Roles
The Roles page manages permission roles that can be assigned to users. Each role contains a set of path-based scopes of the form /<path>:<action>, always with a leading slash (e.g., /scans:view, /config:manage). Users can have multiple roles and their effective permissions are the union of all assigned role scopes. Four built-in roles ship with every installation: admin (/:* — every scope), run-scans (/scans:view, /scans:execute, /health:view, /health/alerting:manage, /admin/alerting:manage, /audit:view — execute scans and view results; no scan configuration, but it can manage alerting: alarm rules, notification channels and policies), configure-scans (/config:*, /scans:*, /health:view, /health/alerting:manage, /admin/alerting:manage — manage scan configuration; no admin functions except alerting: alarm rules, notification channels and policies) and audit (/scans:view, /config:view, /health:view, /admin/alerting:view, /audit:view — read-only access for compliance review). Only the admin role is locked against edits and deletion.
Inputs
| Name | Description | Allowed values | Default |
|---|---|---|---|
Name | Unique name for the role | Non-empty string | — |
Description | Optional description of the role purpose | Any text | Empty |
Scopes | Permissions granted by this role | Space or comma separated /path:action scopes, each with a leading slash (e.g., /scans:view, /config:manage) | Empty |
Fields & columns
| Name | Description |
|---|---|
Name | Editable inline — the role name |
Description | Editable inline — optional description of what this role is for |
Scopes | Editable inline as tags — the /path:action permissions this role grants |
How to
Create a custom role
- Navigate to Admin > Identity > Roles.
- Click Add Role.
- Enter a role name and description.
- Type the scopes to grant, each with its leading slash (e.g., /scans:view /audit:view).
- Click Add Role to create the role.
Gotchas
- Only the built-in admin role is locked: it cannot be modified or deleted. The other three built-ins — run-scans, configure-scans and audit — can be edited or deleted, but every manager start re-creates a missing built-in and resets each built-in's scopes to the shipped defaults. Create a custom role instead of trying to trim one of them.
- Scope format is /<path>:<action> with a leading slash (e.g., /scans:view), where action is "view" (read), "manage" (create/edit/delete), "execute" (special actions such as running a scan) or "*" (every action). A scope written without the leading slash (e.g., scans:view) is rejected with "Invalid scope format" — it is not saved.
- Removing a scope from a role immediately affects all users who have that role assigned.
API calls (4)
| Method | Path | Description |
|---|---|---|
| GET | /api/admin/identity/roles | List all roles with their scopes |
| POST | /api/admin/identity/roles | Create a new custom role |
| PUT | /api/admin/identity/roles/:id | Update role name, description, or scopes |
| DELETE | /api/admin/identity/roles/:id | Delete a custom role |
Related
- Users — Users are assigned roles to control their permissions
- Changes — Role modifications are logged in the audit trail
- OIDC Configuration — Auto-provisioned OIDC users receive a default role