Permission Descriptions for Users and Groups
Understand how each permission affects access for users and groups.
- Edit Processes
While permissions apply to users, those permissions can be assigned from a user account or a group:
- User-level permissions: Permissions can be assigned to a user account. These permission assignments only apply to that user account. From user-level permissions, you can assign Administrator-level permissions or all permissions to a user account. Instead of assigning individual permissions to a user account, the following options are also available:
- Super Admin: Assign the Make this user a Super Admin option to grant unrestricted access to the entire ProcessMaker Platform instance. In doing so, ProcessMaker Platform does not check permissions for user accounts with this setting selected, allowing such users to administer and install packages which might otherwise require permissions be granted to a user account to perform. Users whose account have this setting may do the following:
- View the Tasks as displayed in the Task column of Request summaries by clicking a link to that Task. Users that do not have the Make this user a Super Admin option do not have a hyperlink to Tasks from Request summaries.
- See all comments in a Request and a Task summary.
- Upload file in API - Settings.
- Filter by any user in API - GroupMember.
- Run Script Executor in APIs.
- Link to edit any task in Request Detail.
- Reassign any open or overdue Task.
- All permissions: Assign the Assign all permissions to this user option to assign all permissions to that user account.
- Group-level permissions: Permissions can be assigned to a group. A group assigns the same permissions to all user account members. Using groups makes it easy to manage permissions for multiple user accounts with identical permission assignments. From group-level permissions, you can assign all permissions to a group. See Edit a Group.
User-level and group-level permission assignments are cumulative. This means that a user account has all the group-level permission assignments from all its group memberships, but also has the flexibility of permission assignments that apply only to that user account. For example, a user account might be a member of a group whereby its members can view the list of all Processes. However, an Administrator can assign the permission to edit Processes to only the one user account.
See the following best practices when organizing group members:
Create groups based on how you define user roles in your organization. Based on how you define user roles, assign permissions to groups so that all group members have the same permission set. Below is an example how you might create groups to assign permissions:
- User: Most users start or participate in Requests and perform Tasks. Their permission assignments may be limited to Requests. Note that if you want specific users and/or groups to start and/or cancel Requests, those must be set from the following functional areas and are outside the scope of the permission settings discussed in this topic:
- Process Designer: Process designers create Process models. Their permission assignments may be limited to Decision Tables, Environment Variables, Processes, Process Templates, Requests, Saved Search, Screens, Version History, and Vocabularies categories.
- Developer: Developers often create Scripts. Their permission assignments may be limited to Collections, Data Connectors, Files (API), Notifications (API), Requests, Scripts, Task Assignments (API), and Webhooks categories.
- Administrator: Administrators administer the ProcessMaker Platform environment and its users. Their permission assignments may be limited to Auth Clients, Collections, Comments, Groups, Requests, Translations, and Users categories. Assign specific Administrators in their user accounts the Make this user a Super Admin option.
Organize the role-based groups into larger groups so that permissions overlap amongst group members. Consider the following example.
Suppose that a group named "Process Modelers" with a set of permission categories to design Process models. This group has assigned to it the following permission categories:
A second group named "Process Architects" has a different set of permission categories from which to maintain Process Template consistency across their organization:
Senior managers within the organization that must have all these sets of permission categories. Instead of a third group that contains all five sets of permission categories, create a third group called "Senior Managers" that includes the "Process Modelers" and "Process Architect" groups. The "Senior Managers" group inherits the permission categories of the groups within it.
Permissions are organized into categories. Permissions are described below by category and how each permission affects ProcessMaker Platform functionality. These permissions function identically in user accounts and groups.
The Analytic Reporting package must be installed for the Analytics category of permissions to display.
The Analytics Reporting category contains the following permissions:
- Create Analytics: Create an Analytic Report from the Analytics page. Selecting this permission also selects the Edit Analytics permission. See Create an Analytic Report.
Select the View Analytics permission to use any of the other permissions in this category.
The Auth Clients category contains the following permissions:
- Create Auth Clients: Create a client authentication key on the Auth Clients page. Selecting this permission also selects the Edit Auth Clients permission. See Create a New Client Authentication Key.
- Delete Auth Clients: Delete a client authentication key from the Auth Clients page. See Delete a Client Authentication Key.
- Edit Auth Clients: Edit a client authentication key from the Auth Clients page. See Edit a Client Authentication Key.
- View Auth Clients: View all client authentication keys on the Auth Clients page. See View All Client Authentication Keys.
Select the View Auth Clients permission to use any of the other permissions in this category.
The Collections category contains the following permissions:
- Create Collections: Create a Collection from the Collections page. Selecting this permission also selects the Edit Collections permission. See Create a New Collection.
- Truncate Collections: Delete all records in a Collection using the
TruncateCollectionData Connector Resource for that Collection. See Resources for Collections.
Select the View Collections permission to use any of the other permissions in this category.
- Create Comments: Post or reply to a Request or a Task comment. Selecting this permission also selects the Edit Comments permission. See the following sections:
- Delete Comments: Delete one of your Request or Task comments. You may only delete comments that you created. See the following sections:
- Edit Comments: Edit one your Request or Task comments. You may only edit comments that you created. See the following sections:
- View Comments: View Request or Task comments posted in the Request/Task summary. See the following sections:
Select the View Comments permission to use any of the other permissions in this category.
The Data Connectors package must be installed for the Data Connectors category of permissions to display.
The Data Connectors category contains the following permissions:
- Create Data Connector Categories: Create a Data Connector Category from the Categories page. Selecting this permission also selects the Edit Data Connector Categories permission. See Create a New Data Connector Category.
- Create Data Connectors: Create a Data Connector from the Data Connectors page. Selecting this permission also selects the Edit Data Connectors permission. See Create a New Data Connector.
- Delete Data Connector Categories: Delete a Data Connector Category from the Categories page. See Delete a Data Connector Category.
- Delete Data Connectors: Delete a Data Connector from the Data Connectors page. See Delete a Data Connector.
- Edit Data Connector Categories: Edit a Data Connector Category from the Categories page. See Edit a Data Connector Category.
- Edit Data Connectors: Edit a Data Connector from the Data Connectors page. See Edit a Data Connector.
- View Data Connector Categories: View the table of Data Connector Categories on the Categories page. See View Data Connector Categories.
- View Data Connectors: View the table of Data Connectors on the Data Connectors page. See View Data Connectors.
Select the View Data Connector Categories permission to use any of the other permissions related to Data Connector Categories.
Select the View Data Connectors permission to use any of the other permissions in the Data Connectors category.
The Decisions Tables package must be installed for the Decision Tables category of permissions to display.
The Decision Tables category contains the following permissions:
- Create Decision Table Categories: Create a Decision Table Category from the Categories page. Selecting this permission also selects the Edit Decision Table Categories permission. See View Decision Table Categories.
- Create Decision Tables: Create a Decision Table from the Decision Tables page. Selecting this permission also selects the Edit Decision Tables permission. See Create a New Decision Table.
- Delete Decision Table Categories: Delete a Decision Table Category from the Categories page. See Delete a Decision Table Category.
- Delete Decision Tables: Delete a Decision Table from the Decision Tables page. See Delete a Decision Table.
- Edit Decision Table Categories: Edit a Decision Table Category from the Categories page. See Edit a Decision Table Category.
- Edit Decision Tables: Edit a Decision Table from the Decision Tables page. See Edit a Decision Table.
- View Decision Table Categories: View the table of Decision Table Categories on the Categories page. See View Decision Table Categories.
- View Decision Tables: View the table of Decision Tables on the Decision Tables page. See View Decision Tables.
Select the View Decision Tables Categories permission to use any of the other permissions related to Decision Table Categories.
Select the View Decision Tables permission to use any of the other permissions in the Decision Tables category.
The Environment Variables category contains the following permissions:
- Create Environment Variables: Create an Environment Variable from the Environment Variables page. Selecting this permission also selects the Edit Environment Variables permission. See Create a New Environment Variable.
- Delete Environment Variables: Delete an Environment Variable from the Environment Variables page. See Delete an Environment Variable.
- Edit Environment Variables: Edit an Environment Variable from the Environment Variables page. See Edit an Environmental Variable.
- View Environment Variables: View the table of Environment Variables on the Environment Variables page. See View All Environment Variables.
Select the View Environment Variables permission to use any of the other permissions in this category.
The Files (API) category contains the following permissions:
- Create Files: Saves a new file specified in an API request. Selecting this permission also selects the Edit Files permission. See "Files > Post" endpoint in the ProcessMaker Platform RESTful API.
- Delete Files: Deletes a specified file in an API request. See "Files > Delete" endpoint in the ProcessMaker Platform RESTful API.
- Edit Files: Update a file specified in an API request. See "Files > Update" endpoint in the ProcessMaker Platform RESTful API.
- View Files: Returns the list of files associated to an API request. See "Files > Get" endpoint in the ProcessMaker Platform RESTful API.
For more information about the ProcessMaker Platform RESTful API, see Access ProcessMaker Platform RESTful API Documentation.
The Groups category contains the following permissions:
- Create Groups: View a group from the Groups page. Selecting this permission also selects the Edit Groups permission. See Create a New Group.
- View Groups: View groups from the following locations:
Select the View Groups permission to use any of the other permissions in this category.
The Notifications (API) category contains the following permissions:
- Create Notifications: Save a new notification through an API request. Selecting this permission also selects the Edit Notifications permission. See "Notifications > Post" endpoint in the ProcessMaker Platform RESTful API.
- Delete Notifications: Deletes a specified notification through an API request. See "Notifications > Delete" endpoint in the ProcessMaker Platform RESTful API.
- Edit Notifications: Updates a notification through an API request. See "Notifications > Update" endpoint in the ProcessMaker Platform RESTful API.
- View Notifications: Returns all notifications to which the user has access. See "Notifications > Get" endpoint in the ProcessMaker Platform RESTful API.
For more information about the ProcessMaker Platform RESTful API, see Access ProcessMaker Platform API Documentation.
The PM Blocks category contains the following permissions:
- Create PM Block Categories: Create a PM Block Category from the Categories page. Selecting this permission also selects the Edit PM Block Categories permission. See Create a New PM Block Category.
- Create PM Blocks: Create a PM Block from the PM Blocks page. Selecting this permission also selects the Edit PM Blocks permission. See Create a New PM Block.
- Delete PM Block Categories: Delete a PM Block Category from the Categories page. See Delete a PM Block Category.
- Edit PM Block Categories: Edit a PM Block Category from the Categories page. See Edit a PM Block Category.
- Edit PM Blocks: Edit a PM Block and/or its configuration from the PM Blocks page. See Edit a PM Block and Configure a PM Block.
- View PM Block Categories: View the table of PM Block Categories on the Categories page. See View PM Block Categories.
Select the View PM Block Categories permission to use any of the other permissions related to PM Block Categories.
Select the View PM Blocks permission to use any of the other permissions in the PM Blocks category.
The Process Templates category contains the following permissions:
- Create Process Templates: Create a Process Template from an existing Process. See Create a Template from a Process.
- Edit Process Templates: Edit a Process Template and/or its configuration from the Templates page. See Edit a Process Template and Configure a Process Template.
- Export Process Templates: Export a Process Template from the Templates page. See Export a Process Template.
- Import Process Templates: Import a Process Template from the Templates page. See Import a Process Template.
- View Process Templates: View a list of Process Templates on the Templates page. See View Process Templates.
Select the View Process Templates permission to use any of the other permissions in the Process Templates category.
The Process Translations category contains the following permissions:
- Cancel Process Translations: Cancel a Screen translation that has started. See Translate Screens for a Process.
- Create Process Translations: Translate Screens for a Process to a selected natural language. See Translate Screens for a Process.
- Delete Process Translations: Delete a selected language translation of a Process's Screens. See Delete Language Translations for Screens Used in a Process.
- Edit Process Translations: Edit the Screens for a selected language translation. See Edit Screen Translations for a Process.
- Export Process Translations: Export the translated Screens for a selected language. See Export Language Translations for Screens Used in a Process.
- Import Process Translations: Import the translated Screens to a Process. See Import Language Translations for Screens Used in a Process.
- View Process Translations: View the Screen translations for a selected Process. See View Screen Translations for a Process.
The Processes category contains the following permissions:
- Create Process Categories: Create a Process Category from the Categories page. Selecting this permission also selects the Edit Process Categories permission. See Create a New Process Category.
- Create Processes: Create a Process from the Processes page. Selecting this permission also selects the Edit Processes permission. See Create a New Process.
- Delete Process Categories: Delete a Process Category from the Categories page. See Delete a Process Category.
- Edit Process Categories: Edit a Process Category from the Categories page. See Edit a Process Category.
- Edit Processes: Edit a Process model and/or its configuration from the Processes page. See Edit the Process Model Information and Edit Process Configuration.
- View Process Categories: View the table of Process Categories on the Categories page. See View Process Categories.
Select the View Process Categories permission to use any of the other permissions related to Process Categories.
Select the View Processes permission to use any of the other permissions in the Processes category.
The Requests category contains the following permissions:
- Edit Request Data: View the Data tab for a completed Request and edit the completed Request data that is in JSON format. See Editable Request Data.
- Edit Task Data: View the Data tab for an assigned Task and edit the Task data that is in JSON format. See Editable Task Data.
- View All Requests: View the All Requests page and Request information accessible from that page. See View All Requests.
The Saved Search category contains the following permission:
- Toggle Notifications: Receive Saved Search notifications for your own Saved Searches. Notifications must already be enabled for your own Saved Searches. See Enable Notification of Saved Search Result Changes.
The Screens category contains the following permissions:
- Create Screen Categories: Create a Screen Category from the Categories page. Selecting this permission also selects the Edit Screen Categories permission. See Create a New Screen Category.
- Create Screens: Create a Screen from the Screens page. Selecting this permission also selects the Edit Screens permission. See Create a New Screen.
- Delete Screen Categories: Delete a Screen Category from the Categories page. See Delete a Screen Category.
- Edit Screen Categories: Edit a Screen Category from the Categories page. See Edit a Screen Category.
- Edit Screens: Edit a Screen and/or its configuration from the Screens page. See Edit a Screen and Edit Screen Configuration.
- View Screen Categories: View the table of Screen Categories on the Categories page. See View Screen Categories.
Select the View Screen Categories permission to use any of the other permissions related to Screen Categories.
Select the View Screens permission to use any of the other permissions in the Screens category.
The Scripts category contains the following permissions:
- Create Script Categories: Create a Script Category from the Categories page. Selecting this permission also selects the Edit Script Categories permission. See Create a New Script Category.
- Create Scripts: Create a Script from the Scripts page. Selecting this permission also selects the Edit Scripts permission. See Create a New Script.
- Delete Script Categories: Delete a Script Category from the Categories page. See Delete a Script Category.
- Edit Script Categories: Edit a Script Category from the Categories page. See Edit a Script Category.
- Edit Scripts: Edit a Script and/or its configuration from the Scripts page. See Edit a Script and Edit Script Configuration.
- View Script Categories: View the table of Script Categories on the Categories page. See View Script Categories.
Select the View Script Categories permission to use any of the other permissions related to Script Categories.
Select the View Scripts permission to use any of the other permissions in the Scripts category.
The Security Logs category contains the following permission:
- Create Security Logs (API): Creates a security log entry for a specified user via an API request. See "Security Logs > Post" endpoint in the ProcessMaker Platform RESTful API.
- View Security Logs: View security logs for a user from the Users page. See View Security Logs for a User.
The Settings category contains the following permissions:
Select the View Settings permission to use any of the other permissions in this category.
The Signals category contains the following permissions:
- Create Signals: Create a new Signal in the Signals Manager. Selecting this permission also selects the Edit Signals permission. See Create a new Signal.
Select the View Signals permission to use any of the other permissions in this category.
The Task Assignments (API) category contains the following permissions:
- Create Task Assignments: Saves a new task assignment to a specified user in an API request. Selecting this permission also selects the Edit Task Assignments permission. See "Task Assignments > Post" endpoint in the ProcessMaker Platform RESTful API.
- Delete Task Assignments: Deletes a specified task assignment through an API request.
- Edit Task Assignments: Updates a task assignment through an API request. See "Task Assignments > Update" endpoint in the ProcessMaker Platform RESTful API.
- View Task Assignments: Returns all assignments assigned to the user.
For more information about the ProcessMaker Platform RESTful API, see Access ProcessMaker Platform RESTful API Documentation.
The Translations category contains the following permissions:
- Edit Translations: Edit a text label or message from the Translations page. See Edit Text that Displays in the User Interface.
- Reset Translations: Reset all text labels and messages to default on the Translations page. See Reset All User Interface Labels and Messages to Their Defaults.
- View Translations: View the table of text labels and messages on the Translations page. See View English-Language Labels and Messages from the User Interface.
Select the View Translations permission to use any of the other permissions in this category.
The Users category contains the following permissions:
- Create Users: Create a user account from the Users page. Selecting this permission also selects the Edit Users permission. See Create a New User Account.
- View Other Users Profiles: View another user's profile. If a user is not granted this new permission, then that user receives an Error 404 (not found) page when clicking on another user's avatar or manually adjusting the URL to view another user's profile page. See View Another User's Profile Information.
- View Users: View users from the following locations:
Select the View Users permission to use any of the other permissions in this category.
The Versioning package must be installed for the Version History category of permissions to display.
- Edit Version History: Edit versions within the version history for a ProcessMaker Platform asset.
- View Version History: View the version history for a ProcessMaker Platform asset.
Select the View Version History permission to use any of the other permissions in this category.
The Vocabularies category contains the following permissions:
- Create Vocabularies: Create a Vocabulary from the Vocabularies page. Selecting this permission also selects the Edit Vocabularies permission. See Create a New Vocabulary.
- View Vocabularies: View the table of Vocabularies on the Vocabularies page. See View All Vocabularies.
Select the View Vocabularies permission to use any of the other permissions in this category.
The Webhooks category contains the following permissions:
- Disable Webhooks: Disable a Signal's webhook from the Signals Manager. See Configure a Signal's Webhook Access.
- Enable Webhooks: Enable a Signal's webhook from the Signals Manager. See Configure a Signal's Webhook Access.
- Read Webhooks: View the configuration of a Signal's webhook from the Signals Manager. See Configure a Signal's Webhook Access.
- Update Webhooks: Edit the configuration of a Signal's webhook from the Signals Manager. See Configure a Signal's Webhook Access.
Last modified 9h ago