Permissions Reference by Layer and Access Level
Every BackOps permission in each layer (organization, department, location, event, collaborator, area), its access level, and which ones need Event Pass.
This page lists the permissions BackOps grants in each layer, as the product has them today. A layer (also called a scope) is the place a permission applies: an organization, one department, one location, one event, one collaborator on an event, or one area of an event. For how the layers fit together, read how permissions work.
Each table shows the label you see in the app, the permission string the API uses, and the level the permission matrix places it at (View, Edit or Admin). "Not in the matrix" means the app does not offer the permission in the matrix; it can still be granted through the API.
This page lists what each permission is called and where it applies. It does not map every screen or API operation to the permission it checks. That per-operation matrix will be published after the upcoming permissions overhaul.
Admin and basic access
Every layer has an admin permission, written with * as its action (for example Event.*). It covers every permission in that layer, so a person with it needs nothing else there. An event admin also holds every collaborator and area permission on that event.
Organizations and events also have basic access. Every member of an organization holds Organization basic access, and it cannot be removed. Event basic access is the minimum needed to take part in an event, and it is what an organization admin gets when they join an event as a guest.
Organization
| Permission | String | Level |
|---|---|---|
| Organization admin | Organization.* | Admin (covers everything) |
| Organization Basic Access | Organization.BasicAccess | Always held by members |
| View departments | Organization.Departments.Read | View |
| View locations | Organization.Locations.Read | View |
| Collaborator Database Read | Organization.CollaboratorDatabase.Read | View |
| Crew Database Read | Organization.CrewDatabase.Read | View |
| Add departments | Organization.Departments.Add | Edit |
| Add locations | Organization.Locations.Add | Edit |
| Add activities | Organization.Activities.Add | Edit |
| Edit files | Organization.Files.Edit | Edit |
| Collaborator Database Edit | Organization.CollaboratorDatabase.Edit | Edit |
| Crew Database Edit | Organization.CrewDatabase.Edit | Edit |
| Files admin | Organization.Files.Admin | Admin |
| Project Management Admin | Organization.ProjectManagement.* | Admin |
| Manage notification receivers | Organization.Notifications.ManageReceivers | Admin |
| Resource Type Database Read | Organization.ResourceTypeDatabase.Read | Not in the matrix |
| Resource Type Database Edit | Organization.ResourceTypeDatabase.Edit | Not in the matrix |
| Resource Inventory Read | Organization.ResourceInventory.Read | Not in the matrix |
| Resource Inventory Edit | Organization.ResourceInventory.Edit | Not in the matrix |
| Advance Database Read | Organization.AdvanceDatabase.Read | Not in the matrix |
| Advance Database Edit | Organization.AdvanceDatabase.Edit | Not in the matrix |
Only an organization admin creates, lists and revokes the organization's API keys, and a person cannot change their own organization permissions.
Departments and locations
Each department and each location has its own permissions, granted per department or per location by an organization admin. The two layers have the same set:
| Permission | Department string | Location string |
|---|---|---|
| Admin | Department.* | Location.* |
| Read | Department.Read | Location.Read |
| Settings | Department.Settings | Location.Settings |
| Delete | Department.Delete | Location.Delete |
| Add activities | Department.Activities.Add | Location.Activities.Add |
| Edit files | Department.Files.Edit | Location.Files.Edit |
| Files admin | Department.Files.Admin | Location.Files.Admin |
Event
Every event permission except basic access needs Event Pass working access. A BackOps Pro seat provides it on every event in the organization.
| Permission | String | Level |
|---|---|---|
| Event admin | Event.* | Admin (covers everything) |
| Basic access | Event.BasicAccess | Always held by event users |
| Read | Event.Read | View |
| View collaborators | Event.Collaborators.Read | View |
| View areas | Event.Areas.Read | View |
| Read Communications | Event.Communications.Read | View |
| Add collaborators | Event.Collaborators.Add | Edit |
| Add areas | Event.Areas.Add | Edit |
| Add activities | Event.Activities.Add | Edit |
| Edit files | Event.Files.Edit | Edit |
| Edit documents | Event.Documents.Edit | Edit |
| Contribute to Communications | Event.Communications.Contribute | Edit |
| Settings | Event.Settings | Admin |
| Archive | Event.Archive | Admin |
| Files admin | Event.Files.Admin | Admin |
| Content Management Admin | Event.ContentManagement.* | Admin |
| Project Management Admin | Event.ProjectManagement.* | Admin |
| Manage notification receivers | Event.Notifications.ManageReceivers | Admin |
| View resources | Event.Resources.Read | Not in the matrix |
| Pull resources | Event.Resources.Pull | Not in the matrix |
| Edit resources | Event.Resources.Edit | Not in the matrix |
A person cannot remove their own event admin permission, and cannot remove both their own event admin and Read permissions.
Collaborator
Collaborator permissions apply to one collaborator on one event. The Needs Event Pass column matters for people invited without a license: they can be given only the permissions marked No, and only on their own collaborator.
| Permission | String | Level | Needs Event Pass |
|---|---|---|---|
| Collaborator admin | Collaborator.* | Admin (covers everything) | Yes |
| Read | Collaborator.Read | View | No |
| Manage Crew | Collaborator.Crew.Manage | Edit | No |
| Add activities | Collaborator.Activities.Add | Edit | No |
| Edit advance | Collaborator.Advance.Edit | Edit | No |
| Edit files | Collaborator.Files.Edit | Edit | No |
| Settings | Collaborator.Settings | Admin | Yes |
| Delete | Collaborator.Delete | Admin | Yes |
| Approve advance | Collaborator.Advance.Approve | Admin | Yes |
| Files admin | Collaborator.Files.Admin | Admin | No |
Area
Area permissions apply to one area of one event, and every one of them needs Event Pass. The app has no permission matrix for areas, so area permissions are set through the API only. The Level column shows the level each would sit at by the same convention as the other tables.
| Permission | String | Level |
|---|---|---|
| Area admin | Area.* | Admin (covers everything) |
| Read | Area.Read | View |
| Add activities | Area.Activities.Add | Edit |
| Edit files | Area.Files.Edit | Edit |
| Settings | Area.Settings | Admin |
| Delete | Area.Delete | Admin |
| Files admin | Area.Files.Admin | Admin |
Who can change permissions
| Layer | Who can change a person's permissions |
|---|---|
| Organization | An organization admin, for anyone but themselves |
| Department, location | An organization admin |
| Event | An event admin, or an admin of the organization that owns the event |
| Collaborator | An event admin, or an admin of the organization that owns the event |
| Area | An event admin |
When someone's permissions change, the access token they hold for that place is withdrawn, so they are given a token with the new set the next time BackOps authorizes them there.