Role templates
Three role templates cover the jobs that teams most often split platform access by: procurement, device operations, and finance. Each template is a permission set you create as a custom role, not a built-in system role.
What each role covers
None of the three include user management or SSO. To grant those, add the permissions yourself or assign the Administrator system role.
Before you begin
Creating a role requires an authentication token and a role that includes role management, such as Administrator.
The examples use my as the Workspace identifier, which targets your own Workspace.
Create a role from a template
During the beta, a Workspace can hold at most 3 custom roles. To request beta access, contact your Customer Success Manager.
Each role below has a runnable request and the payload it posts. Run it from the reference, or save the payload as a JSON file and post it yourself.
The response is 201 Created with the role’s id.
Assign the role to users with that ID.
The name and description fields are free text.
Rename a template to match your own conventions, within the name rules.
If a template includes a permission your Workspace type can’t assign, the request returns 400 Bad Request.
Remove that pair and post the request again.
See Troubleshooting.
Procurement
Orders SIMs and brings them into the Workspace.
This role can:
- View SIM Inventory, including SIM details and events.
- Order SIMs, and register the SIMs it receives.
- Create devices in bulk, either during registration or from a selection in SIM Inventory.
- View the Device Policies lists, and the Workspace contact and payment details that an order needs.
This role can’t:
- Open Connected Devices or any device details.
- Change, deactivate, delete, or transfer SIMs.
- Create tags or IP address spaces, so device creation picks from existing ones only.
- Open Reports, Dashboard, Integrations, Automations, or Billing.
procurement.json (21 permissions)
To let this role save invoice and shipping details back to the Workspace, add Organisation.Contact with Create, Update, and Delete, and Organisation.BillingConfig with Update.
Orders go through without them.
Device Manager
Handles day-to-day device and SIM work, with no access to cost data.
This role can:
- Manage devices end to end: create them, assign and release SIMs, rename them, set IMEI and IMEI lock, turn them on and off, and change their coverage and service policies.
- Manage tags, operator blacklists, data and SMS quotas, traffic limit extensions, and eSIM profiles.
- Send SMS, reset connectivity, and view events, location, and Flow Logs.
- Deactivate SIMs from SIM Inventory.
This role can’t:
- See usage statistics anywhere: no usage columns, Stats tabs, or usage charts.
- Delete devices, or delete or transfer SIMs.
- Register or order SIMs, which stay with Procurement.
- Create or edit policies, since the policy lists are read-only.
- See coverage policy cost details, such as tariffs and rates.
- Open Reports, Dashboard, Integrations, Automations, or Billing.
device-manager.json (54 permissions)
Finance
Handles billing and reporting.
This role can:
- Open Reports, including Daily Usage and the dashboard report tabs.
- View and change the payment method, and change the Workspace currency.
- Edit the VAT number, and view the prepaid balance on prepaid Workspaces.
- View monthly cost details, and view and pay invoices.
This role can’t:
- Open device or SIM pages, Orders, Device Policies, Dashboard, Integrations, or Automations.
- Open Workspace and organization data.
finance.json (10 permissions)
The credit limit appears on Billing without an extra permission, on postpaid Workspaces that have a monthly cost limit set.
Actions that share a permission
Two actions stay available to Device Manager even though the template aims to withhold them. Both are guarded by the same permissions the role needs for everyday work, so the permission model can’t separate them:
- Edit IP on device details shares
Endpoint+UpdateandIpAddressSpace+List. - Release SIM shares
Endpoint+Update,Sim+Update, andEndpoint+Get.
Removing those write permissions does block both actions, but it also stops the role from creating devices and assigning SIMs.
Verify what a role grants
To review a template after you create it, list your roles. To check the result from a user’s side, sign in as someone holding the role and check your own permissions.
For how permissions work, see Permissions. For the full create, update, and assign reference, see Manage roles and permissions.