Roles and permissions

Everyone in an organization has one role, and the role decides what they can do there. The same rules apply in the web app, in the tn command line and in the API.

The three roles

Role	Shown in the app as	Who it is for
Owner	Gestor	The people who run the organization: they manage the team, credentials and integrations, and can do everything an editor can.
Editor	Editor	The people who set up the work: catalogs, forms and projects.
Field	Coletor	The people who collect data in the field.

The web app uses the names in the second column. The command line and the API use the names in the first: owner, editor and field.

What each role can do

	Owner	Editor	Field
See projects and the list of members	Yes	Yes	Yes
Create and archive projects	Yes	Yes	No
Edit a project	See below	See below	See below
Collect in the field with the app	Yes	Yes	Yes
Catalogs and data sources: view, upload, change	Yes	Yes	No
Forms and form templates: view	Yes	Yes	Yes
Forms and form templates: create and change	Yes	Yes	No
Integrations	Yes	No	No
Invite people, change roles, remove members	Yes	No	No
API keys and registered devices	Yes	No	No
Organization settings	Yes	No	No

Public catalogs are a Terranode-only capability

Terranode's own organization can publish one of its catalogs as public, making it available for every other organization to browse and build project layers from — read-only, and without needing to import or own the data themselves. See Getting started for what that looks like day to day.

No organization other than Terranode's own can publish a public catalog today, whatever role a member holds there — owner and editor included.

Members of Terranode's own organization, whatever their role, also see a performance panel on a project's map page. It measures how the map loads raster layers and is meant for the Terranode team only.

Editing a project takes two things

Editing a project needs both of these:

1. A role that allows editing projects. All three roles do.
2. A part in that particular project. You created it, or you were assigned as one of its managers.

Being an owner or an editor is not enough on its own. Another owner's project stays theirs to edit unless you were made one of its managers. The exception is a project that has no recorded creator, which any owner can edit.

A field member who manages a project can edit it. They still cannot create or archive projects: managing one project does not make someone a project creator.

The person or API key that creates a project is its first manager and cannot be removed from that role.

API keys have a role too

When an owner creates an API key, the key gets a role, and it can do what that role can do and nothing more. A key with the editor role, for example, can work with catalogs and forms but cannot create an integration.

See what you can do

tn auth whoami shows who you are, which organizations you belong to and, for each one, the list of things you are allowed to do there. It is the same list the web app uses to decide which sections to show you.

Changing someone's role

Owners can change a role from the members page in the web app, or with tn orgs members set-role. The change applies at once: the person's next request uses the new role, with no need to sign in again. An organization always keeps at least one active owner, so the last owner cannot be demoted or removed.

See the Glossary for terms like organization and role.