Users & Permissions

Activepieces implements Role-Based Access Control (RBAC) at both platform and project levels, providing fine-grained control over user permissions.

User Roles Hierarchy

Platform Roles

Global roles that apply across all projects:

ADMIN: Full platform control
OPERATOR: Manage projects and users
MEMBER: Regular user access

Project Roles

Project-specific roles with granular permissions:

Admin: Full project control
Editor: Create and modify flows
Viewer: Read-only access

Default Project Roles

Activepieces provides three built-in project roles:

Admin
Editor
Viewer

Admin Role

Full control over the project:Permissions:

✅ READ_FLOW / WRITE_FLOW
✅ UPDATE_FLOW_STATUS
✅ READ_APP_CONNECTION / WRITE_APP_CONNECTION
✅ READ_PROJECT_MEMBER / WRITE_PROJECT_MEMBER
✅ WRITE_INVITATION / READ_INVITATION
✅ WRITE_PROJECT_RELEASE / READ_PROJECT_RELEASE
✅ READ_RUN / WRITE_RUN
✅ WRITE_ALERT / READ_ALERT
✅ WRITE_PROJECT / READ_PROJECT
✅ WRITE_FOLDER / READ_FOLDER
✅ READ_TABLE / WRITE_TABLE
✅ READ_MCP / WRITE_MCP

Use Cases:

Project owners
Team leads
Department heads

Permission Model

Activepieces uses a comprehensive permission system:

Resource Permissions

Flow Permissions

READ_FLOW: View flow definitions
WRITE_FLOW: Create and edit flows
UPDATE_FLOW_STATUS: Enable/disable flows

Connection Permissions

READ_APP_CONNECTION: View connections (without credentials)
WRITE_APP_CONNECTION: Create and manage connections

Member Permissions

READ_PROJECT_MEMBER: View project members
WRITE_PROJECT_MEMBER: Add/remove members, change roles
READ_INVITATION: View pending invitations
WRITE_INVITATION: Send and manage invitations

Run Permissions

READ_RUN: View execution logs
WRITE_RUN: Trigger manual runs, retry failed runs

Project Permissions

READ_PROJECT: View project details
WRITE_PROJECT: Modify project settings

Release Permissions

READ_PROJECT_RELEASE: View releases
WRITE_PROJECT_RELEASE: Create and deploy releases

Additional Permissions

READ_FOLDER / WRITE_FOLDER: Manage flow organization
READ_ALERT / WRITE_ALERT: Configure alerting
READ_TABLE / WRITE_TABLE: Access project data storage
READ_MCP / WRITE_MCP: Manage MCP integrations

Custom Roles

Create custom roles with specific permission sets:

{
  name: "Integration Specialist",
  type: RoleType.CUSTOM,
  platformId: "platform_123",
  permissions: [
    "READ_FLOW",
    "WRITE_FLOW",
    "READ_APP_CONNECTION",
    "WRITE_APP_CONNECTION",
    "READ_RUN"
  ]
}

Custom roles are available in Enterprise Edition and allow you to create roles tailored to your organization’s needs.

Managing Project Members

Adding Members

Invite User

Send an invitation with a role:

{
  email: "user@company.com",
  projectId: "proj_abc123",
  projectRoleId: "role_editor"
}

User Accepts

User receives email and accepts invitation

Member Created

Project member record is created:

{
  id: "member_xyz",
  userId: "user_123",
  projectId: "proj_abc123",
  projectRoleId: "role_editor",
  platformId: "platform_123"
}

Updating Member Roles

Change a member’s role:

// Promote to Admin
{
  id: "member_xyz",
  projectId: "proj_abc123",
  role: "Admin"
}

Removing Members

Delete project member to revoke access:

DELETE /v1/projects/{projectId}/members/{memberId}

Role Resolution Logic

Activepieces determines project access through a hierarchy:

Project Owner Check

If user is the project owner → Admin role

Platform Admin Check

If user is Platform Admin → Admin role

Platform Operator Check

If user is Platform Operator → Editor role

Project Member Check

If user is a project member → Use assigned project role

No Access

Otherwise → No access to project

Platform-level roles (Admin, Operator) automatically grant elevated permissions in all projects within that platform.

Team Management

Listing Members

Get all members with their roles:

{
  data: [
    {
      id: "member_1",
      user: {
        id: "user_123",
        email: "alice@company.com",
        firstName: "Alice",
        lastName: "Smith"
      },
      projectRole: {
        name: "Admin",
        permissions: [...]
      },
      project: {
        id: "proj_abc123",
        displayName: "Marketing Team"
      }
    }
  ],
  next: null
}

User Analytics

Track active users per project:

{
  totalUsers: 8,      // All members
  activeUsers: 5      // Members who logged in recently
}

User Invitations

Invitation Flow

Create Invitation

{
  email: "newuser@company.com",
  type: InvitationType.PROJECT,
  platformId: "platform_123",
  projectId: "proj_abc123",
  projectRoleId: "role_editor"
}

Email Sent

Invitation email sent to user

User Signs Up

New user creates account or existing user logs in

Provisioning

System automatically:

Creates project member
Assigns specified role
Deletes invitation

Invitation Types

Platform Invitation
Project Invitation

Invites user to the platform without specific project:

{
  type: InvitationType.PLATFORM,
  platformRole: PlatformRole.MEMBER
}

Invites user to specific project:

{
  type: InvitationType.PROJECT,
  projectId: "proj_abc123",
  projectRoleId: "role_editor"
}

Permission Checking

Implement permission checks in your code:

// Check if user has specific permission
const hasPermission = projectRole.permissions.includes(
  Permission.WRITE_FLOW
)

// Get user's role in project
const role = await projectMemberService.getRole({
  userId: "user_123",
  projectId: "proj_abc123"
})

API Reference

curl -X GET 'https://api.activepieces.com/v1/projects/{projectId}/members' \
  -H 'Authorization: Bearer {token}'

curl -X POST 'https://api.activepieces.com/v1/projects/{projectId}/members' \
  -H 'Authorization: Bearer {token}' \
  -H 'Content-Type: application/json' \
  -d '{
    "userId": "user_123",
    "projectRoleName": "Editor"
  }'

curl -X PATCH 'https://api.activepieces.com/v1/projects/{projectId}/members/{memberId}' \
  -H 'Authorization: Bearer {token}' \
  -H 'Content-Type: application/json' \
  -d '{
    "role": "Admin"
  }'

curl -X POST 'https://api.activepieces.com/v1/project-roles' \
  -H 'Authorization: Bearer {token}' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Integration Specialist",
    "permissions": ["READ_FLOW", "WRITE_FLOW"],
    "platformId": "platform_123"
  }'

Best Practices

Least Privilege

Grant users the minimum permissions needed for their role.

Regular Audits

Review member lists and permissions quarterly.

Role Standardization

Use default roles when possible; create custom roles sparingly.

Owner Designation

Assign project ownership to responsible team leads.

Project Management

Set up project structure

SSO Configuration

Enable single sign-on

Audit Logs

Track permission changes

Platform Management

Security

User Roles Hierarchy

Default Project Roles

Admin Role

Editor Role

Viewer Role

Permission Model

Resource Permissions

Custom Roles

Managing Project Members

Adding Members

Updating Member Roles

Removing Members

Role Resolution Logic

Team Management

Listing Members

User Analytics

User Invitations

Invitation Flow

Invitation Types

Permission Checking

API Reference

Best Practices

Least Privilege

Regular Audits

Role Standardization

Owner Designation

Project Management

SSO Configuration

Audit Logs

​User Roles Hierarchy

​Default Project Roles

​Admin Role

​Editor Role

​Viewer Role

​Permission Model

​Resource Permissions

​Custom Roles

​Managing Project Members

​Adding Members

​Updating Member Roles

​Removing Members

​Role Resolution Logic

​Team Management

​Listing Members

​User Analytics

​User Invitations

​Invitation Flow

​Invitation Types

​Permission Checking

​API Reference

​Best Practices

Least Privilege

Regular Audits

Role Standardization

Owner Designation

​Related Topics

Project Management

SSO Configuration

Audit Logs

User Roles Hierarchy

Default Project Roles

Admin Role

Editor Role

Viewer Role

Permission Model

Resource Permissions

Custom Roles

Managing Project Members

Adding Members

Updating Member Roles

Removing Members

Role Resolution Logic

Team Management

Listing Members

User Analytics

User Invitations

Invitation Flow

Invitation Types

Permission Checking

API Reference

Best Practices

Related Topics