Configuring administrator roles (RBAC)

Administrators are the users of an admin panel of a Strapi application. Administrator accounts and roles are managed with the Role-Based Access Control (RBAC) feature. It is available in the Administration panel section of the Settings sub navigation.

The Administration panel section is divided into 2 sub-sections: Roles and Users (see Managing administrators).

The Roles sub-section of Administration panel displays all created roles for the administrators of your Strapi application.

From this interface, it is possible to:

• create a new administrator role (see Creating a new role),
• delete an administrator role (see Deleting a role),
• or access information regarding an administrator role, and edit it (see Editing a role).

By default, 3 administrator roles are defined for any Strapi application:

• Author: to be able to create and manage their own content.
• Editor: to be able to create content, and manage and publish any content.
• Super Admin: to be able to access all features and settings. This is the role attributed by default to the first administrator at the creation of the Strapi application.

Creating a new role

On the top right side of the Administration panel > Roles interface, an Add new role button is displayed. It allows to create a new role for administrators of your Strapi application.

To create a new role, click on the Add new role button. Clicking on the Add new role button will redirect you to the roles edition interface, where you will be able to edit the role's details and configure its permissions (see Editing a role).

💡 Tip

In the Roles interface, from the table, you can click on the duplicate button to create a new role by duplicating an existing one.

Deleting a role

Administrator roles can be deleted from the Administration panel > Roles interface. However, they can only be deleted once they are no more attributed to any administrator of the Strapi application.

To delete a role:

1. Click on the delete button on the right side of the role's record.
2. In the deletion window, click on the Yes, confirm button to confirm the deletion.

Editing a role

The role edition interface allows to edit the details of an administrator role as well as configure in detail the permissions to all sections of your Strapi application. It is accessible from Administration panel > Roles either after clicking on the edit button on the right side of a role's record, or after clicking on the Add new role button (see Creating a new role).

✋ Caution

It isn't possible to edit the permissions of the Super Admin role. All configurations are in read-only mode.

Editing role's details

The details area of an administrator role editing interface allow to define the name of the role, and to give it a description that should help other administrators understand what the role gives access to.

💡 Tip

In the top right corner, you can see a counter indicating how many administrators have been attributed the role.

To edit a role's details, follow the instructions from the table below:

Role details	Instructions
Name	Write the new name of the role in the textbox.
Description	Write the description of the role in the textbox.

Configuring role's permissions

The permissions area of an administrator role editing interface allows to configure in detail what actions an administrator can do for any part of the Strapi application. It is displayed as a table, split into 4 categories: Collection types, Single types, Plugins and Settings.

Collection and Single types

The Collection types and Single types categories respectively list all available collection and single types for the Strapi application. For each content-type, the administrators can have the permission to perform the following actions: create, read, update, delete and publish.

To configure Collection or Single types permissions for a role:

1. Go to the Collection types or Single types category of the permissions table.
2. Tick the box on the left of the name of the content-type to give access to. By default, all actions can be performed for all fields of the content-type.
3. (optional) Untick the action-related boxes to prevent actions of your choice.
4. (optional) Click the name of the content-type to display its full list of fields. Untick the field and action-related boxes to prevent access and/or action for the fields of your choice. If the Internationalization plugin is installed, define also what permissions should be granted for each available locale.
5. Repeat steps 2 to 4 for each content-type available to which the role should give access.
6. Click on the Save button on the top right corner.

Plugins and Settings

The Plugins and Settings categories both display a sub-category per available plugin or setting of the Strapi application. Each sub-category contains its own specific set of permissions.

To configure plugins or settings permissions for a role:

1. Go to the Plugins or Settings category of the permissions table.
2. Click on the name of the sub-category which permissions to configure, to display all available permissions.
3. Tick the boxes of the permissions the role should give access to. You can refer to the table below for more information and instructions.

Plugins

By default, plugins permissions can be configured for the Content-type Builder, the Upload (i.e. Media Library) plugin, the Content Manager, and Users Permissions (i.e. the Users & Permissions plugin allowing to manage end users). Each plugin has its own specific set of permissions.

Plugin name	Permissions
Content-Releases (Releases)	General "Read" - gives access to the Releases feature "Create" - allows to create releases "Edit" - allows to edit releases "Delete" - allows to delete releases "Publish" - allows to publish releases "Remove an entry from a release" "Add an entry to a release"
Content-Manager	Single types "Configure view" - allows to configure the edit view of a single type Collection types "Configure view" - allows to configure the edit view of a collection type Components "Configure Layout" - allows to configure the layout of a component
Content-Type-Builder	General "Read" - gives access to the Content-type Builder plugin in read-only mode
Upload (Media Library)	General "Access the Media Library" - gives access to the Media Library plugin Assets "Create (upload)" - allows to upload media files "Update (crop, details, replace) + delete" - allows to edit uploaded media files "Download" - allows to download uploaded media files "Copy link" - allows to copy the link of an uploaded media file
Users-Permissions	Roles "Create" - allows to create end-user roles "Read" - allows to see created end-user roles "Update" - allows to edit end-user roles "Delete" - allows to delete end-user roles Providers "Read" - allows to see providers "Edit" - allows to edit providers Email Templates "Read" - allows to access the email templates "Edit" - allows to edit email templates Advanced settings "Read" - allows to access the advanced settings of the Users & Permissions plugin "Edit" - allows to edit advanced settings 👉 Path reminder to the Users & Permissions plugin: General > Settings > Users & Permissions plugin

Settings

Settings permissions can be configured for all settings accessible from General > Settings from the main navigation of the admin panel: Media Library and Webhooks (Global settings section) and Users & Roles (Administration panel section, to configure the settings of the RBAC feature). Settings permissions also allow to configure access to the Plugins and Marketplace sections of the admin panel. Each setting has its own specific set of permissions.

Setting name	Permissions
API Tokens	API tokens "Access the API tokens settings page" - toggles access to the API tokens page General "Create (generate)" - allows the creation of API tokens "Read" - allows you to see created API tokens (disabling this permission will disable access to the Global Settings - API Tokens settings) "Update" - allows editing of API tokens "Delete (revoke)" - allows deletion of API tokens "Regenerate" - allows regeneration of the API token 👉 Path reminder to API Tokens settings: General > Settings > Global Settings - API Tokens
Transfer Tokens	Transfer tokens "Access the Transfer tokens settings page" - toggles access to the Transfer tokens page General "Create (generate)" - allows the creation of Transfer tokens "Read" - allows you to see created Transfer tokens (disabling this permission will disable access to the Global Settings - Transfer Tokens settings) "Update" - allows editing of Transfer tokens "Delete (revoke)" - allows deletion of Transfer tokens "Regenerate" - allows regeneration of the Transfer token 👉 Path reminder to Transfer Tokens settings: General > Settings > Global Settings - Transfer Tokens
Media Library	General "Access the Media Library settings page" - gives access to Media Library settings 👉 Path reminder to Media Library settings: General > Settings > Global Settings - Media Library
Internationalization	Locales "Create" - allows to create new locales "Read" - allows to see available locales "Update" - allows to edit available locales "Delete" - allows to delete locales 👉 Path reminder to the Internationalization settings: General > Settings > Global Settings - Internationalization
Single sign on Enterprise	Options "Read" - allows to access the SSO settings "Update" - allows to edit the SSO settings 👉 Path reminder to the SSO settings: General > Settings > Global Settings - Single Sign-On
Plugins and Marketplace	Marketplace "Access the Marketplace" - gives access to the Marketplace Plugins "Install (only for dev env)" - allows to install new plugins when in a development environment "Uninstall (only for dev env)" - allows to uninstall plugins when in a development environment
Webhooks	General "Create" - allows to create webhooks "Read" - allows to see created webhooks "Update" - allows to edit webhooks "Delete" - allows to delete webhooks 👉 Path reminder to Webhook settings: General > Settings > Global Settings - Webhook
Users and Roles	Users "Create (invite)" - allows to create administrator accounts "Read" - allows to see existing administrator accounts "Update" - allows to edit administrator accounts "Delete" - allows to delete administrator accounts Roles "Create" - allows to create administrator roles "Read" - allows to see created administrator roles "Update" - allows to edit administrator roles "Delete" - allows to delete administrator roles 👉 Path reminder to the RBAC feature: General > Settings > Administration Panel
Review Workflows Enterprise	"Create" - allows to create workflows "Read" - allows to see created workflows "Update" - allows to edit workflows "Delete" - allows to delete workflows 👉 Path reminder to Review workflows settings: General > Settings > Global Settings - Review workflows

4. Click on the Save button on the top right corner.

Setting custom conditions for permissions

For each permission of each category, a Settings button is displayed. It allows to push the permission configuration further by defining additional conditions for the administrators to be granted the permission. There are 2 default additional conditions:

• the administrator must be the creator,
• the administrator must have the same role as the creator.

✏️ Note

Other custom conditions can be available if they have been created beforehand for your Strapi application (see Role-Based Access Control).

To set custom conditions:

1. Click on the Settings button of the permission already granted for the role.
2. In the Define conditions window, each available permission can be customized with a specific condition. Click on the drop-down list related to the permission you want to customize.
3. Define the custom condition for the chosen permission. You can either:
   • Tick the Default option for all available additional conditions to be applied.
   • Click on the arrow button to see the available additional conditions and tick only the chosen one(s).
4. Click on the Apply button.

💡 Tip

Once a custom condition is set for a permission, a dot is displayed next to the permission's name and the Settings button.

✋ Caution

Custom conditions can only be set for permissions that have been ticked to be granted for the role. If not, when clicking the Settings button, the window that opens will remain empty, as no custom condition option will be available.