settlements, business contacts and payment methods)
- Disputes – View unanswered and all disputes lists
- Funds management – View spending credentials and transactions for cards assigned to them
- Homepage & analytics – View homepage, KPIs, and Analytics section
- Issuing – View all transactions, cards, cardholders, and card products
- Network tokens – Read access to the Network Tokens Dashboard page
- Notifications – View the list of workflow notifications
- Payments:
    - View and search for payments
    - View payment details
- Payments creation – View all Payment Links
- Personally identifiable information (PII) – View customer PII (such as name, card number and email)
- Reports – View and generate payment reports
- Sub-entities – View list of own sub-entities only
- Transfers – View list of transfers

**Risk manager**

Manages the decline payments functionality and views payments data and disputes:

- Account - View account settings (business stakeholders, billing descriptors, processing channels, bank settlements, business contacts and payment methods)
- Disputes – View unanswered and all disputes lists
- Fraud management
    - Create, edit, or delete rules
    - Decline high-risk payments
- Homepage & analytics – View homepage, KPIs, and Analytics section
- Issuing – View all transactions, cards, cardholders, and card products
- Network tokens – Read access to the Network Tokens Dashboard page
- Payments:
    - View and search for payments
    - View payment details
- Personally identifiable information (PII) – View customer PII (such as name, card number and email)
- Reports – View and generate payment reports
- Transfers – View list of transfers
- Vault:
    - Access to download the reports from Vault Dashboard page
    - Read access to the Vault Dashboard page

**Support manager**

Views and manages payments data and disputes. For PayFac accounts, views sub-entities too:

- Account - View account settings (business stakeholders, billing descriptors, processing channels, bank settlements, business contacts and payment methods)
- Disputes:
    - Accept disputes and submit evidence
    - View unanswered and all disputes lists
- Homepage & analytics – View homepage, KPIs, and Analytics section
- Issuing:
    - Create and edit cards and cardholders; Simulate transactions
    - View all transactions, cards, cardholders, and card products
- Network Tokens:
    - Access to download the reports from Network Tokens Dashboard page
    - Read access to the Network Tokens Dashboard page
- Notifications – View the list of workflow notifications
- Payments:
    - Capture payments
    - Manage payment documents
    - Refund payments
    - View and search for payments
    - View payment details
    - Void payments
- Payments creation:
    - Create payments (Payment Links and manual payments)
    - View all Payment Links
- Personally identifiable information (PII) – View customer PII (such as name, card number and email)
- Reports – View and generate payment reports
- Settlements:
    - View and search for settlements
    - View settlements details and download the transaction breakdown report
- Sub-entities:
    - Download files associated with sub-entities
    - Onboard and edit sub-entity details
    - View list of own sub-entities only
- Transfers – View list of transfers
- Vault:
    - Access to download the reports from Vault Dashboard page
    - Read access to the Vault Dashboard page

---

## Permissions

Certain tasks in the Dashboard require a specific permission to carry out.
Each permission may be available to one or more pre-defined roles.
You can also add certain permissions individually to custom roles.

Permissions are grouped as follows:

- [Account](#Account)
- [Account activation](#Account_activation)
- [Account rules](#Account_rules)
- [Business account](#Business_account)
- [Compliance](#Compliance)
- [Developers](#Developers)
- [Disputes](#Disputes)
- [Fraud management](#Fraud_management)
- [Funds management](#Funds_management)
- [Homepage and analytics](#Homepage_and_analytics)
- [Invoices](#Invoices)
- [Issuing](#Issuing)
- [Network tokens](#Network_tokens)
- [Notifications](#Notifications)
- [Payments](#Payments)
- [Payments creation](#Payments_creation)
- [Personally identifiable information (PII)](#Personally_identifiable_information)
- [Reports](#Reports)
- [Settlements](#Settlements)
- [Sub-entities](#Sub-entities)
- [Transfers](#Transfers)
- [User management](#User_management)
- [Vault](#Vault)

### Account

| Permission | Pre-defined roles |
| --- | --- |
| Manage account structure<br><br>Cannot be added to a custom role | Account owner |
| Manage processing settings (website URLs, payment methods, processing channels, and account structure)<br><br>Cannot be added to a custom role | - Account owner<br>- Admin |
| Manage team security settings including [single sign-on](https://www.checkout.com/docs/business-operations/use-the-dashboard/single-sign-on.md)<br><br>Cannot be added to a custom role | - Account owner<br>- IAM admin |
| Transfer ownership<br><br>Cannot be added to a custom role | Account owner |
| View account settings (business stakeholders, billing descriptors, processing channels, bank settlements, business contacts and payment methods) | - Account owner<br>- Admin<br>- Compliance operator<br>- Developer<br>- Disputes manager<br>- Disputes operator<br>- Identity and access management (IAM) admin<br>- Read only<br>- Risk manager<br>- Support manager |
| View sensitive business stakeholder details<br><br>Cannot be added to a custom role | - Account owner<br>- Admin |

### Account activation

| Permission | Pre-defined roles |
| --- | --- |
| Manage applications for new entities and sub-entities<br><br>Cannot be added to a custom role | Account application only |

### Account rules

| Permission | Pre-defined roles |
| --- | --- |
| Create, edit, or delete rules<br><br>For configuring [account rules](https://www.checkout.com/docs/business-operations/use-the-dashboard/configure-account-rules.md), including approval flows | Admin |
| View the list of rules<br><br>For account rules configured on the account | Admin |

### Business account

| Permission | Pre-defined roles |
| --- | --- |
| View all sub-account [balances](https://www.checkout.com/docs/funds-management/manage-funds/balances.md) and add funds<br><br>To use this permission, you must also have the Homepage and analytics – View homepage, KPIs, and Analytics section permission. | Admin |

### Compliance

| Permission | Pre-defined roles |
| --- | --- |
| Manage compliance requests | - Admin<br>- Compliance operator |
| View compliance requests | - Admin<br>- Compliance operator |

### Developers

| Permission | Pre-defined roles |
| --- | --- |
| Create new keys | - Admin<br>- Developer |
| Edit Issuing [authorization relay](https://www.checkout.com/docs/funds-management/manage-funds/balances.md) settings | - Admin<br>- Developer |
| Edit or delete keys | None |
| View the list of keys | - Admin<br>- Developer |

### Disputes

| Permission | Pre-defined roles |
| --- | --- |
| Accept [disputes](https://www.checkout.com/docs/payments/process-disputes.md) and submit evidence | - Admin<br>- Disputes manager<br>- Disputes operator<br>- Support manager |
| View unanswered and all disputes lists | - Admin<br>- Disputes manager<br>- Disputes operator<br>- Read only<br>- Risk manager<br>- Support manager |

### Fraud management

| Permission | Pre-defined roles |
| --- | --- |
| Create, edit, or delete rules | - Admin<br>- Risk manager |
| Decline high-risk payments | - Admin<br>- Risk manager |

### Funds management

| Permission | Pre-defined roles |
| --- | --- |
| Access spending credentials for all cards `Beta`<br><br>For all the entity’s [Corporate Cards](https://www.checkout.com/docs/funds-management/spend-funds/corporate-cards.md) | Admin |
| Create new, rename, and change limits for all cards `Beta`<br><br>For Corporate Cards, including changing card users and revoking cards | Admin |
| View last four digits, transactions, and card name for all cards `Beta`<br><br>For all the entity’s Corporate Cards | Admin |
| View spending credentials and transactions for cards assigned to them `Beta`<br><br>For Corporate Cards assigned to you, including suspending and reactivating cards | - Admin<br>- Read only |

### Homepage and analytics

| Permission | Pre-defined roles |
| --- | --- |
| View homepage, KPIs, and Analytics section | - Admin<br>- Developer<br>- Disputes manager<br>- Read only<br>- Risk manager<br>- Support manager |

### Invoices

| Permission | Pre-defined roles |
| --- | --- |
| View and download monthly fees [invoices](https://www.checkout.com/docs/funds-management/retrieve-financial-reports/invoices.md) | Admin |

### Issuing

| Permission | Pre-defined roles |
| --- | --- |
| Create and edit cards and cardholders; Simulate transactions | - Admin<br>- Support manager |
| Raise, amend, escalate and withdraw Issuing disputes | - Admin<br>- Disputes manager<br>- Support manager |
| View all transactions, cards, cardholders, and card products | - Admin<br>- Developer<br>- Disputes manager<br>- Disputes operator<br>- Read only<br>- Risk manager<br>- Support manager |
| View card number and CVC2 | Admin |

### Network tokens

| Permission | Pre-defined roles |
| --- | --- |
| Access to download the reports from [Network Tokens](https://www.checkout.com/docs/payments/store-and-manage-credentials/store-credentials/network-tokens.md) Dashboard page | - Admin<br>- Support manager |
| Manage access from the Network Tokens Dashboard page - Enable, Disable, Add, Modify configurations for NT | Admin |
| Read access to the Network Tokens Dashboard page | - Admin<br>- Disputes manager<br>- Read only<br>- Risk manager<br>- Support manager |

### Notifications

| Permission | Pre-defined roles |
| --- | --- |
| Create, edit and delete workflow notifications | - Admin<br>- Compliance operator<br>- Developer |
| View secret keys | - Admin<br>- Developer |
| View the list of workflow notifications | - Admin<br>- Compliance operator<br>- Developer<br>- Read only<br>- Support manager |

### Payments

| Permission | Pre-defined roles |
| --- | --- |
| Capture payments | - Admin<br>- Support manager |
| Manage payment documents | - Admin<br>- Support manager |
| Refund payments | - Admin<br>- Support manager |
| View and manage [billing descriptors](https://www.checkout.com/docs/payments/manage-payments/manage-billing-descriptors.md) | Admin |
| View and search for payments | - Admin<br>- Compliance operator<br>- Developer<br>- Disputes manager<br>- Read only<br>- Risk manager<br>- Support manager |
| View, approve or reject pending refund requests triggered by account rules | Admin |
| View payment details | - Admin<br>- Compliance operator<br>- Developer<br>- Disputes manager<br>- Disputes operator<br>- Read only<br>- Risk manager<br>- Support manager |
| Void payments | - Admin<br>- Support manager |

### Payments creation

| Permission | Pre-defined roles |
| --- | --- |
| Create payments ([Payment Links](https://www.checkout.com/docs/payments/accept-payments/create-a-payment-link.md) and manual payments) | - Admin<br>- Support manager |
| View all Payment Links | - Admin<br>- Compliance operator<br>- Read only<br>- Support manager |

### Personally identifiable information

| Permission | Pre-defined roles |
| --- | --- |
| View customer PII (such as name, card number and email) | - Account application only<br>- Admin<br>- Compliance operator<br>- Developer<br>- Disputes manager<br>- Disputes operator<br>- IAM admin<br>- Read only<br>- Risk manager<br>- Support manager |

### Reports

| Permission | Pre-defined roles |
| --- | --- |
| View and generate payment [reports](https://www.checkout.com/docs/business-operations/retrieve-reports.md) | - Admin<br>- Developer<br>- Disputes manager<br>- Read only<br>- Risk manager<br>- Support manager |

### Settlements

| Permission | Pre-defined roles |
| --- | --- |
| Change [bank account details](https://www.checkout.com/docs/funds-management/receive-settlements/manage-settlements.md#Update_a_bank_account) and balance minimums, and add [stablecoin wallets](https://www.checkout.com/docs/funds-management/move-funds/transfer-funds-to-wallets.md) | - Admin<br>- Support manager |
| View and search for [settlements](https://www.checkout.com/docs/funds-management/receive-settlements.md) | - Admin<br>- Support manager |
| View settlements details and download the transaction breakdown report | - Admin<br>- Support manager |

### Sub-entities

| Permission | Pre-defined roles |
| --- | --- |
| Download files associated with [sub-entities](https://www.checkout.com/docs/platforms/onboard-sub-entities.md) | - Account application only<br>- Admin<br>- Support manager |
| Onboard and edit sub-entity details | - Admin<br>- Support manager |
| View list of own sub-entities only | - Admin<br>- Disputes manager<br>- Read only<br>- Support manager |

### Transfers

| Permission | Pre-defined roles |
| --- | --- |
| Execute [wallet transfers](https://www.checkout.com/docs/funds-management/move-funds/transfer-funds-to-wallets.md) | Admin |
| Make [transfers](https://www.checkout.com/docs/funds-management/move-funds.md) | - Account owner<br>- Admin |
| View a list of transfers between sub-accounts | - Account owner<br>- Admin<br>- Read only<br>- Risk manager<br>- Support manager |

### User management

| Permission | Pre-defined roles |
| --- | --- |
| Create, edit, and delete custom roles<br><br>Cannot be added to a custom role | - Admin<br>- IAM admin |
| Create, edit, and delete users on the account | - Admin<br>- IAM admin |
| View the list of users on the account | - Admin<br>- IAM admin |

### Vault

| Permission | Pre-defined roles |
| --- | --- |
| Access to download the reports from [Vault](https://www.checkout.com/docs/payments/store-and-manage-credentials.md) Dashboard page | - Admin<br>- Risk manager<br>- Support manager |
| Manage access from the Vault Dashboard page - Create, Delete, Edit Instruments | Admin |
| Read access to the Vault Dashboard page | - Admin<br>- Disputes manager<br>- Disputes operator<br>- Risk manager<br>- Support manager |

---

## Custom roles

In addition to the pre-defined roles that have a fixed set of permissions, you can also create custom roles with specific permissions as required. You must have the Admin role to create custom roles and assign them to users.

### Create a custom role

To create a custom role:

1. Sign in to the [Dashboard](https://dashboard.checkout.com).
2. Select the _Settings menu_ in the top navigation bar, and then select _Settings_.
3. On the _Settings_ page, under _Team settings_, select _Roles and permissions_.
4. On the _Roles and permissions_ page, in the _Popular roles_ section, select _View all roles_.
5. On the _Roles_ page, under _Organization roles_, select _New role_.
6. On the _Create custom role_ page, under _Settings_, enter the _Role name_ and _Description_.
7. Under _Permissions_, select the relevant permissions for the role.

    You must assign at least one permission and can assign as many as needed, except for the following, which are not available for custom roles:

    - User management – Account owner and Admin roles only
    - Manage team security settings including single sign-on – Account owner and IAM admin roles only
    - Manage processing settings (website URLs, payment methods, processing channels, and account structure) – Account owner and Admin roles only

8. Select _Create custom role_ to save the role.

The new custom role is displayed in the _Organization roles_ section on the _Roles_ page. You can now assign the role to new and existing users.

### Assign a custom role to an existing user

To assign a custom role to an existing user:

1. Sign in to the [Dashboard](https://dashboard.checkout.com).
2. Select the _Settings menu_ in the top navigation bar, and then select _Settings_.
3. On the _Settings_ page, under _Team settings_, select _Roles and permissions_.
4. On the _Roles and permissions_ page, under _Users_, select the user you want to assign the role to.
5. On the _User profile_ page, select _Edit user_.
6. On the _Edit user_ page, under _Permissions_, from the _Role_ dropdown, select the custom role you want to assign to the user.
7. Select _Save user_ to confirm.

### View all roles

To view all pre-defined and custom roles set up and currently active for your organization:

1. Sign in to the [Dashboard](https://dashboard.checkout.com).
2. Select the _Settings menu_ in the top navigation bar, and then select _Settings_.
3. On the _Settings_ page, under _Team settings_, select _Roles and permissions_.
4. In the _Popular roles_ section, select _View all roles_.

### Edit a custom role

You can edit permissions assigned to a custom role as required. You cannot edit pre-defined roles.

To edit a custom role:

1. Sign in to the [Dashboard](https://dashboard.checkout.com).
2. Select the _Settings menu_ in the top navigation bar, and then select _Settings_.
3. On the _Settings_ page, under _Team settings_, select _Roles and permissions_.
4. On the _Roles and permissions_ page, in the _Popular roles_ section, select _View all roles_.
5. On the _Roles_ page, under _Organization roles_, select the role you want to edit.
6. On the _Role details_ page, select _Edit role_.
7. On the _Edit custom role_ page, make the required changes, and then select _Update custom role_.

> **Note**
>
> Editing a role affects the permissions for _all_ users assigned to that role.

### Delete a custom role

When a custom role is no longer needed, you can delete it. You cannot delete pre-defined roles.

To delete a custom role:

1. Sign in to the [Dashboard](https://dashboard.checkout.com).
2. Select the _Settings menu_ in the top navigation bar, and then select _Settings_.
3. On the _Settings_ page, under _Team settings_, select _Roles and permissions_.
4. On the _Roles and permissions_ page, in the _Popular roles_ section, select _View all roles_.
5. On the _Roles_ page, under _Organization roles_, select the role you want to delete.
6. On the _Role details_ page, select _Delete role_.
7. In the confirmation dialog that appears, select _Delete role_ to confirm.

> **Note**
>
> Any user assigned to a role that is deleted is transferred to the _Read only_ role by default.