Workspace roles

Every workspace membership has one of five access roles. From least to most access they are View only, Operator, Editor, Admin, and Owner. Each role can do everything the roles before it can.

Role codes

Code	Label	Summary
view_only	View only	Opens dashboards and history reports and reads live values
operator	Operator	Day-to-day plant operation: reads and writes live values on dashboards
editor	Editor	Setup, dashboards, live values, local pull and push, and own workspace API keys
admin	Admin	Editor access plus members, name, branding, limits, stored data, everyone’s workspace API keys
owner	Owner	Admin access plus the workspace’s billing account and workspace deletion

The API, the CLI, and dashboard code use the codes. The app shows the translated label, for example under each workspace name in the workspace switcher.

A workspace has exactly one owner. The person who creates a workspace becomes its owner.

Capabilities

Dashboard code checks the same rules with canWriteSetup, canWriteParameterValues, and canManageWorkspace from @overvis/hmi-shared/workspace.

Action	view_only	operator	editor	admin	owner
List and open the workspace	✓	✓	✓	✓	✓
Open dashboards	✓	✓	✓	✓	✓
Open the history report runtime (/reports/$presetId)	✓	✓	✓	✓	✓
Freeze live values into report snapshots (freezeFromLive)	✓	✓	✓	✓	✓
Read live parameter values	✓	✓	✓	✓	✓
List report comments (report.comment.list)	✓	✓	✓	✓	✓
Open workspace settings	✓	✓	✓	✓	✓
See active alarms and the alarm log	✓	✓	✓	✓	✓
Write live parameter values	✗	✓	✓	✓	✓
Acknowledge and shelve alarms	✗	✓	✓	✓	✓
Create a temporary report (createTemporary)	✗	✓	✓	✓	✓
Create report comments and signatures (report.comment.create)	✗	✓	✓	✓	✓
Delete report comments (report.comment.delete)	✗	✓	✓	✓	✓
Open Setup and activity history	✗	✗	✓	✓	✓
Create, edit, and delete endpoints, parameters, dashboards, and automations	✗	✗	✓	✓	✓
Create, edit, and delete alarm rules	✗	✗	✓	✓	✓
Enable and disable Setup entities	✗	✗	✓	✓	✓
List, create, and edit report presets in Setup → Reports	✗	✗	✓	✓	✓
Promote a temporary report (saveTemporary)	✗	✗	✓	✓	✓
Pull, push, and revoke their own workspace API keys	✗	✗	✓	✓	✓
Invite and remove members, change member roles	✗	✗	✗	✓	✓
See and revoke everyone’s workspace API keys	✗	✗	✗	✓	✓
Rename the workspace, change its logo and favicon, automation and SMS limits	✗	✗	✗	✓	✓
Change stored-data retention, delete stored data	✗	✗	✗	✓	✓
See the workspace’s billing account	✗	✗	✗	✓	✓
Change the billing account, delete the workspace	✗	✗	✗	✗	✓
Leave the workspace	✓	✓	✓	✓	✗
Create a workspace (account action)	✓	✓	✓	✓	✓

Notes on the table:

• History report runtime: every member, including View only, can open the runtime report page. Viewers and operators have no workspace Reports list. They open a report from a dashboard or a direct link.
• Freeze live values: report.preset.freezeFromLive is a read, not Setup authoring.
• Temporary report: a temporary report is a Quick report that a dashboard offers. It is missing from Setup → Reports and from pull until an editor, admin, or owner saves it with saveTemporary. report.preset.get by UUID still returns it.
• Delete report comments: editors, admins, and owners can delete any comment, signatures included. Operators can delete only their own non-signature kind:user comments created strictly after the latest signature on that preset.
• Setup and activity history: viewers and operators see no Setup menu. Every Setup URL, Activity history included, takes them back to the dashboards. The API procedures that read setup stay open to every member, because dashboards use them.
• Workspace API keys: the keys local workspaces use, listed on the CLI keys tab of Workspace settings.
• Create a workspace: creating a workspace does not depend on a role in another workspace. Any admitted, onboarded account can create one from the workspace switcher and becomes its owner.

Membership rules

• Admins and the owner invite people by email as View only, Operator, Editor, or Admin.
• Admins and the owner can change the role of any other member, including making them an admin, and can remove any other member.
• Nobody can change the owner’s role or remove the owner.
• Every member except the owner can leave the workspace. The owner cannot leave a workspace they own. An owner can delete their last workspace and later create a new one from the empty account state.

Assistant and API keys

The AI assistant acts with the signed-in user’s workspace role and cannot do anything that role does not allow. A personal API key acts with the key owner’s role in each workspace. A workspace API key acts with the key owner’s role in its one workspace. What each kind of key reaches is under API authentication, and the API’s role table under API permissions.

Access errors

The app shows these messages in the selected UI language. The API sends the code as the error message.

Situation	Code	Message (English)
No membership	workspace_no_access	You do not have access to this workspace.
Workspace suspended	workspace_suspended	This workspace is suspended. Open it to see why.
Non-owner on an owner action	workspace_not_owner	Only the workspace owner can do that.
Non-admin on an admin action	workspace_not_admin	Only a workspace admin or owner can do that.
Non-editor changing or syncing the setup	workspace_not_editor	Only a workspace editor, admin, or owner can do that.
View only member writing values	workspace_not_operator	Only a workspace operator, editor, admin, or owner can do that.
Workspace API key used outside its workspace	workspace_api_key_scope	This API key is limited to one workspace and cannot be used for this action.
Owner leaving their workspace	workspace_owner_cannot_leave	The workspace owner cannot leave the workspace.
Someone else’s comment	report_comment_forbidden	You do not have permission to change this comment.
Quick report with too many parameters	report_preset_temporary_limit_exceeded	Select at most 20 parameters for a quick report.
Temporary report edited from Setup	report_preset_temporary_update_forbidden	Save this quick report before editing it from Setup.
Not signed in, or no valid API key	authentication_required	Sign in to continue.
Account awaiting admission	admission_required	Your account does not have access yet. Use an invitation or access code to continue.
Onboarding not finished	onboarding_required	Complete your profile in the web app to continue.

workspace_suspended carries details.reasons: admin, balance, or both. The API errors section lists the error categories these codes are sent with.