15

Create & assign custom roles

Account Admins can grant team members access to workspaces by assigning them workspace-level roles. If you’re on a Premium or Enterprise plan, you can create roles with custom permission sets. Otherwise, you’ll assign one of our standard roles with predefined permissions.

Overview

Customer.io has two types of workspace-level roles: standard roles and custom roles. Standard roles come with a predefined set of permissions, while custom roles allow you to specify your own set of permissions across content, integrations, and more.

Account Admins can create custom roles in Account Settings > Roles. You can create roles from scratch or start from an existing role. A few things to keep in mind:

• Custom roles must minimally have all view permissions. When you create a role, you’ll see the checkboxes in the Permissions table reflect the minimum permissions needed.
• Permissions accumulate; to grant a permission on the right, you need all the permissions on the left. For instance, to delete campaigns, you must also be able to view, edit, and create them.

Before you finish creating a role, make sure you specify whether people with this role should see sensitive data.

Compare permissions

Customer.io breaks permissions into four categories:

• Messaging & Content: Manage which workflows and content people have access to.
• People, Objects, & Activity: Manage the data in your workspace.
• Integrations, Imports, & Exports: Programmatically manage data, including Collections. Visibility of sensitive data across the workspace is controlled by the feature Hide sensitive attributes.
• Workspace & Message Channel Configuration: Manage workspace settings, integration of message channels, and your subscription center.

Messaging & Content

People, Objects, & Activity

These permissions control whether you can manage people, objects, segments, and ad audiences in the UI of your workspace. They do not control whether you can programmatically manage them through our APIs. See Integrations, Imports, & Exports for more.

To redact people’s data from team members, you must mark profile attribute as sensitive in the Data Index and assign “Hide sensitive attributes” to the custom role. See Hide sensitive attributes to learn more.

Integrations, Imports, & Exports

Permissions for API keys

For complete access to API keys, you need two permissions:

• The account-level permission “Manage API credentials”—gives you the ability to create and delete keys for all of our APIs: Track, App, and Pipelines
• The Edit permission for “Integrations”—gives you the ability to view and copy Pipelines API keys

You assign “Manage API credentials” under Account-level permissions when adding or editing a team member. People will only see keys to the workspaces they have access to.

You need the account-level “Manage API credentials” permission to access and copy Track and App API credentials; you don’t need this permission to access and copy Pipelines API keys. To view Pipelines API keys, you only need the Edit permission for “Integrations”.

For more on the differences between our APIs and when to use each, check out our comparison article.

Each key gives you access to the complete API, regardless of permissions set on your custom role. For instance, if you have the “Manage API credentials” permission, then you can create people and send events even if you don’t have the Edit or Create permissions for People.

Permissions for data-out integrations

You may need permissions under “Export data” and “Integrations” depending on the service you want to integrate:

• For Mixpanel or Amplitude, you need “Export data” permissions to manage them.
• For data warehouses like Amazon Redshift or Google BigQuery, you need “Export data” permissions and permissions for “Integrations”.
• For all other data-out integrations including reporting webhooks, you won’t need Export permissions, only permissions for “Integrations”.

Breakdown of integration permissions

Workspace & Message Channel Configuration

Create a custom role

To create a custom role, you must be an Account Admin on a Premium or Enterprise plan. Every custom role must have a minimum set of view permissions. By default, we check these for you when you start.

1. Go to Account Settings > Roles.
2. Click Create role.
3. Enter a Name for the role. This is what you see when assigning roles to team members.
4. (Optional) Add a Description so you remember what this role is for.
5. (Optional) Under Quick Setup, decide whether to start from a standard role or previously made custom role. This will populate the permissions table.
6. Edit permissions by checking or unchecking the boxes.
   • Click the check box to the left of a permission to grant full access to it.
   • Click individual checkboxes to the right to give granular access.
7. If you want to hide sensitive data from team members with this role, choose Hide sensitive attributes from the dropdown.
8. Click Submit.

Next, assign the role to a team member.

Hide sensitive attributes

If you’re on a Premium or Enterprise plan, then Account and Workspace Admins can mark profile attributes as “sensitive” in the Data Index and decide whether to hide this data from team members. This redacts values but not attribute names from the workspace.

Members with custom roles can also mark attributes as sensitive and hide them from team members depending on their level of access.

• If the team member has the Edit permission for the Data Index, they can mark attributes as sensitive.
• Then if they have the Edit permission for Workspace Settings, they can manage which Authors or Viewers can see these attributes. Note, this permission only lets them manage sensitive data for Authors and Viewers, not team members with custom roles.

Mark attributes as sensitive

Account admins and workspace admins can mark profile attributes as sensitive in the Data Index. This redacts values but not attributes names from the workspace and helps ensure data privacy across team members. If you have a custom role that includes the Edit permission for the Data Index, you can also mark attributes as sensitive.

The index also includes events, objects, and relationship attributes; however, you can only mark profile attributes as sensitive at this time. If an event attribute has the same name as a profile attribute marked as sensitive, those event values will also be redacted.

1. In the Attributes tab, click an attribute.
2. Click Edit in the panel.
3. Click “Make sensitive.” To unhide sensitive attributes, select the box to uncheck it.

    Not seeing Make sensitive?

   Check that you’re an Account Admin or Workspace Admin in Team Members. If you are, then check whether you’re on a Premium or Enterprise plan or reach out to someone with billing access. Otherwise, you’ll have to upgrade for access.

4. Click Save.
5. Next, assign “Hide sensitive attributes” to team members.

Choose “Hide sensitive attributes” when creating custom roles

To redact sensitive data from team members, you must be an Account Admin:

1. While editing a role, choose “Hide sensitive attributes” from the dropdown in the Permissions table.
2. Click Save.

Any team members with that role will now see values redacted for sensitive attributes. If they send test messages or webhooks from your workspace, those messages and responses will also contain redacted values.

Edit a custom role

You must be an Account Admin to edit a custom role.

1. Go to Account Settings > Roles.
2. Click the name of the role.
3. Modify the name, description or permissions as you see fit. You can also change whether to hide sensitive data.
4. Click Save.

Changes to permissions take effect immediately. If you reduce permissions and the role is assigned to someone logged in, they may lose their work. For instance, if you edit a role down to view only permissions for a campaign and the team member is currently editing an email in a campaign, they won’t be able to save their changes. Make sure you communicate with your team before editing roles in use.

You can find who will be impacted by permission changes on the Roles page under Users. We do not notify people if their permissions changed.

Duplicate a custom role

You must be an Account Admin to edit a custom role. Duplicating a role only creates the role; you must manually assign it to team members.

1. Go to Account Settings > Roles.
2. Click and choose Duplicate.
3. Click the new role to edit it. It will have “(Copy)” in front of the original role’s name.
4. Click Save.

Delete a custom role

To delete a custom role, you must be an Account Admin. You must remove the role from all team members before you can delete it.

1. Go to Account Settings > Roles.
2. Click and choose Delete.
3. Confirm your action.