How do I manage team access permissions in the messaging platform?
SendSeven's role-based access control offers granular, scope-based permissions across all platform resources. Predefined system roles (Owner, Admin, Support Agent, Marketing Agent, etc.) or create custom roles. Multiple roles per user combinable. Audit log tracks all changes. Privilege escalation prevention. GDPR-compliant. Included in every plan.
Who can do what.
Clearly defined.
Define exactly which team member can access which features. With granular, scope-based permissions, predefined system roles, and custom access rights per team.
Everyone can do everything. Until something goes wrong.
A new employee accidentally deletes a contact list with 3,000 entries. An intern sends a WhatsApp campaign to the wrong audience. Another intern changes the billing settings. Nobody knew they had access.
For small and mid-sized businesses, this is a common scenario. As the team grows, so does the risk. Without clear access rules, everyone has access to everything: contacts, campaigns, settings, billing.
The problem grows when external partners, agencies, or freelancers need platform access. Without a permissions system, there are two options: give full access (risky) or give no access (impractical).
During GDPR audits, the question is: Who had access to which data, and when? Without a permissions system and audit log, that question is unanswerable.
Access that fits the job
Assign each team member exactly the permissions they need for their work. Nothing more, nothing less.
Here's how it works: Choose one of the predefined roles (e.g., Support Agent, Marketing Agent, Admin) or create a custom role with individual permissions. Each team member can hold multiple roles, e.g., Support Agent and Marketing Agent at the same time.
Permissions are granular: 'Read conversations' is separate from 'Assign conversations'. 'Create campaigns' is separate from 'Send campaigns'. 'View contacts' is separate from 'Delete contacts'. Granular, scope-based permissions across every resource.
Every permission change is logged in the audit log. Who assigned which role to whom, and when? For GDPR requests, you have the answer instantly.
Measurable results
Teams with clear permissions work more securely and independently.
Predefined roles, ready to use
Choose from predefined roles: Owner, Admin, Support Agent, Marketing Agent, and more. Each role comes with a defined set of permissions. For special requirements, create custom roles with individual scope combinations.
- Predefined roles for typical team structures
- Create custom roles with individual permissions
- Multiple roles per team member, combinable
- Change or remove roles at any time
Granular permissions, scope-based access
Every permission is fine-grained: 'Read' is separate from 'Write', 'Create' from 'Delete'. Wildcard patterns like *:read (read everything) or campaigns:* (full campaign access) simplify configuration.
- Permissions: read, write, create, delete, send, assign per resource
- Wildcard patterns: *:* (everything), campaigns:* (full campaigns), *:read (read only)
- Resources: Conversations, Campaigns, Contacts, Tickets, Analytics, Settings, etc.
- Privilege escalation prevention: Nobody can grant themselves higher permissions
Every change logged
All permission changes are documented in the audit log: Who assigned or revoked which role, to whom, and when? During GDPR audits or internal reviews, you have the answers immediately.
- Audit log for all role and permission changes
- Timestamp and acting user for every action
- GDPR-compliant: Access records available on request
- Exportable for internal audits and compliance reviews
Agencies and partners, securely onboarded
Give external partners, agencies, or freelancers exactly the access they need. Without the risk of them accessing billing data, contact lists, or settings.
- Custom role for external partners with restricted permissions
- Limit access to specific channels or campaigns
- Adjust or revoke roles at any time
- Audit log tracks actions by external users too
ROI in numbers
What this looks like in practice
A marketing agency with 15 employees manages 5 clients through SendSeven. Before: all employees could see all client accounts. After RBAC configuration: each 3-person team only sees the channels and contacts for their client. The CEO keeps a full overview. External freelancers get read-only access to specific campaigns.
Typical scenario based on industry data
Configured in minutes
Assign roles, set permissions, done.
Choose a role
Pick from predefined roles or create your own.
Assign team members
Invite team members and assign one or more roles.
Access secured
Everyone sees and can do only what their role allows. Audit log runs automatically.
Step-by-step guides for setup via the platform or API.
Platform Guide: Step by Step
Manage team permissions:
View Team Members
Go to Settings > Team. See all users, their roles, and current status.
Assign Roles
Click on a team member to edit their roles. Select one or more roles from the list (e.g., SUPPORT_AGENT + MARKETING_AGENT).
Create Custom Role
Click "Create Role" to define a custom role. Select specific scopes (e.g., conversations:read, campaigns:send) to grant.
Manage API Tokens
Go to Settings > API Tokens. Create scoped tokens with only the permissions needed for each integration.
API Reference: Developer Access
Manage roles, permissions, and API tokens programmatically.
| Method | Path | Description |
|---|---|---|
| GET | /api/v1/roles | List all roles |
| POST | /api/v1/roles | Create custom role |
| GET | /api/v1/permissions/me/scopes | Get current user scopes |
| POST | /api/v1/api-tokens | Create scoped API token |
const response = await fetch(
'https://api.sendseven.com/api/v1/permissions/me/scopes',
{
headers: {
'Authorization': 'Bearer YOUR_API_TOKEN',
'X-Tenant-ID': 'YOUR_TENANT_ID'
}
}
);
const scopes = await response.json();
console.log('My scopes:', scopes);const response = await fetch('https://api.sendseven.com/api/v1/api-tokens', {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_JWT_TOKEN',
'X-Tenant-ID': 'YOUR_TENANT_ID',
'Content-Type': 'application/json'
},
body: JSON.stringify({
name: 'CRM Integration Token',
scopes: ['contacts:read', 'contacts:write', 'conversations:read'],
expires_at: null // Never expires
})
});
const token = await response.json();
console.log('Token (save this!):', token.token);
// Returns: s7_api_a1b2c3d4e5f6...Frequently Asked Questions
What roles are available?
Predefined roles: Owner, Admin, Support Agent, Marketing Agent, and more. You can also create custom roles with individual permission combinations.
Can a team member have multiple roles?
Yes. Roles are combinable. A team member can be both a Support Agent and Marketing Agent at the same time. Permissions are additive.
How granular are the permissions?
Granular, scope-based permissions across every resource. For example, 'Read conversations' is separate from 'Assign conversations'. Wildcard patterns like *:read simplify configuration.
Is there an audit log?
Yes. Every permission change is logged: who assigned or revoked which role, to whom, and when. Exportable for GDPR audits.
Can external partners get restricted access?
Yes. Create a custom role for external partners with exactly the permissions they need. No access to billing data, contact lists, or settings.
What do roles and permissions cost?
Role-based access is included in every SendSeven plan, with no extra cost and unlimited users. Plans start at €49/month (Basic). View pricing.
Access that fits the job
Assign roles, configure permissions, audit log runs automatically. Secure from the first team member.