Workspace roles
Every workspace membership has one of five access roles. From least to most access they are View only, Operator, Editor, Admin, and Owner. Each role can do everything the roles before it can.
Role codes
Section titled “Role codes”| Code | Label | Summary |
|---|---|---|
view_only | View only | Opens dashboards and history reports and reads live values |
operator | Operator | Day-to-day plant operation: reads and writes live values on dashboards |
editor | Editor | Setup, dashboards, live values, local pull and push, and own workspace API keys |
admin | Admin | Editor access plus members, name, branding, limits, stored data, everyone’s workspace API keys |
owner | Owner | Admin access plus the workspace’s billing account and workspace deletion |
The API, the CLI, and dashboard code use the codes. The app shows the translated label, for example under each workspace name in the workspace switcher.
A workspace has exactly one owner. The person who creates a workspace becomes its owner.
Capabilities
Section titled “Capabilities”Dashboard code checks the same rules with canWriteSetup, canWriteParameterValues, and
canManageWorkspace from @overvis/hmi-shared/workspace.
| Action | view_only | operator | editor | admin | owner |
|---|---|---|---|---|---|
| List and open the workspace | ✓ | ✓ | ✓ | ✓ | ✓ |
| Open dashboards | ✓ | ✓ | ✓ | ✓ | ✓ |
Open the history report runtime (/reports/$presetId) | ✓ | ✓ | ✓ | ✓ | ✓ |
Freeze live values into report snapshots (freezeFromLive) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Read live parameter values | ✓ | ✓ | ✓ | ✓ | ✓ |
List report comments (report.comment.list) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Open workspace settings | ✓ | ✓ | ✓ | ✓ | ✓ |
| See active alarms and the alarm log | ✓ | ✓ | ✓ | ✓ | ✓ |
| Write live parameter values | ✗ | ✓ | ✓ | ✓ | ✓ |
| Acknowledge and shelve alarms | ✗ | ✓ | ✓ | ✓ | ✓ |
Create a temporary report (createTemporary) | ✗ | ✓ | ✓ | ✓ | ✓ |
Create report comments and signatures (report.comment.create) | ✗ | ✓ | ✓ | ✓ | ✓ |
Delete report comments (report.comment.delete) | ✗ | ✓ | ✓ | ✓ | ✓ |
| Open Setup and activity history | ✗ | ✗ | ✓ | ✓ | ✓ |
| Create, edit, and delete endpoints, parameters, dashboards, and automations | ✗ | ✗ | ✓ | ✓ | ✓ |
| Create, edit, and delete alarm rules | ✗ | ✗ | ✓ | ✓ | ✓ |
| Enable and disable Setup entities | ✗ | ✗ | ✓ | ✓ | ✓ |
| List, create, and edit report presets in Setup → Reports | ✗ | ✗ | ✓ | ✓ | ✓ |
Promote a temporary report (saveTemporary) | ✗ | ✗ | ✓ | ✓ | ✓ |
| Pull, push, and revoke their own workspace API keys | ✗ | ✗ | ✓ | ✓ | ✓ |
| Invite and remove members, change member roles | ✗ | ✗ | ✗ | ✓ | ✓ |
| See and revoke everyone’s workspace API keys | ✗ | ✗ | ✗ | ✓ | ✓ |
| Rename the workspace, change its logo and favicon, automation and SMS limits | ✗ | ✗ | ✗ | ✓ | ✓ |
| Change stored-data retention, delete stored data | ✗ | ✗ | ✗ | ✓ | ✓ |
| See the workspace’s billing account | ✗ | ✗ | ✗ | ✓ | ✓ |
| Change the billing account, delete the workspace | ✗ | ✗ | ✗ | ✗ | ✓ |
| Leave the workspace | ✓ | ✓ | ✓ | ✓ | ✗ |
| Create a workspace (account action) | ✓ | ✓ | ✓ | ✓ | ✓ |
Notes on the table:
- History report runtime: every member, including View only, can open the runtime report page. Viewers and operators have no workspace Reports list. They open a report from a dashboard or a direct link.
- Freeze live values:
report.preset.freezeFromLiveis a read, not Setup authoring. - Temporary report: a temporary report is a Quick report that a dashboard offers. It is
missing from Setup → Reports and from pull until an editor, admin, or owner saves it with
saveTemporary.report.preset.getby UUID still returns it. - Delete report comments: editors, admins, and owners can delete any comment, signatures
included. Operators can delete only their own non-signature
kind:usercomments created strictly after the latest signature on that preset. - Setup and activity history: viewers and operators see no Setup menu. Every Setup URL, Activity history included, takes them back to the dashboards. The API procedures that read setup stay open to every member, because dashboards use them.
- Workspace API keys: the keys local workspaces use, listed on the CLI keys tab of Workspace settings.
- Create a workspace: creating a workspace does not depend on a role in another workspace. Any admitted, onboarded account can create one from the workspace switcher and becomes its owner.
Membership rules
Section titled “Membership rules”- Admins and the owner invite people by email as View only, Operator, Editor, or Admin.
- Admins and the owner can change the role of any other member, including making them an admin, and can remove any other member.
- Nobody can change the owner’s role or remove the owner.
- Every member except the owner can leave the workspace. The owner cannot leave a workspace they own. An owner can delete their last workspace and later create a new one from the empty account state.
Assistant and API keys
Section titled “Assistant and API keys”The AI assistant acts with the signed-in user’s workspace role and cannot do anything that role does not allow. A personal API key acts with the key owner’s role in each workspace. A workspace API key acts with the key owner’s role in its one workspace. What each kind of key reaches is under API authentication, and the API’s role table under API permissions.
Access errors
Section titled “Access errors”The app shows these messages in the selected UI language. The API sends the code as the error
message.
| Situation | Code | Message (English) |
|---|---|---|
| No membership | workspace_no_access | You do not have access to this workspace. |
| Workspace suspended | workspace_suspended | This workspace is suspended. Open it to see why. |
| Non-owner on an owner action | workspace_not_owner | Only the workspace owner can do that. |
| Non-admin on an admin action | workspace_not_admin | Only a workspace admin or owner can do that. |
| Non-editor changing or syncing the setup | workspace_not_editor | Only a workspace editor, admin, or owner can do that. |
| View only member writing values | workspace_not_operator | Only a workspace operator, editor, admin, or owner can do that. |
| Workspace API key used outside its workspace | workspace_api_key_scope | This API key is limited to one workspace and cannot be used for this action. |
| Owner leaving their workspace | workspace_owner_cannot_leave | The workspace owner cannot leave the workspace. |
| Someone else’s comment | report_comment_forbidden | You do not have permission to change this comment. |
| Quick report with too many parameters | report_preset_temporary_limit_exceeded | Select at most 20 parameters for a quick report. |
| Temporary report edited from Setup | report_preset_temporary_update_forbidden | Save this quick report before editing it from Setup. |
| Not signed in, or no valid API key | authentication_required | Sign in to continue. |
| Account awaiting admission | admission_required | Your account does not have access yet. Use an invitation or access code to continue. |
| Onboarding not finished | onboarding_required | Complete your profile in the web app to continue. |
workspace_suspended carries details.reasons: admin, balance, or both. The
API errors section lists the error categories these codes are sent with.