---
title: Permission Reference
description: This is the complete list of the 88 permissions RackHelm ships with, in the same eleven groups the role editor uses. Use it when you are building a role and need to know what a switch actually unlocks. For how…
url: "https://rackhelm.com/documentation/permission-reference/"
updated: "2026-09-24"
category: "Clients, Staff & Access Control"
---

# Permission Reference

This is the complete list of the 88 permissions RackHelm ships with, in the same eleven groups the role editor uses. Use it when you are building a role and need to know what a switch actually unlocks. For how roles, ranking and inheritance work, see [Roles and Permissions](/docs/roles-and-permissions/).

> **Note:** A Super Admin bypasses every check in this list, so these permissions only ever describe what *other* staff can do.

## Dashboard & Reports

| Key | What it allows |
| --- | --- |
| `view_dashboard` | Shows the **Dashboard** entry in the admin sidebar. The dashboard page itself carries a second check against an undefined capability, so it opens for Super Admins only however you grant this key. |
| `view_reports` | Open the Reports section. Each individual report needs its own key as well. |
| `view_seo_reports` | See SEO scans, including the SEO Reports tab on a client profile. |
| `manage_seo_reports` | Delete SEO scans. |
| `view_audit_logs` | Open Audit Logs and Email Logs. |
| `view_report_account_review` | Run the **Account Review** report — status overview of all accounts. |
| `view_report_new_customers` | Run **New Customers** — yearly comparison of signups. |
| `view_report_billing_cycle_income` | Run **Billing Cycle Income** — revenue by billing frequency. |
| `view_report_income_per_gateway` | Run **Income per Gateway**. |
| `view_report_income_growth` | Run **Income Growth**. |
| `view_report_product_performance` | Run **Product Performance** — top sellers and revenue split. |
| `view_report_customer_retention` | Run **Customer Retention** — lifetime value and churn. |
| `view_report_ticket_analytics` | Run **Ticket Analytics** — department and staff performance. |
| `view_report_ticket_review` | Run **Ticket Review** — tickets opened against closed. |

> **Tip:** Report permissions are derived from the report's own slug, in the form `view_report_<slug>` with hyphens replaced by underscores. A report added later needs a matching permission record before anyone but a Super Admin can open it.

## Staff & Roles

| Key | What it allows |
| --- | --- |
| `view_roles` | Open **Roles & Permissions** and view a role. |
| `create_roles` | Create a new role. |
| `edit_roles` | Edit a role's name, permissions and staff flag, and reorder the hierarchy. Subject to the rank and "cannot grant what you do not hold" rules. |
| `delete_roles` | Delete a role that has no users and is not the client default. |
| `view_staff`, `create_staff`, `edit_staff`, `delete_staff` | Declared but not checked anywhere. Staff accounts are governed by the **Clients** keys below plus the role hierarchy. |

## Clients

| Key | What it allows |
| --- | --- |
| `view_clients` | Open **All Users** and the profile tabs. The foundation permission for the whole client area. |
| `create_clients` | Create an account from the admin area. |
| `edit_clients` | Edit contact details, reset a password, manage affiliate codes, and add a sub-account to a customer. |
| `delete_clients` | Delete an account. Super Admin accounts and your own login are refused by the controller; staff accounts are excluded by hiding the button rather than by a server-side check. |
| `login_as_client` | Impersonate a customer. See [Impersonating a Client](/docs/impersonating-a-client/). |
| `view_client_activity` | Read an account's authentication log — sign-in times, IP addresses and approximate locations. |
| `add_client_credit` | Reach the credit form on the Billing tab and top a balance up. |
| `remove_client_credit` | Debit a balance. Checked separately from adding, so a role can be allowed to give credit but not take it away. |
| `suspend_clients` | Declared but not checked anywhere today. |

> **Note:** The two credit keys sit in the **Clients** group in the editor, not **Billing & Credit**, because grouping is worked out from the key name and both contain "client".

## Billing & Credit

| Key | What it allows |
| --- | --- |
| `view_credit_balances` | See a customer's credit balance and ledger — this is what gates the Billing tab. |
| `view_widget_income` | Show the revenue widgets on the admin dashboard. |
| `view_transactions` | Declared but not checked anywhere today. |

## Orders & Services

| Key | What it allows |
| --- | --- |
| `view_orders` | Open Orders, Active Packages and order detail. |
| `create_orders` | Place an order on a customer's behalf, including charging a stored card. |
| `edit_orders` | Change an order or a package — product, price, cycle, due date, provisioning fields. |
| `cancel_orders` | Cancel or terminate a package. |
| `delete_orders` | Remove a package from an order. Invoices are retained for audit. |
| `provision_orders` | Trigger provisioning, including retrying a failed job. |
| `suspend_services` | Move an active package to suspended. |
| `unsuspend_services` | Return a suspended package to active. |
| `view_widget_provisioning` | Show the provisioning-health widgets on the dashboard. |

## Invoices

| Key | What it allows |
| --- | --- |
| `view_invoices` | Open the invoice list and individual invoices. |
| `create_invoices` | Raise an invoice by hand. |
| `edit_invoices` | Change invoice lines, totals and dates. |
| `delete_invoices` | Delete an invoice. |
| `refund_invoices` | Refund a paid invoice. |
| `mark_invoices_paid` | Record an off-platform payment against an invoice. |
| `send_invoice_reminders` | Send a reminder for an unpaid invoice. |
| `view_widget_invoices` | Show the invoice widgets on the dashboard. |

## Products & Catalog

| Key | What it allows |
| --- | --- |
| `view_products` | Open the product and product-group lists. |
| `edit_products` | Create, edit, duplicate, activate and delete products and product groups, and manage billing cycles and variable assignments. This one key covers the whole catalogue editor. |
| `delete_products` | Checked by the product policy for deletion. |
| `manage_addons` | Manage product add-ons and their options and prices. |
| `manage_custom_fields` | Manage the custom fields shown at checkout. |
| `manage_coupons` | Manage discount coupons. |
| `create_products`, `view_product_groups`, `manage_product_groups` | Declared but not checked anywhere. Creating a product and managing groups both run on `edit_products`. |

## Support & Tickets

| Key | What it allows |
| --- | --- |
| `view_tickets` | Open the ticket queue and the Tickets tab on a client profile. Department membership still limits which tickets appear. |
| `create_tickets` | Open a ticket on a customer's behalf. |
| `reply_tickets` | Post replies and internal notes. |
| `assign_tickets` | Assign a ticket to a member of staff. |
| `close_tickets` | Close a ticket. |
| `delete_tickets` | Delete a ticket. |
| `manage_departments` | Create and edit departments and their staff and role membership. |
| `manage_canned_replies` | Manage the canned reply library. |
| `view_widget_tickets` | Show the ticket widgets on the dashboard. |
| `view_departments` | Declared but not checked anywhere; the department screens use `manage_departments`. |

## Integrations & Servers

| Key | What it allows |
| --- | --- |
| `edit_integrations` | The working key for the whole integrations area: control panels, registrars, game panels, server accounts and connection tests. |
| `manage_custom_apis` | Create and edit Custom API integrations — operator-defined outbound HTTP calls, including their destination URL and payload template. |
| `view_integrations`, `create_integrations`, `delete_integrations` | Declared but not checked anywhere; everything runs on `edit_integrations`. |

> **Warning:** Treat `manage_custom_apis` as a high-trust permission. Whoever holds it chooses where an outbound call goes and what it contains, which means they can direct customer data and service credentials at a server of their choosing. RackHelm deliberately withholds it from the built-in Administrator role.

## System Settings & Monitoring

| Key | What it allows |
| --- | --- |
| `view_settings` | Gates the `/admin/settings` route, but that route points at a controller method that does not exist, so the key opens nothing today. |
| `edit_company_settings` | Edit company, billing and onboarding settings, mail settings, countries, the spam filter and the import tools. A broad key — grant it deliberately. Note that theme, CAPTCHA, fraud, MFA, password-policy and payment-gateway settings are *not* covered: their controllers add a second check against an undefined capability, so they open for Super Admins only. |
| `edit_support_settings` | Edit the support and ticketing settings. |
| `manage_email_routes` | Manage inbound email routing (**Support → Email Routing**). The spam rules are a separate screen gated on `edit_company_settings`. |
| `view_schedules` | See the system schedule widgets on the dashboard. |
| `manage_schedules` | Edit the scheduled jobs — invoice generation, renewals, suspensions and so on. |
| `view_horizon` | Gates the queue-monitor routes, but the controller behind them adds a second check against an undefined capability, so the screen opens for Super Admins only whatever you grant here. |
| `manage_navigation` | Edit the portal menus. |
| `manage_notifications` | Configure admin notification channels, audiences and subscriptions. |
| `view_notification_logs` | Read the notification delivery log. |
| `manage_site_templates` | Manage the site templates offered when a site is provisioned. |
| `manage_email_templates` | Declared but not checked anywhere today. |

## Content

| Key | What it allows |
| --- | --- |
| `manage_pages` | Create and edit content and legal pages, page groups, redirects and the page builder. |

## Screens with no permission of their own

A few admin screens are checked against capability names that were never added to the permission list. Because an undefined capability is denied for everybody except a Super Admin, those screens are effectively Super Admin only, and no switch in the role editor will open them:

- **Marketing campaigns** — the campaign routes are checked against `manage_campaigns`.
- **Assigning roles to a user account** — checked against `manage_roles`. Editing the roles themselves uses the real `*_roles` keys, but attaching one to a person does not.
- **The queue monitor** — also checked against `manage_roles`, on top of the `view_horizon` key on its routes.
- **The admin dashboard**, the **Theme**, **Captcha Protection**, **Fraud Protection**, **MFA** and **Password Policy** screens, and **Payment Gateways** — all checked against `staff_panel`.

These are whole-screen locks: the check runs in the controller, so typing the URL does not get round it.

Several *sidebar links* are rendered against the same kind of undefined name — `manage_settings`, `manage_orders` and `manage_products` in the admin sidebar, and `staff_panel` on the customer portal's **Admin Panel** link. Links guarded that way, which include **Roles & Permissions**, **Create Order**, **Billing Cycles**, most of **Platform Settings** and the whole **Security** group that holds **Audit Logs**, appear only for Super Admins. Where the page behind the link has a real permission of its own — Roles & Permissions and Audit Logs both do — staff holding that permission can still reach it by typing the URL.