Permissions and roles

This page lists every ReputeCast permission key a role, API key or MCP agent can hold, grouped as in the role editor under Settings › , then Roles.

Every API operation names the permission it needs, and members, API keys and MCP agents go through the same check. Sensitive permissions are marked ⚑ in the app and trigger the two-factor policy: when the instance requires two-factor authentication for sensitive permissions, every member whose role holds one must use it. Includes lists the permissions that come with a key automatically.

Campaigns

Key	Description	Sensitive	Who can hold it	Includes
campaigns:view	See campaigns, their content, audience and status.	No	People, API keys and AI agents	—
campaigns:edit	Create and edit drafts, request approval.	No	People, API keys and AI agents	campaigns:view
campaigns:send	Start or schedule a send, and resume a paused one.	Yes	People, API keys and AI agents	campaigns:view
campaigns:pause	Stop a send that is running. Resuming needs campaigns:send.	No	People, API keys and AI agents	campaigns:view
campaigns:approve	Approve, reject or request changes on sends that need approval.	Yes	People, API keys and AI agents	campaigns:view

Templates

Key	Description	Sensitive	Who can hold it	Includes
templates:view	See saved templates and sections.	No	People, API keys and AI agents	—
templates:edit	Create, edit and delete templates and saved sections.	No	People, API keys and AI agents	templates:view

Transactional

Key	Description	Sensitive	Who can hold it	Includes
transactional:view	See transactional templates, the message log and its numbers. Never message content.	No	People, API keys and AI agents	—
transactional:edit	Create and edit template drafts, import templates.	No	People, API keys and AI agents	transactional:view
transactional:publish	Make a draft the live version, or roll back to an earlier one.	Yes	People, API keys and AI agents	transactional:view
transactional:send	Send transactional messages from your product. Send-only keys hold this alone.	Yes	People, API keys and AI agents	—
transactional:content	Open the rendered content of a sent message. Every view is logged.	Yes	People, API keys and AI agents	transactional:view

Automations

Key	Description	Sensitive	Who can hold it	Includes
automations:view	See flows and their live stats.	No	People, API keys and AI agents	—
automations:edit	Change drafts of flows.	No	People, API keys and AI agents	automations:view
automations:publish	Publish, pause and resume flows.	Yes	People, API keys and AI agents	automations:view

Contacts

Key	Description	Sensitive	Who can hold it	Includes
subscribers:view	See contacts, profiles and activity.	No	People, API keys and AI agents	—
subscribers:create	Add contacts through signup forms and the API.	No	People, API keys and AI agents	subscribers:view
subscribers:edit	Change fields, tags and list membership.	No	People, API keys and AI agents	subscribers:view
subscribers:import	Run the importer. Consent is always kept.	No	People, API keys and AI agents	subscribers:view
subscribers:export	Download contacts. Every export is logged.	Yes	People, API keys and AI agents	subscribers:view
subscribers:delete	Permanently erase a contact's personal data.	Yes	People, API keys and AI agents	subscribers:view
subscribers:verify	Send contacts' addresses to a verification service. It spends credits; every use is logged.	Yes	People and API keys, not AI agents	subscribers:view

Lists and segments

Key	Description	Sensitive	Who can hold it	Includes
lists:manage	Create, rename and delete lists.	No	People, API keys and AI agents	subscribers:view
segments:edit	Build segments with the condition builder.	No	People, API keys and AI agents	subscribers:view
segments:sql	Write read-only SQL against a contacts view.	Yes	People, API keys and AI agents	segments:edit, subscribers:view

Forms and pages

Key	Description	Sensitive	Who can hold it	Includes
forms:edit	Change signup forms, the preference center and the archive.	No	People, API keys and AI agents	—

Reports

Key	Description	Sensitive	Who can hold it	Includes
reports:view	See campaign and automation reports.	No	People, API keys and AI agents	—
reports:share	Share a report with people outside the workspace.	No	People, API keys and AI agents	reports:view

Deliverability

Key	Description	Sensitive	Who can hold it	Includes
deliverability:view	See domain, IP and provider health.	No	People, API keys and AI agents	—
integrations:hostrepute	Connect, reconnect or disconnect HostRepute.	No	People, API keys and AI agents	deliverability:view

Sending

Key	Description	Sensitive	Who can hold it	Includes
providers:view	See provider status and routing. Never credentials.	No	People, API keys and AI agents	—
providers:manage	Connect providers, replace credentials, change routing.	Yes	People, API keys and AI agents	providers:view
domains:manage	Add sending domains and sender identities.	Yes	People, API keys and AI agents	providers:view

Team

Key	Description	Sensitive	Who can hold it	Includes
team:view	See members, roles and invitations.	No	People, API keys and AI agents	—
team:invite	Invite people with roles you hold.	No	People, API keys and AI agents	team:view
team:manage	Change roles, deactivate and remove members.	Yes	People, API keys and AI agents	team:view, team:invite

Developer

Key	Description	Sensitive	Who can hold it	Includes
apikeys:manage	Create, rotate and revoke API keys.	Yes	People, API keys and AI agents	—
webhooks:manage	Add webhook endpoints and see delivery logs.	No	People, API keys and AI agents	—
mcp:manage	Create and revoke AI agents and see their actions.	Yes	People, API keys and AI agents	—

Integrations

Key	Description	Sensitive	Who can hold it	Includes
integrations:view	See the integrations hub, each integration's health, activity and managed webhooks.	No	People, API keys and AI agents	—
integrations:manage	Creates, changes and revokes the integrations' keys and webhooks.	Yes	People only	integrations:view

AI

Key	Description	Sensitive	Who can hold it	Includes
ai:use	Use the AI assistant: subject ideas, rewrites, translations and alt text with the workspace's own model.	No	People only	—

Audience scoring

Key	Description	Sensitive	Who can hold it	Includes
scoring:edit	Change how contacts are scored.	No	People, API keys and AI agents	subscribers:view

Placement tests

Key	Description	Sensitive	Who can hold it	Includes
placement:run	Send copies through the workspace's providers to its own seed mailboxes.	No	People and API keys, not AI agents	deliverability:view
placement:manage	Add, reconnect and remove seed mailboxes. Their passwords and tokens can read whole mailboxes.	Yes	People and API keys, not AI agents	deliverability:view

Grow

Key	Description	Sensitive	Who can hold it	Includes
grow:view	See referrals, referrers, rewards and recommendations.	No	People, API keys and AI agents	—
grow:edit	Change the program, its milestones and rewards, and the newsletters you recommend.	No	People, API keys and AI agents	grow:view
grow:review	Decide on held referrals and handle rewards.	No	People, API keys and AI agents	grow:view
grow:connect	Exchange signed subscribe links with other ReputeCast instances.	Yes	People, API keys and AI agents	grow:view

Earn

Key	Description	Sensitive	Who can hold it	Includes
earn:view	See Earn's numbers, paid members, gifts and sponsor bookings.	No	People, API keys and AI agents	—
earn:edit	Change what readers pay and the upgrade, cancel and gift pages.	Yes	People, API keys and AI agents	earn:view
earn:manage	Grant complimentary access, import paid members, cancel subscriptions and change gifts.	Yes	People, API keys and AI agents	earn:view
payments:manage	Connect Stripe and change its keys and webhook.	Yes	People, API keys and AI agents	earn:view
sponsors:manage	Keep the sponsor library and book sponsors into issues.	No	People, API keys and AI agents	earn:view
conversions:create	Report a conversion with its value. The Conversions key preset holds this alone.	No	People, API keys and AI agents	—

Website and pages

Key	Description	Sensitive	Who can hold it	Includes
website:view	See the website's posts, pages, members and numbers.	No	People, API keys and AI agents	—
website:edit	Write and change drafts of posts and pages.	No	People, API keys and AI agents	website:view
website:publish	Put posts and pages on the website, or take them down.	Yes	People, API keys and AI agents	website:view
website:manage	Change how the website works and who can read what.	Yes	People, API keys and AI agents	website:view

Products and orders

Key	Description	Sensitive	Who can hold it	Includes
products:view	See digital products, their sales and orders.	No	People, API keys and AI agents	—
products:edit	Change products' files, descriptions and drafts.	No	People, API keys and AI agents	products:view
products:publish	Put products on sale, take them off and change what they cost.	Yes	People, API keys and AI agents	products:view
orders:manage	Send new download links and change buyers' access.	No	People, API keys and AI agents	products:view

SMS

Key	Description	Sensitive	Who can hold it	Includes
sms:send	Send or schedule SMS campaigns, and publish automations with SMS steps. Needed with campaigns:send to send text messages.	Yes	People, API keys and AI agents	—

Push

Key	Description	Sensitive	Who can hold it	Includes
push:send	Send or schedule push campaigns, and publish automations with push steps. Needed with campaigns:send to send push notifications.	Yes	People, API keys and AI agents	—

WhatsApp

Key	Description	Sensitive	Who can hold it	Includes
whatsapp:send	Send or schedule WhatsApp campaigns, and publish automations with WhatsApp steps. Needed with campaigns:send to send WhatsApp messages.	Yes	People, API keys and AI agents	—

Audit

Key	Description	Sensitive	Who can hold it	Includes
audit:view	See who did what, when and from where.	No	People, API keys and AI agents	—

Workspace

Key	Description	Sensitive	Who can hold it	Includes
workspace:manage	Name, default sender, timezone and the approval policy.	No	People, API keys and AI agents	—
workspace:transfer	Make another member the Owner.	Yes	Owner only	—
workspace:delete	Delete the workspace and everything in it.	Yes	Owner only	—

Agency (instance)

Key	Description	Sensitive	Who can hold it	Includes
agency:view	See every assigned client's health, next send, approvals waiting and incidents, and search across them.	No	People only	—
agency:usage	Emails, texts, notifications and provider costs per client and month, with what to rebill.	No	People only	—
agency:library	Add, change and remove library items and workspace templates, and copy them into clients.	No	People only	—
agency:manage	Create and delete clients, add and remove staff, and assign them to clients.	Yes	People only	—

Who can hold a permission

The Who can hold it column uses four rules:

• People, API keys and AI agents: any role, API key or MCP agent can hold it.
• People and API keys, not AI agents: MCP agents never hold it, even when their creator does.
• People only: only members hold it, through their role. API keys and MCP agents can’t.
• Owner only: only the built-in Owner role holds it. It can’t be added to a custom role, an API key or an agent, and the Admin role has every other permission.

An API key or MCP agent never does more than the member who created it can do right now. When that member’s role loses a permission, the key loses it too; when the member leaves the workspace, the key loses all its permissions.

The keys in the Agency (instance) group belong to the instance, not to a workspace. Agency staff hold them through the Agency manager and Account manager roles when agency mode is on.

Built-in roles

Built-in roles can’t be edited; duplicate one to make a custom role. Each row below is a permission, each column a built-in role: workspace roles (Owner, Admin, Editor, Viewer), the roles for clients of an agency’s client workspaces, and the instance-level agency roles.

Permission	Owner	Admin	Editor	Viewer	Client approver	Client viewer	Agency manager	Account manager
campaigns:view	✓included	✓included	✓included	✓included	✓included	✓included	—not included	—not included
campaigns:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
campaigns:send	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
campaigns:pause	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
campaigns:approve	✓included	✓included	—not included	—not included	✓included	—not included	—not included	—not included
templates:view	✓included	✓included	✓included	✓included	✓included	✓included	—not included	—not included
templates:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
transactional:view	✓included	✓included	✓included	✓included	—not included	—not included	—not included	—not included
transactional:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
transactional:publish	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
transactional:send	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
transactional:content	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
automations:view	✓included	✓included	✓included	✓included	✓included	✓included	—not included	—not included
automations:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
automations:publish	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
subscribers:view	✓included	✓included	✓included	✓included	✓included	—not included	—not included	—not included
subscribers:create	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
subscribers:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
subscribers:import	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
subscribers:export	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
subscribers:delete	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
subscribers:verify	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
lists:manage	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
segments:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
segments:sql	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
forms:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
reports:view	✓included	✓included	✓included	✓included	✓included	✓included	—not included	—not included
reports:share	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
deliverability:view	✓included	✓included	✓included	✓included	✓included	✓included	—not included	—not included
integrations:hostrepute	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
providers:view	✓included	✓included	✓included	✓included	—not included	—not included	—not included	—not included
providers:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
domains:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
team:view	✓included	✓included	✓included	✓included	—not included	—not included	—not included	—not included
team:invite	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
team:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
apikeys:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
webhooks:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
mcp:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
integrations:view	✓included	✓included	✓included	✓included	—not included	—not included	—not included	—not included
integrations:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
ai:use	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
scoring:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
placement:run	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
placement:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
grow:view	✓included	✓included	✓included	✓included	—not included	—not included	—not included	—not included
grow:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
grow:review	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
grow:connect	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
earn:view	✓included	✓included	✓included	✓included	—not included	—not included	—not included	—not included
earn:edit	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
earn:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
payments:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
sponsors:manage	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
conversions:create	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
website:view	✓included	✓included	✓included	✓included	—not included	—not included	—not included	—not included
website:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
website:publish	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
website:manage	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
products:view	✓included	✓included	✓included	✓included	—not included	—not included	—not included	—not included
products:edit	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
products:publish	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
orders:manage	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
sms:send	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
push:send	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
whatsapp:send	✓included	✓included	✓included	—not included	—not included	—not included	—not included	—not included
audit:view	✓included	✓included	✓included	✓included	—not included	—not included	—not included	—not included
workspace:manage	✓included	✓included	—not included	—not included	—not included	—not included	—not included	—not included
workspace:transfer	✓included	—not included	—not included	—not included	—not included	—not included	—not included	—not included
workspace:delete	✓included	—not included	—not included	—not included	—not included	—not included	—not included	—not included
agency:view	—not included	—not included	—not included	—not included	—not included	—not included	✓included	✓included
agency:usage	—not included	—not included	—not included	—not included	—not included	—not included	✓included	✓included
agency:library	—not included	—not included	—not included	—not included	—not included	—not included	✓included	✓included
agency:manage	—not included	—not included	—not included	—not included	—not included	—not included	✓included	—not included

Related

• Roles and permissions explains custom roles, scopes and requesting access.
• Invite and manage members shows how a member gets a role.
• Authentication and API keys covers the permissions of API keys.
• Connect AI agents with MCP covers what an MCP agent can do.
• Run client workspaces as an agency describes the agency and client roles.