14.3Roles and permissions
A team has two roles: owner and member.
- An owner can do everything a member can. An owner can also read the audit log and change the team's alert defaults.
- In the team window, the owner role is shown as the admin role. Anyone with an admin role there is an owner in obsrvly.
- Everyone else is a member.
- The person who creates the team is an owner.
| You can… | Owner | Member |
|---|---|---|
| Create, edit, pause and delete monitors | Yes | Yes |
| Manage alert channels, secrets, maintenance windows and the status page | Yes | Yes |
| Create and revoke API keys | Yes | Yes |
| Acknowledge incidents | Yes | Yes |
| Open billing → plans | Yes | Yes |
| Change the team's alert defaults (9.4) | Yes | No |
| Read the audit log (14.5) | Yes | No |
| Delete deploy markers (3.8) | Yes | No |
| Get plan-limit warning emails | Yes | No |
Change someone's role#
- Select billing, then team.
- In the members list, change the person's role.
The audit log shows "changed the role of member" with their email, for example role owner → member.
What members see#
- On alerting → thresholds, owners see edit team defaults. Members see "Only a team owner can change the team's defaults." Alerts for every monitor still follow your alert policy (chapter 9).
- On billing → audit log, members see "Only a team owner can read the audit log".
Roles and API keys#
An API key is never an owner, even if an owner created it. These calls need an owner who is signed in to the dashboard:
| Task | Dashboard | API |
|---|---|---|
| Read the audit log | Owners | ListAuditEvents, owner's signed-in session only |
| Change team alert defaults | Owners | SetTeamAlertPolicy, owner's signed-in session only |
With a key, or as a member, these calls fail with permission_denied. The messages are "only a team owner can read its audit log" and "only a team owner can change its paging defaults". To check through the API whether you may change the defaults, see chapter 13.