Skip to main content

Read-Only Roles

Grant view-only access to team members without allowing modifications.

Overview​

Read-only roles provide a way to give team members access to view all data and reports without the ability to modify anything. This is useful for preview access, auditing, and scenarios where you want to share insights with stakeholders who should not make changes.

The platform supports two read-only role variants:

  • Read-Only Member — View-only version of the Member role
  • Read-Only Admin — View-only version of the Admin role

Use Cases​

Auditing & Compliance​

Allow auditors or compliance officers to review all scans, reports, and organizational data without the ability to make changes.

Stakeholder Access​

Share reports and analysis results with team members, clients, or external parties in a read-only mode to prevent unintended modifications while maintaining visibility.

Training & Onboarding​

Safely demonstrate platform features and data to new team members while preventing accidental changes during their learning period.

Available Read-Only Roles​

Read-Only Member​

Equivalent to: Member role (view-only version)

Permissions:

  • View all scans and reports
  • View vendor reviews and findings
  • Cannot submit repositories for analysis
  • Cannot schedule scans
  • Cannot modify any settings
  • Cannot access API keys
  • Cannot manage team members
  • Cannot access the Settings page or read administrative configuration

Best For: Team members who need to review scan results but should not submit new analyses or make changes.

Read-Only Admin​

Equivalent to: Admin role (view-only version)

Permissions:

  • Full view access to all scans, reports, and data
  • View all organization settings
  • View team members and their roles
  • View API keys (list only, cannot create or revoke)
  • View sub-organization configurations
  • View billing and plan information (cannot modify)
  • Cannot submit repositories for analysis
  • Cannot schedule scans
  • Cannot invite or manage team members
  • Cannot modify any settings, branding, security policies, or API keys
  • Cannot change subscription or billing settings

Best For: Administrators, auditors, or stakeholders who need full visibility into the organization but should not make any modifications.

Permission Reference​

This table compares all four roles and their available operations:

OperationMemberAdminRead-Only MemberRead-Only Admin
View scans and reports✓✓✓✓
View team members✗✓✗✓
View API keys list✗✓✗✓
Submit repositories✓✓✗✗
Schedule scans✓✓✗✗
Re-scan repositories✓✓✗✗
Create vendors and operate reviews✓✓✗✗
Edit questions, responses, and findings✓✓✗✗
Invite team members✗✓✗✗
Manage team member roles✗✓✗✗
Remove team members✗✓✗✗
Access Settings page✗✓✗✓ (view only)
Modify branding✗✓✗✗
Configure API keys✗✓✗✗
Modify security policies✗✓✗✗
Change subscription/billing✗✓✗✗
Manage sub-organizations✗✓✗✗

The same roles apply independently in each sub-organization. A child admin does not gain parent account or billing access. Parent-governed vendor settings remain read-only for child admins unless delegated.

Assigning Read-Only Roles​

Read-only roles are assigned during team member invitation or by changing an existing member's role.

During Invitation​

When inviting a new team member:

  1. On the Team Members card in Settings, fill in the email address
  2. Click the Role dropdown
  3. Select Read-Only Member or Read-Only Admin
  4. Click Invite to send the invitation

The invited person will receive an invitation email and can accept to join with the read-only role.

Changing an Existing Member's Role​

To convert an existing full member to a read-only role:

  1. On the Team Members table in Settings, locate the team member
  2. Click the Role dropdown in the member's row
  3. Select Read-Only Member or Read-Only Admin
  4. The role updates immediately

User Interface for Read-Only Roles​

When logged in with a read-only role, you will notice:

  • Disabled Input Fields: Any form fields for making changes (e.g., inviting members, creating API keys) are disabled (grayed out)
  • Hidden or Disabled Buttons: Action buttons that would make changes (e.g., "Invite", "Create API Key", "Submit Repository") are disabled or hidden
  • View-Only Settings: The Settings page displays all configuration options but prevents modifications
  • No Edit Options: Report editing, scan scheduling, and other modification features are not available
  • All data and reports remain fully visible and accessible for review

API Behavior​

The REST API enforces read-only restrictions at the request level. Read-only users will receive a 403 Forbidden response if they attempt to:

  • Submit repositories (POST /api/v1/repos/analyze)
  • Modify scans or reports (any write operations)
  • Invite team members (POST /api/v1/settings/users)
  • Manage API keys (POST /api/v1/settings/api-keys)
  • Modify any settings or configurations

Read operations (GET requests) remain fully available for read-only users, allowing access to all data and reports.

Best Practices​

Security​

  • Use Read-Only Member for regular users who only need to view results
  • Use Read-Only Admin for auditors, compliance officers, or external stakeholders needing full visibility
  • Regularly review team members with read-only roles to ensure they're still needed
  • Combine read-only roles with shared reports to provide temporary access to specific reports

Organization Management​

  • Assign read-only roles to new team members during their onboarding period
  • Clearly communicate to read-only members that they cannot make changes
  • Document the purpose of each read-only member (audit, stakeholder access, onboarding, etc.)
  • Review read-only member assignments periodically to ensure they're still appropriate

Troubleshooting​

Read-Only User Receives "Permission Denied" Error​

This is expected behavior. Read-only users cannot perform any write operations (creating, modifying, or deleting data). If a read-only user needs to perform an action:

  1. Contact your organization administrator
  2. Request an upgrade to a full Member or Admin role
  3. Or, request that an admin perform the operation on your behalf

Form Fields Are Grayed Out​

This is the correct behavior for read-only users. All fields that would modify data are disabled to prevent accidental changes. To enable these fields, upgrade to a full Member or Admin role.

Cannot Create API Keys as Read-Only Admin​

API key creation is a write operation, so read-only users (including read-only admins) cannot create new keys. Only full admin users can manage API keys. If you need to create API keys:

  1. Contact your organization administrator
  2. Request that they create the API key for you
  3. Or request an upgrade to a full Admin role

Settings Page Shows "Read-Only" Message​

Read-only users can view the Settings page but cannot modify any configurations. To make changes:

  1. Contact your organization administrator
  2. Request an upgrade to a full Admin role
  3. Or request that an admin make the necessary changes

Next Steps​