How do I manage team access permissions in the messaging platform?

SendSeven's role-based access control offers granular, scope-based permissions across all platform resources. Predefined system roles (Owner, Admin, Support Agent, Marketing Agent, etc.) or create custom roles. Multiple roles per user combinable. Audit log tracks all changes. Privilege escalation prevention. GDPR-compliant. Included in every plan.

Roles & Permissions

Who can do what.Clearly defined.

Define exactly which team member can access which features. With granular, scope-based permissions, predefined system roles, and custom access rights per team.

Start free trialSetup guide
  • Instant configuration
  • No credit card required
  • 14-day free trial
scope-based permissions
Granular
Fine-grained resource control
system roles
Predefined
Owner, Admin, Agent, Marketing, etc.
roles per team member, combinable
Multi
e.g. Support Agent + Marketing Agent
logging of all permission changes
Complete
Audit log
01 · Challenge

Everyone can do everything. Until something goes wrong.

A new employee accidentally deletes a contact list with 3,000 entries. An intern sends a WhatsApp campaign to the wrong audience. Another intern changes the billing settings. Nobody knew they had access.

For small and mid-sized businesses, this is a common scenario. As the team grows, so does the risk. Without clear access rules, everyone has access to everything: contacts, campaigns, settings, billing.

The problem grows when external partners, agencies, or freelancers need platform access. Without a permissions system, there are two options: give full access (risky) or give no access (impractical).

During GDPR audits, the question is: Who had access to which data, and when? Without a permissions system and audit log, that question is unanswerable.

Everyone
can do everything when permissions aren't configured
Default without RBAC
Granular
permissions for precise access control
Scope-based RBAC
02 · Solution

Access that fits the job

Assign each team member exactly the permissions they need for their work. Nothing more, nothing less.

Here's how it works: Choose one of the predefined roles (e.g., Support Agent, Marketing Agent, Admin) or create a custom role with individual permissions. Each team member can hold multiple roles, e.g., Support Agent and Marketing Agent at the same time.

Permissions are granular: 'Read conversations' is separate from 'Assign conversations'. 'Create campaigns' is separate from 'Send campaigns'. 'View contacts' is separate from 'Delete contacts'. Granular, scope-based permissions across every resource.

Every permission change is logged in the audit log. Who assigned which role to whom, and when? For GDPR requests, you have the answer instantly.

Predefined
system roles: Owner, Admin, Support Agent, Marketing Agent, and more
Ready to use out of the box
  1. 1
    Choose or create a role
    Predefined roles or custom configuration
  2. 2
    Assign team members
    One or multiple roles per person
  3. 3
    Access controlled
    Everyone sees and can do only what their role allows
03 · Result

Measurable results

Teams with clear permissions work more securely and independently.

Zero
unintended changes due to wrong permissions
  1. Controlled

    Access by role

    Team members only see what they need for their work.

  2. Logged

    Audit log

    Every permission change is fully traceable.

  3. Flexible

    Multiple roles per person

    Support + Marketing + Admin: combine as needed.

Predefined roles, ready to use

Choose from predefined roles: Owner, Admin, Support Agent, Marketing Agent, and more. Each role comes with a defined set of permissions. For special requirements, create custom roles with individual scope combinations.

  • Predefined roles for typical team structures
  • Create custom roles with individual permissions
  • Multiple roles per team member, combinable
  • Change or remove roles at any time

Granular permissions, scope-based access

Every permission is fine-grained: 'Read' is separate from 'Write', 'Create' from 'Delete'. Wildcard patterns like *:read (read everything) or campaigns:* (full campaign access) simplify configuration.

  • Permissions: read, write, create, delete, send, assign per resource
  • Wildcard patterns: *:* (everything), campaigns:* (full campaigns), *:read (read only)
  • Resources: Conversations, Campaigns, Contacts, Tickets, Analytics, Settings, etc.
  • Privilege escalation prevention: Nobody can grant themselves higher permissions

Every change logged

All permission changes are documented in the audit log: Who assigned or revoked which role, to whom, and when? During GDPR audits or internal reviews, you have the answers immediately.

  • Audit log for all role and permission changes
  • Timestamp and acting user for every action
  • GDPR-compliant: Access records available on request
  • Exportable for internal audits and compliance reviews

Agencies and partners, securely onboarded

Give external partners, agencies, or freelancers exactly the access they need. Without the risk of them accessing billing data, contact lists, or settings.

  • Custom role for external partners with restricted permissions
  • Limit access to specific channels or campaigns
  • Adjust or revoke roles at any time
  • Audit log tracks actions by external users too

ROI in numbers

unintended changes
Zero
Access by role
scope-based permissions
Granular
Every resource covered
system roles
Predefined
Ready to use
traceability
100%
Audit log

What this looks like in practice

A marketing agency with 15 employees manages 5 clients through SendSeven. Before: all employees could see all client accounts. After RBAC configuration: each 3-person team only sees the channels and contacts for their client. The CEO keeps a full overview. External freelancers get read-only access to specific campaigns.

Access
Everyone sees everythingEveryone sees only their area
External partners
Full access or noneCustom role with restrictions
Audit for GDPR request
Not possibleInstantly exportable

Typical scenario based on industry data

Configured in minutes

Assign roles, set permissions, done.

  1. 01 · 1 min

    Choose a role

    Pick from predefined roles or create your own.

  2. 02 · 1 min

    Assign team members

    Invite team members and assign one or more roles.

  3. 03 · Instant

    Access secured

    Everyone sees and can do only what their role allows. Audit log runs automatically.

For Developers & Power Users

Step-by-step guides for setup via the platform or API.

Platform Guide: Step by Step

Manage team permissions:

  1. 1

    View Team Members

    Go to Settings > Team. See all users, their roles, and current status.

  2. 2

    Assign Roles

    Click on a team member to edit their roles. Select one or more roles from the list (e.g., SUPPORT_AGENT + MARKETING_AGENT).

  3. 3

    Create Custom Role

    Click "Create Role" to define a custom role. Select specific scopes (e.g., conversations:read, campaigns:send) to grant.

  4. 4

    Manage API Tokens

    Go to Settings > API Tokens. Create scoped tokens with only the permissions needed for each integration.

You're all set!
API Reference: Developer Access

Manage roles, permissions, and API tokens programmatically.

MethodPathDescription
GET/api/v1/rolesList all roles
POST/api/v1/rolesCreate custom role
GET/api/v1/permissions/me/scopesGet current user scopes
POST/api/v1/api-tokensCreate scoped API token
Language:
Check My Permissions
const response = await fetch(
  'https://api.sendseven.com/api/v1/permissions/me/scopes',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_TOKEN',
      'X-Tenant-ID': 'YOUR_TENANT_ID'
    }
  }
);

const scopes = await response.json();
console.log('My scopes:', scopes);
Create Scoped API Token
const response = await fetch('https://api.sendseven.com/api/v1/api-tokens', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_JWT_TOKEN',
    'X-Tenant-ID': 'YOUR_TENANT_ID',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'CRM Integration Token',
    scopes: ['contacts:read', 'contacts:write', 'conversations:read'],
    expires_at: null // Never expires
  })
});

const token = await response.json();
console.log('Token (save this!):', token.token);
// Returns: s7_api_a1b2c3d4e5f6...

Pairs perfectly with

Frequently Asked Questions

What roles are available?
Predefined roles: Owner, Admin, Support Agent, Marketing Agent, and more. You can also create custom roles with individual permission combinations.
Can a team member have multiple roles?
Yes. Roles are combinable. A team member can be both a Support Agent and Marketing Agent at the same time. Permissions are additive.
How granular are the permissions?
Granular, scope-based permissions across every resource. For example, 'Read conversations' is separate from 'Assign conversations'. Wildcard patterns like *:read simplify configuration.
Is there an audit log?
Yes. Every permission change is logged: who assigned or revoked which role, to whom, and when. Exportable for GDPR audits.
Can external partners get restricted access?
Yes. Create a custom role for external partners with exactly the permissions they need. No access to billing data, contact lists, or settings.
What do roles and permissions cost?
Role-based access is included in every SendSeven plan, with no extra cost and unlimited users. Plans start at €49/month (Basic). View pricing.
Can I limit which contacts a team member sees?
Yes. Admins set for each team member which contacts they see: all contacts, all contacts with conversation history only through their own inboxes, or only reachable contacts. A contact is reachable if it matches the rules of one of their inboxes, if they own it or if a conversation with it is assigned to them. Hidden contacts also stay hidden in the contact list, search, exports and notifications. Campaigns still go to the whole list or segment.

Access that fits the job

Assign roles, configure permissions, audit log runs automatically. Secure from the first team member.

Start free trialSetup guide
Capterra5.0Google5.04.9
No credit card required
100 test messages included