Roles and permissions reference
<!-- Generated by pnpm docs:build (docs-reference) from ROLE_PERMISSIONS in packages/shared/src/index.ts. Do not edit by hand; edit the source and run the command. -->
Every API route checks one of these permissions; roles are the only way to hold them. A user may have global roles, roles on one site and roles in one section of a site (see multisite.md); an API token holds a subset of its owner's permissions (see mcp.md).
| Permission | viewer | author | editor | manager | admin | What it allows |
|---|---|---|---|---|---|---|
content.view_drafts | yes | yes | yes | yes | yes | See unpublished content: drafts, items in review, previews, revision history, comments and checks. |
registry.publish | yes | yes | yes | yes | yes | Publish packages to a registry instance (spillwaycms.com); granted to every signed-in user. |
content.create | yes | yes | yes | yes | Create entities (always as drafts) and translations. | |
content.edit_own | yes | yes | yes | yes | Save new revisions of entities the user authored. | |
content.submit_review | yes | yes | yes | yes | Move a draft to the review queue. | |
media.upload | yes | yes | yes | yes | Upload files to the media library and edit their alt text and focal point. | |
ai.use | yes | yes | yes | yes | Call the AI layer: page from brief, assist text, alt text, translations. | |
content.edit_any | yes | yes | yes | Save new revisions of anyone's entities; break another user's editing lock. | ||
content.delete | yes | yes | yes | Delete entities. | ||
content.publish | yes | yes | yes | Publish, reject, schedule, merge workstreams, manage alerts; force past failing checks. | ||
content.unpublish | yes | yes | yes | Unpublish or archive published content. | ||
media.delete | yes | yes | yes | Delete media items. | ||
forms.view_submissions | yes | yes | yes | Read and export form submissions. | ||
content.translate | yes | yes | yes | |||
types.manage | yes | yes | Create and edit content types, vocabularies, collections and shared blocks; install kits (with site.settings). | |||
site.settings | yes | yes | Site settings, theme, SEO, redirects, menus, integrations, AI settings, brand profile, notifications, modules, audiences and experiments, structure import. | |||
forms.manage | yes | yes | Create and edit forms and their connectors; delete submissions. | |||
views.share | yes | yes | ||||
users.manage | yes | Users, roles, site and section roles, SSO providers; list and revoke everyone's API tokens. | ||||
sites.manage | yes | Create, edit and delete sites (multisite). | ||||
imports.manage | yes |
Roles
- viewer: Reads drafts and previews; cannot change content. (2 permissions)
- author: Writes drafts and submits them for review; uses AI assistance. (7 permissions)
- editor: Everything an author can, plus editing anyone's content, publishing and reading form submissions. (14 permissions)
- manager: Everything an editor can, plus the content model, site settings and forms. (18 permissions)
- admin: Everything, including users, sign-in providers and sites. (21 permissions)
Spillway 0.1.0 · Edit this page on GitHub