User roles and permissions

Collections

The following user roles determine access to the collections you share:

• Reader - can view collection content.
• Developer - can view collection content and manage API tokens for the collection.
• Contributor - can view and update the collection's own metadata, and add items to or remove items from the collection. This role does not grant permissions to edit, publish, archive, or delete the assets within the collection. Those permissions must be granted separately through user group policies.
• Manager - has full control, including deleting the collection and managing the roles of other users.

The following table lists the permissions granted by each of these roles:

¹ A user with asset-level Update permission can remove an asset from a collection, even if the user has only Reader access to the collection. To prevent this, ensure that the user does not have Update permission on M.Asset.

Removing an asset from a collection uses the Unlink operation on the asset-to-collection relationship. When the operation is used with a Selection component, the user must have Update permission on all selected entities. For more information, see Unlink operation.

Collection user roles control permissions scoped to the collection, such as collection metadata, membership, and lifecycle operations. They do not grant permissions on the assets contained in the collection.

To allow users to edit, publish, archive, or delete assets, grant the required permissions on the M.Asset entity through user group policies. The required permissions also depend on the relevant operation and asset lifecycle configuration.

API keys

The same user roles also determine user permissions for API keys, which authorize access to content collections through the Preview and Delivery APIs. The following table shows the API keys permissions for each user role: