Permission Reference

This is the complete list of the 88 permissions RackHelm ships with, in the same eleven groups the role editor uses. Use it when you are building a role and need to know what a switch actually unlocks. For how roles, ranking and inheritance work, see Roles and Permissions.

Note: A Super Admin bypasses every check in this list, so these permissions only ever describe what other staff can do.

Dashboard & Reports #

Key	What it allows
view_dashboard	Shows the Dashboard entry in the admin sidebar. The dashboard page itself carries a second check against an undefined capability, so it opens for Super Admins only however you grant this key.
view_reports	Open the Reports section. Each individual report needs its own key as well.
view_seo_reports	See SEO scans, including the SEO Reports tab on a client profile.
manage_seo_reports	Delete SEO scans.
view_audit_logs	Open Audit Logs and Email Logs.
view_report_account_review	Run the Account Review report — status overview of all accounts.
view_report_new_customers	Run New Customers — yearly comparison of signups.
view_report_billing_cycle_income	Run Billing Cycle Income — revenue by billing frequency.
view_report_income_per_gateway	Run Income per Gateway.
view_report_income_growth	Run Income Growth.
view_report_product_performance	Run Product Performance — top sellers and revenue split.
view_report_customer_retention	Run Customer Retention — lifetime value and churn.
view_report_ticket_analytics	Run Ticket Analytics — department and staff performance.
view_report_ticket_review	Run Ticket Review — tickets opened against closed.

Tip: Report permissions are derived from the report’s own slug, in the form view_report_<slug> with hyphens replaced by underscores. A report added later needs a matching permission record before anyone but a Super Admin can open it.

Staff & Roles #

Key	What it allows
view_roles	Open Roles & Permissions and view a role.
create_roles	Create a new role.
edit_roles	Edit a role’s name, permissions and staff flag, and reorder the hierarchy. Subject to the rank and “cannot grant what you do not hold” rules.
delete_roles	Delete a role that has no users and is not the client default.
view_staff, create_staff, edit_staff, delete_staff	Declared but not checked anywhere. Staff accounts are governed by the Clients keys below plus the role hierarchy.

Clients #

Key	What it allows
view_clients	Open All Users and the profile tabs. The foundation permission for the whole client area.
create_clients	Create an account from the admin area.
edit_clients	Edit contact details, reset a password, manage affiliate codes, and add a sub-account to a customer.
delete_clients	Delete an account. Super Admin accounts and your own login are refused by the controller; staff accounts are excluded by hiding the button rather than by a server-side check.
login_as_client	Impersonate a customer. See Impersonating a Client.
view_client_activity	Read an account’s authentication log — sign-in times, IP addresses and approximate locations.
add_client_credit	Reach the credit form on the Billing tab and top a balance up.
remove_client_credit	Debit a balance. Checked separately from adding, so a role can be allowed to give credit but not take it away.
suspend_clients	Declared but not checked anywhere today.

Note: The two credit keys sit in the Clients group in the editor, not Billing & Credit, because grouping is worked out from the key name and both contain “client”.

Billing & Credit #

Key	What it allows
view_credit_balances	See a customer’s credit balance and ledger — this is what gates the Billing tab.
view_widget_income	Show the revenue widgets on the admin dashboard.
view_transactions	Declared but not checked anywhere today.

Orders & Services #

Key	What it allows
view_orders	Open Orders, Active Packages and order detail.
create_orders	Place an order on a customer’s behalf, including charging a stored card.
edit_orders	Change an order or a package — product, price, cycle, due date, provisioning fields.
cancel_orders	Cancel or terminate a package.
delete_orders	Remove a package from an order. Invoices are retained for audit.
provision_orders	Trigger provisioning, including retrying a failed job.
suspend_services	Move an active package to suspended.
unsuspend_services	Return a suspended package to active.
view_widget_provisioning	Show the provisioning-health widgets on the dashboard.

Invoices #

Key	What it allows
view_invoices	Open the invoice list and individual invoices.
create_invoices	Raise an invoice by hand.
edit_invoices	Change invoice lines, totals and dates.
delete_invoices	Delete an invoice.
refund_invoices	Refund a paid invoice.
mark_invoices_paid	Record an off-platform payment against an invoice.
send_invoice_reminders	Send a reminder for an unpaid invoice.
view_widget_invoices	Show the invoice widgets on the dashboard.

Products & Catalog #

Key	What it allows
view_products	Open the product and product-group lists.
edit_products	Create, edit, duplicate, activate and delete products and product groups, and manage billing cycles and variable assignments. This one key covers the whole catalogue editor.
delete_products	Checked by the product policy for deletion.
manage_addons	Manage product add-ons and their options and prices.
manage_custom_fields	Manage the custom fields shown at checkout.
manage_coupons	Manage discount coupons.
create_products, view_product_groups, manage_product_groups	Declared but not checked anywhere. Creating a product and managing groups both run on edit_products.

Support & Tickets #

Key	What it allows
view_tickets	Open the ticket queue and the Tickets tab on a client profile. Department membership still limits which tickets appear.
create_tickets	Open a ticket on a customer’s behalf.
reply_tickets	Post replies and internal notes.
assign_tickets	Assign a ticket to a member of staff.
close_tickets	Close a ticket.
delete_tickets	Delete a ticket.
manage_departments	Create and edit departments and their staff and role membership.
manage_canned_replies	Manage the canned reply library.
view_widget_tickets	Show the ticket widgets on the dashboard.
view_departments	Declared but not checked anywhere; the department screens use manage_departments.

Integrations & Servers #

Key	What it allows
edit_integrations	The working key for the whole integrations area: control panels, registrars, game panels, server accounts and connection tests.
manage_custom_apis	Create and edit Custom API integrations — operator-defined outbound HTTP calls, including their destination URL and payload template.
view_integrations, create_integrations, delete_integrations	Declared but not checked anywhere; everything runs on edit_integrations.

Warning: Treat manage_custom_apis as a high-trust permission. Whoever holds it chooses where an outbound call goes and what it contains, which means they can direct customer data and service credentials at a server of their choosing. RackHelm deliberately withholds it from the built-in Administrator role.

System Settings & Monitoring #

Key	What it allows
view_settings	Gates the /admin/settings route, but that route points at a controller method that does not exist, so the key opens nothing today.
edit_company_settings	Edit company, billing and onboarding settings, mail settings, countries, the spam filter and the import tools. A broad key — grant it deliberately. Note that theme, CAPTCHA, fraud, MFA, password-policy and payment-gateway settings are not covered: their controllers add a second check against an undefined capability, so they open for Super Admins only.
edit_support_settings	Edit the support and ticketing settings.
manage_email_routes	Manage inbound email routing (Support → Email Routing). The spam rules are a separate screen gated on edit_company_settings.
view_schedules	See the system schedule widgets on the dashboard.
manage_schedules	Edit the scheduled jobs — invoice generation, renewals, suspensions and so on.
view_horizon	Gates the queue-monitor routes, but the controller behind them adds a second check against an undefined capability, so the screen opens for Super Admins only whatever you grant here.
manage_navigation	Edit the portal menus.
manage_notifications	Configure admin notification channels, audiences and subscriptions.
view_notification_logs	Read the notification delivery log.
manage_site_templates	Manage the site templates offered when a site is provisioned.
manage_email_templates	Declared but not checked anywhere today.

Content #

Key	What it allows
manage_pages	Create and edit content and legal pages, page groups, redirects and the page builder.

Screens with no permission of their own #

A few admin screens are checked against capability names that were never added to the permission list. Because an undefined capability is denied for everybody except a Super Admin, those screens are effectively Super Admin only, and no switch in the role editor will open them:

• Marketing campaigns — the campaign routes are checked against manage_campaigns.
• Assigning roles to a user account — checked against manage_roles. Editing the roles themselves uses the real *_roles keys, but attaching one to a person does not.
• The queue monitor — also checked against manage_roles, on top of the view_horizon key on its routes.
• The admin dashboard, the Theme, Captcha Protection, Fraud Protection, MFA and Password Policy screens, and Payment Gateways — all checked against staff_panel.

These are whole-screen locks: the check runs in the controller, so typing the URL does not get round it.

Several sidebar links are rendered against the same kind of undefined name — manage_settings, manage_orders and manage_products in the admin sidebar, and staff_panel on the customer portal’s Admin Panel link. Links guarded that way, which include Roles & Permissions, Create Order, Billing Cycles, most of Platform Settings and the whole Security group that holds Audit Logs, appear only for Super Admins. Where the page behind the link has a real permission of its own — Roles & Permissions and Audit Logs both do — staff holding that permission can still reach it by typing the URL.