Skip to main content
Each backend administrator can be assigned a subset of permissions to limit their access to only the areas they need. Permissions are set per-user from Settings > Curator > Backend Administrators. Some permissions are only visible when certain features or integrations are enabled on your Curator instance. So in case you don’t see the corresponding menu item on the left-hand navigation, it is because you don’t have that feature currently enabled. Each backend page checks its permission whenever it opens, including when an administrator types its URL. An administrator without that permission sees an access denied page.

​
Choosing Permissions

The Permissions section of the backend user form groups the permissions into one card per area, with System first and the other areas in alphabetical order. Each card shows how many of its permissions are checked, for example “2 of 10”, and has Select all and Clear links that change only that card. Type in the Filter permissions box to show only the permissions whose name or area contains the text. The Select all and Clear all links next to it change every permission that is showing, so with a filter applied they leave the hidden permissions as they were. An administrator who is not a superuser sees only the permissions they hold themselves. See Granting Permissions to Other Administrators.
Upgrading from an earlier release: administrators who are not superusers may need permissions added to their accounts after the upgrade.
  • The Backups page needs the new Manage backups permission. Before, any Curator permission opened it.
  • Turning on Data Manager or Integration no longer grants their permissions to every administrator. Check Manage data, Manage data structure, and the Integration permissions on each account that needs them.
  • Pages that used to open for any signed-in administrator now need their permission, for example Manage Curator settings for the Curator settings page and Manage authentication settings for the authentication pages.
  • On the Authentication settings page, only a superuser can change the sign-in method, the SAML and OAuth provider fields, the username attribute or claim, SAML strict mode, and Multi-factor Authentication. Administrators who are not superusers see those fields disabled and can still change the rest of the page.

​
Central Dispatch

​
Content

​
Data Manager

​
Integration

The Scripts and Commands permissions exist on self-hosted Curator only. On Curator SaaS, Manage API relay is the only Integration Automation permission.

​
Security

​
Curator

​
Custom Code Permission

Head Insert, Custom CSS, and Unrestricted HTML run on every page a user opens, so they need Manage custom code in addition to the permission for the area. Without it, an administrator who can edit themes, pages, or the Terms of Service sees these fields locked and the Unrestricted HTML and embed code options hidden, and saving keeps the existing custom code as it was. Turning custom code on or off also needs the permission. The same applies to the JavaScript Snippet of a Tableau dashboard, and the REST API refuses a javascript_snippet sent with an API key. Loading screens show their content as it was saved, so a loading screen with scripts, styles, or other code needs Manage custom code as well as Manage loading screens. See Loading Screens. HTML, JavaScript, CSS, XML, and SVG files also run code when someone opens them, so uploading one to Content > Files needs Manage custom code as well. The same applies to renaming a file to one of these types and to turning Download Only off on a file that holds one. A file with Download Only on is exempt, because Curator always sends it as a download. Without the permission, saving shows “Uploading HTML, JavaScript, CSS, XML or SVG files requires the Manage Custom Code permission.” Upload fields elsewhere in the backend refuse these files too, except SVG images. See Files. When Curator is upgraded to the release that adds this permission, every administrator and role with Manage Curator settings, Manage pages, or Manage terms of service receives it, so nobody loses access they had. The later release that adds the file upload check also gives it to every administrator and role with Manage files, and the release that adds the JavaScript Snippet check gives it to every administrator and role with Manage Tableau dashboards. Remove it from the administrators who should not change custom code.

​
MCP Tokens

MCP tokens need no dedicated permission. Every backend user can generate, edit, and revoke their own tokens from MCP Tokens in the username dropdown. A token can only do what its owner can do, and each MCP tool checks the owner’s permissions when it runs. The MCP tools that change content use the existing permissions: Manage pages for pages, Manage navigation for menu items, Manage files for files, Manage Curator settings for themes, and Manage API keys for REST API keys. Changing a theme’s custom CSS also needs Manage custom code. See MCP.

​
Power BI

​
Sigma

​
Tableau

​
ThoughtSpot

​
Translator

​
User management

​
Granting Permissions to Other Administrators

An administrator who is not a superuser can only grant permissions they hold themselves. The Backend Administrators form lists only those permissions. They can also only manage an administrator whose permissions they all hold, counting the permissions the account gets from its role. To edit, change the password of, delete, restore, or unsuspend an account that holds a permission you do not, ask a superuser or an administrator who holds every permission on that account. Opening such an account sends you back to the list with this error:
Importing backend users follows the same rules. When an administrator who is not a superuser imports backend users, each account keeps its superuser status and role, only the permissions the importer holds change, and accounts the importer cannot manage are not changed. No import brings in password reset or account activation codes.

​
Superuser Accounts

Apart from the permissions on this page, a backend administrator account can be a Superuser, such as the first administrator account created when Curator was installed. A superuser can access every area of the backend, whatever permissions are checked on its account. Superuser accounts are protected. Only another superuser can edit, delete, restore, unsuspend, or reset the password of a superuser account. An administrator who is not a superuser gets this error when trying to change one, even with every permission checked, including Manage backend users:
The Backend Administrators page does not show or change whether an account is a superuser, so checking more permissions will not clear this error. No administrator can change their own superuser status or their own permissions either. To remove a former employee’s superuser account, sign in with another superuser account and delete it from Settings > Curator > Backend Administrators. If nobody in your organization can sign in with a superuser account, contact InterWorks Support.

​
Frontend Accounts of Linked Administrators

When a backend user has Link to frontend user turned on, the frontend account with the same username can sign them in to the backend. Only someone who can manage that backend user can create, rename, change the email or password of, or delete that frontend account. For a linked superuser, that means another superuser. For any other linked administrator, it means a superuser or an administrator with Manage backend users. Manage frontend users alone is not enough, and the save fails with:
The same rule applies to group imports, REST API keys, and the Tableau and ThoughtSpot passwords Curator sets for that user. Users can still change their own password.

​
System