Extra permissions for team members
Grant an accountant, approver or viewer specific rights beyond their role without making them an admin.
Roles cover the common cases. When one person needs a single extra right, for example an accountant who manages API keys, add a permission override instead of changing the role.
Available permissions
| Permission | Allows |
|---|---|
| Delete invoices | Delete draft invoices and documents |
| Edit accepted incoming invoices | Change data on an incoming invoice after it was accepted |
| Reopen filed VAT returns | Reopen a filed VAT return, with a reason. Owners and admins always can |
| Manage API keys | Create and revoke keys and see the request log on the API access page |
| Manage webhooks | Create, pause and retry webhooks on the API access page |
Steps
- Go to Settings → Team. You need the owner or admin role.
- In the Team Members table, find the Permissions column. Owners and admins show "all"; other members show a button such as "none extra" or "2 extra".
- Click the button. A panel opens with one switch per permission and a note "Extra rights for
beyond the role". - Switch a permission on or off. It saves immediately.
Section access
In the same panel, Section access sets what an accountant, approver or viewer sees in four areas: Incoming invoices, Contacts, Payments and bank and VAT returns.
- Edit: see and change (the accountant default).
- View: see only (the approver and viewer default; they cannot be given Edit).
- None: the menu entry disappears, the pages show "No access", and payment cards are hidden on invoices.
The database enforces it, so the data is not readable through any other screen either. Owners and admins always see everything.
Good to know
- If you use two-factor login, changing a member's role or permissions, or removing a member, asks for a fresh code from your authenticator app. See Two-factor login.
- The switches add rights; section access only reduces what the role allows.
- Issued (submitted or reported) invoices can never be deleted, whatever the permission. They are corrected with credit or debit notes.
- Without "Manage API keys", the API access page shows "Only owners, admins and members with the API keys permission can see keys".
- Permissions are per organization. A CA firm member acting for a client uses the rights they have in that client organization.
- Changing the role to admin makes all overrides irrelevant, since admins have every permission.