This document contains a list of each unique resource type, with a description of each, and the permissions available for that resource.
Each resource type has up to three permissions available, which specify the actions that can be taken by the member for that resource. The acronym CRUD in the table below stands for Create, Read, Update and Delete permissions. Edit permissions include view permissions, and admin permissions include edit permissions.
See Permissions for how to configure these for your team.
|Resource||Description||View Permission||Edit Permission||Admin Permission|
|API authentication controls||Used to authenticate your requests to the Atomic API||List credentials||CRUD||n/a|
|Analytics exporter||Access to view real-time analytics and download batched analytics sets||Download & view analytics||n/a||n/a|
|Audit log||Log of workbench members’ actions within your organization |
|View own audit log entries||n/a||View others' audit log entries|
|Card instance||An instance of a card template sent to a customer||View log and analytics||Send cards from workbench||Cancel sent cards (preview feature)|
|Card template||Used to view, send, edit and publish card templates||View card templates and media, send test cards||Edit draft card templates and media||Publish and archive card templates|
|Connectors||Configuration for incoming webhook connectors||View||CRUD||n/a|
|Container||Configures card streams within your app||View||CRUD||n/a|
|Customer||A user of your web and mobile applications||n/a||n/a||CRUD|
|Environment||Each environment within an organization is a separate space, with separate configuration||View environment name||Create and edit name||Deactivate and edit custom fields|
|Notifications||Push notification configuration details for each SDK platform||View config details||CRUD||n/a|
|Organization||Atomic customers are typically given one organization. Each organization contains multiple environments |
|View name and preferences||Edit name and preferences||n/a|
|Override card approval||Enables a member to approve on behalf of any approval group||n/a||n/a||Approve on behalf of any approval group|
|Request debugger||Log of the last 100 failed client API requests |
|Role||An identity with specific permissions. A role can be assigned to 1 or more groups, giving a set of permissions to all members of that group |
|View all roles and their permissions||Create and edit roles||n/a|
|SDK API key||Needed for SDK integrations, and to configure allowed JWT issuers||View API key||CRUD||n/a|
|Segment||Subset of customers with common characteristics||View which filters are applied||Create and edit segments||n/a|
|Stream||A collection of cards which can be assigned to 1 or more stream containers in your apps||View||CRUD||n/a|
|Tag||Tags are available when filtering customers||View||CRUD (inc user tags)||n/a|
|Theme||Theming configuration for stream containers||View||CRUD||n/a|
|Webhook credentials||Authentication credentials for webhook requests||View||CRUD||n/a|
|Webhook request log||Status and metadata for outgoing webhook requests||View metadata||n/a||n/a|
|Webhook subscription||Requests made from Atomic to external services||View||CRUD||n/a|
|Workbench member||A member of the workbench |
|Workbench member group||Controls workbench member groups and their associated roles |
|Workbench member group assignment||Controls assignment of workbench members to groups |
Example permission sets
People who only need to approve cards can be given a view permission on the card template resource - no other permissions are needed.
People who need access to the insights dashboard need view permissions on the card instance as well as the card template resources.
Organization-scoped workbench resources
Some resources are scoped to the organization level as opposed to the environment level. This means that permissions to these resources can't be limited to an environment.
These resources are:
- audit log
- request debugger
- workbench member
- workbench member group
- workbench member group assignment
See the Scoping of resources section for a further explanation and a worked example of how to create a group with environment-level scoped resource permissions as well as organization-level scoped resource permissions.
Permissions for default roles
By default your Atomic account comes with three groups: Owner, Admin, and Editor.
This table describes the default permissions each of these roles has:
|API authentication controls||Edit||Edit|
|Override card approval||Admin||Admin||n/a|
|SDK API key||Edit||Edit|
|Webhook request log||View||View|
|Workbench member group||Edit||Edit|
|Workbench member group assignment||Edit||Edit|