Roles and permissions

Roles control what each member can do in an organization. A personal account has no roles: you can do everything in it.

Built-in roles

Role	Can do
Owner (one per organization)	Everything, including appointing admins, transferring ownership and deleting the organization
Admin	Everything except owner-only actions: invite and remove members, change roles, manage billing (plan, credit, spending limit), rename the organization and set its billing email
Member	Run actors and work with data (actors, tasks, schedules, webhooks, storage, listening). Sees billing in View only mode but cannot change it

In permission terms, owners and admins always have every permission. The Member preset has every permission except billing.manage, team.manage and listening.verify.

Custom roles

Owners and admins can create up to 50 custom roles per organization.

1. Switch to the organization and open Team → Roles → New role.
2. Enter a Name (up to 60 characters) and tick the Permissions the role grants.
3. Click Create role.

Assign it when you invite someone, or later from the member's role menu. Members with a custom role are still "members", limited to the ticked permissions. Everyone can still see actors, runs and storage.

Change	Effect
Edit a role	Applies at once to everyone holding it, including their organization API tokens
Delete a role	Its members go back to the Member role. Open invitations with that role are cancelled

Permission keys

The catalog is returned by GET /api/v3/permissions (key, label, description, plus the presets).

Key	Label	What it controls
actors.manage	Manage actors	Create, update and delete actors, their versions, environment variables and builds; share actors
runs.start	Start runs	Run actors and tasks (also standby actors)
runs.manage	Manage runs	Abort, resurrect, reboot and metamorph runs
storage.write	Write storage	Create, rename, delete and push to datasets, key-value stores and request queues outside runs
automation.manage	Manage automation	Create, change and delete tasks, schedules and webhooks (also integrations and monitors)
listening.manage	Manage social listening	Projects, sources, campaigns, alerts, collection and share links
listening.view	View social listening	See listening projects, mentions, analytics and exports
listening.verify	Verify mentions	Work the Verify Mentions queue: mark mentions verified or irrelevant, correct sentiment, add notes
billing.view	View billing	See the plan, usage, invoices and transactions (also Earnings)
billing.manage	Manage billing	Change the plan, buy credit, set the spending limit, cancel
team.manage	Manage the team	Invite people and remove members (not admins). Invitations can give at most this role's own permissions; roles stay with the owner and admins
tokens.create	Create API tokens	Create organization API tokens (they carry this role)
proxy.view	Use the proxy	See proxy credentials and rotate the proxy password
support.view	View support tickets	See the account's support tickets and their replies
support.manage	Contact support	Open support tickets, reply to them, close and reopen them

note

These are member permissions inside an organization. They are not the same as the API token permissions, which limit a single token.

Some actions stay with the owner and admins whatever a custom role says: changing roles, creating roles, renaming the organization, setting the billing email and changing general resource access.

When a member lacks a permission, the API answers 403:

403 response

{
  "error": {
    "code": "permission_denied",
    "message": "…",
    "details": { "permission": "billing.manage" }
  }
}

Dashboard menu items a member has no permission for (for example Billing without billing.view) are hidden.

Listening project roles

Inside an organization, each social listening project can also give people a project role:

Project role	Can do
Viewer	See everything in the project: mentions, analytics, creators, campaigns, reports, exports
Analyst	Viewer, plus tag mentions (hide, sentiment, attributes), verify mentions and comment
Manager	Analyst, plus settings, sources, collect now, campaigns, alerts, reports and external sharing. Deleting the project still needs listening.manage

• Owners and admins are managers of every project.
• By default, members see every project, as viewers (with listening.view) or managers (with listening.manage), or with a higher role given on a project.
• To limit members to the projects you choose, owners and admins turn on Restrict listening projects per member on Team. Members then see only the projects they have a role on.
• Give project roles on the project's Access page (/listening/<id>/access): choose Viewer, Analyst, Manager or No access for each team member.

To share one project with someone outside the team, see Walls and sharing.

Activity log

Activity (https://lantfly.com/activity) records every change made in the account from the dashboard and with API tokens: who did it, when, what changed, and how (Via: dashboard, API token, organization token, guest or Lantfly system).

• Owners and admins see everyone's changes. Other members see only their own.
• Filter by member, method, path, date and Via. Filters stay in the page address.
• Changes to actors, schedules, webhooks, tasks, listening projects, notification channels, member roles and custom roles show the old and new values, for example role: member → admin. Secrets and free-text fields are named but their values are not shown.
• Export CSV downloads the filtered rows (up to 10,000).
• Entries are kept for 180 days.
• Runs writing through their own run token are not logged.

Changes to one webhook

curl "https://lantfly.com/api/v3/activity?subject_type=webhook&subject_id=<webhook-id>" \
  -H "Authorization: Bearer $LANTFLY_TOKEN"

Other filters: member, from, to, method (POST, PUT, PATCH, DELETE, EVENT), q, action, via, per_page, and format=csv.