Provider-specific roles

Some roles are bound to specific providers. This page lists all predefined provider-specific roles and their permissions.

If the provider feature role-based access control is active, provider-specific roles can be managed in Control Center. Predefined provider-specific roles remain predefined, but their Requires 2FA setting can be enabled or disabled.

Basic Reporter

This role contains the basic permissions to access most reports.

- access_reports

Extended Reporter

This role contains the basic and extended permissions to access most simple reports as well as reports that operate on a provider level.

- access_reports
- access_provider_based_reports

Personal Data Reporter

This role can export all users of the provider.

- export_all_users

BusinessIntelligence Visualization Admin

This role can access and administer the provider’s BI visualization.

- administrate_superset

BusinessIntelligence Visualization Editor

This role can access and edit the provider’s BI visualization.

- update_superset

BusinessIntelligence Visualization Viewer

This role can access and view the provider’s BI visualization.

- view_superset

Financial Manager

This role can manage the provider’s payment service credentials and access financial data. It can also create, update, and manage booking transactions.

- manage_stripe_accounts
- manage_logpay_credentials
- read_receipts
- read_purchases
- create_purchases
- update_purchases
- manage_purchases
- read_charges

Financial Observer

This role can access financial data and manage booking transactions, but it cannot manage payment service credentials.

- read_receipts
- read_purchases
- create_purchases
- update_purchases
- manage_purchases
- read_charges

ioki Navigator Admin

This role can access and administer the provider’s ioki Navigator.

- manage_leitstelle_provider

ioki Navigator Sales Admin

This role can access the provider’s ioki Navigator and view most of its data.

- access_leitstelle

ioki Navigator User

This role can access the provider’s ioki Navigator and view most of its data.

- access_leitstelle

Personal Discounts Manager

This role is intended for administrators who manage personal discount types, personal discounts, and promo codes for a provider. It grants full create, read, update, and delete access for these records.

- read_personal_discount_types
- create_personal_discount_types
- update_personal_discount_types
- delete_personal_discount_types
- read_personal_discounts
- create_personal_discounts
- update_personal_discounts
- delete_personal_discounts
- read_promo_codes
- create_promo_codes
- update_promo_codes
- delete_promo_codes

Personal Discounts Viewer

This role is intended for admins who need read-only access to the personal discount types, personal discounts, and promo code records of a provider.

- read_personal_discount_types
- read_personal_discounts
- read_promo_codes

Provider Admin

This role is used to administer the provider as the top-level tenant on ioki Platform. It can manage access control, users, operators, products, reports, purchases, and ioki Workflow access.

- administrate_access_control_management
- export_all_users
- create_users
- read_users
- update_users
- lock_users
- delete_users
- manage_eligibility_groups
- manage_eligibility_group_memberships
- manage_user_segments
- read_receipts
- manage_operators
- manage_products
- read_personal_discount_types
- read_personal_discounts
- read_promo_codes
- read_purchases
- create_purchases
- update_purchases
- manage_purchases
- read_charges
- access_ioki_workflow
- access_reports
- access_provider_based_reports

Provider KAM

This role can access and edit most of a provider’s top-level settings. It is usually intended for ioki staff rather than provider administrators.

- administrate_access_control_management
- update_provider
- export_all_users
- create_users
- read_users
- update_users
- lock_users
- delete_users
- manage_user_segments
- manage_stripe_accounts
- manage_logpay_credentials
- manage_eosuptrade_credentials
- manage_firebase_credentials
- manage_webhooks
- read_webhook_events
- update_webhook_events
- read_receipts
- manage_operators
- manage_products
- create_hardware_integrations
- read_hardware_integrations
- update_hardware_integrations
- delete_hardware_integrations
- read_personal_discount_types
- create_personal_discount_types
- update_personal_discount_types
- delete_personal_discount_types
- read_personal_discounts
- create_personal_discounts
- update_personal_discounts
- delete_personal_discounts
- read_promo_codes
- create_promo_codes
- update_promo_codes
- delete_promo_codes
- create_email_deliveries
- read_purchases
- create_purchases
- update_purchases
- manage_purchases
- read_charges
- access_ioki_workflow
- access_reports
- access_provider_based_reports

Third Party SMS Verification

This role can send and verify third-party verification SMS.

- send_third_party_verification_sms

Workflow Admin

This role bundles permissions used only to administer ioki Workflow.

- access_ioki_workflow

User Manager

This role allows to manage users of the provider, including their purchases. This role is necessary if you would like to create users from ioki Booking.

- create_users
- read_users
- update_users
- lock_users
- delete_users
- read_purchases
- create_purchases
- update_purchases
- manage_purchases
- read_charges