User roles and permissions for your data portal
Your data portal has four roles. Three of them, Group member, Manage datasets and Manage group, are given to people within a group, so someone can have a different role in each group. The fourth, Site Admin, applies to the whole site.
Earlier versions of the Data Manager called the group roles Access Data, Manage Data and Manage Group. They work the same way.
The roles build on each other: each one can do everything the role before it can, and more.
The four roles
Section titled “The four roles”- Group member: view, download and use the APIs for the group’s datasets, including private ones. Group member is free.
- Manage datasets: everything Group member can do, plus import, update, edit and delete the group’s datasets and change who can access them. Needs a Paid Seat.
- Manage group: everything Manage datasets can do, plus manage the group’s members and their roles. Needs a Paid Seat.
- Site Admin (shown as Site Administrator in a user’s details): can change site-wide settings and manage all groups, data and sources. A Site Admin doesn’t need to be added to groups. Needs a Paid Seat.
What each role can do
Section titled “What each role can do”The Manage datasets and Manage group columns apply only to the groups where the person has that role.
| Group member | Manage datasets | Manage group | Site Admin | |
|---|---|---|---|---|
| View the group’s datasets, including private ones | Yes | Yes | Yes | Yes |
| Download and export datasets | Yes | Yes | Yes | Yes |
| Create an API key and use the APIs¹ | Yes | Yes | Yes | Yes |
| Import data and update datasets | No | Yes | Yes | Yes |
| Edit dataset details and delete datasets | No | Yes | Yes | Yes |
| Change who can access a dataset | No | Yes | Yes | Yes |
| Make a dataset public | No | If your site allows it² | If your site allows it² | Yes, unless your site turns it off² |
| Add people to the group, and change or remove their roles | No | No | Yes | Yes |
| Delete the group (once it holds no data) | No | No | Yes | Yes |
| Create groups | No | No | No | Yes |
| Invite new users to the site | No | No | No | Yes |
| See all users, block users and make someone a Site Admin | No | No | No | Yes |
| Change site settings and branding, and make the site public or private | No | No | No | Yes |
| Needs a Paid Seat | No | Yes | Yes | Yes |
¹ Only if API access is turned on for your site. An API key can only do what both its scopes and its owner’s permissions allow, so it never has wider access than the person who created it.
² See who can make data public.
Who can make data public
Section titled “Who can make data public”To make a dataset public, a person needs to be able to change who can access the dataset (Manage datasets or higher in its group), and your site’s settings must allow it.
Site Admins choose this in the site’s Public Access settings:
- Allow group administrators to make datasets public turned on: anyone with Manage datasets or Manage group can make their group’s datasets public, or private again, as well as Site Admins.
- Allow group administrators to make datasets public turned off: only Site Admins can make datasets public, or make a public dataset private again.
On a private site there’s also Allow public data access via koordinates.com, even when site is private. When it’s off, nobody can make datasets public. Site Admins can still give access to all registered users of the site.
Someone with Group member can never change who can access a dataset.
How do I give someone a Paid Seat?
Turn on Paid Seat in the person’s details in Users, choose the groups they’ll manage data in, and save. Changing their role in a group to Manage datasets or Manage group also turns on Paid Seat. Your plan includes a set number of Paid Seats, and the details show how many are in use. See Manage Paid Seats.
Does giving someone permission on a single dataset need a Paid Seat?
No. Only the group roles Manage datasets and Manage group, and Site Admin, need a Paid Seat.
How do I free up a Paid Seat?
Turn off Site Administrator if it’s on, then turn off Paid Seat, select Confirm and save. The person stays in their groups, but Manage datasets and Manage group become Group member. See Remove a Paid Seat.
How can I see a list of all Paid Seats?
Use the Paid Seat filter when you find and manage registered users.
Do I have to be a Paid Seat to access privately shared data?
No. Group member is free, and anyone can be given access to private data by a Site Admin, or by someone with Manage datasets or Manage group in the group that holds it.
Can someone have different roles in different groups?
Yes. Roles are set per group, so someone can have Manage datasets in one group and Group member in another.
Can someone with Manage group invite new users to the site?
No. Only Site Admins can invite new users. Someone with Manage group can add people who already have an account on the site to their group.
Who can block a user?
Only Site Admins can block a user.