> ## Documentation Index > Fetch the complete documentation index at: https://docs.curator.interworks.com/llms.txt > Use this file to discover all available pages before exploring further. # Backend Administrator Permissions > Reference for all available backend administrator permissions and what each one controls. Each backend administrator can be assigned a subset of permissions to limit their access to only the areas they need. Permissions are set per-user from **Settings** > **Curator** > **Backend Administrators**. Some permissions are only visible when certain features or integrations are enabled on your Curator instance. So in case you don't see the corresponding menu item on the left-hand navigation, it is because you don't have that feature currently enabled. Each backend page checks its permission whenever it opens, including when an administrator types its URL. An administrator without that permission sees an access denied page. ## Choosing Permissions The **Permissions** section of the backend user form groups the permissions into one card per area, with **System** first and the other areas in alphabetical order. Each card shows how many of its permissions are checked, for example "2 of 10", and has **Select all** and **Clear** links that change only that card. Type in the **Filter permissions** box to show only the permissions whose name or area contains the text. The **Select all** and **Clear all** links next to it change every permission that is showing, so with a filter applied they leave the hidden permissions as they were. An administrator who is not a superuser sees only the permissions they hold themselves. See [Granting Permissions to Other Administrators](#granting-permissions-to-other-administrators). > [!NOTE] > > **Upgrading from an earlier release:** administrators who are not superusers may need permissions added to their > accounts after the upgrade. > > * The Backups page needs the new **Manage backups** permission. Before, any Curator permission opened it. > * Turning on Data Manager or Integration no longer grants their permissions to every administrator. Check **Manage > data**, **Manage data structure**, and the Integration permissions on each account that needs them. > * Pages that used to open for any signed-in administrator now need their permission, for example **Manage Curator > settings** for the Curator settings page and **Manage authentication settings** for the authentication pages. > * On the Authentication settings page, only a superuser can change the sign-in method, the SAML and OAuth provider > fields, the username attribute or claim, SAML strict mode, and Multi-factor Authentication. Administrators who are > not superusers see those fields disabled and can still change the rest of the page. ## Central Dispatch | Permission | Description | | - | - | | **Central Dispatch administrator** | Full access to all Central Dispatch features for managing distributed Curator instances. | | **Managed instance cache** | Manage cache operations across managed Curator instances. | | **Managed instance upgrades** | Manage software upgrades across managed Curator instances. | ## Content | Permission | Description | | - | - | | **Manage external feed** | Configure external data feeds. | | **Manage files** | Upload and manage media files and documents. | | **Manage fonts** | Upload and manage custom fonts. | | **Manage keywords** | Manage searchable keywords and tags. | | **Manage loading screens** | Configure loading screen messages and visuals. | | **Manage navigation** | Configure menus and navigation structure. | | **Manage notices** | Create and manage system-wide notices shown to frontend users. | | **Manage pages** | Create and edit static content pages in the portal. | | **Manage terms of service** | Edit and publish the Terms of Service agreement. | | **Manage tutorials** | Create and manage in-portal tutorial content. | ## Data Manager | Permission | Description | | - | - | | **Manage data** | View, add, edit, and delete Data Manager records. | | **Manage data structure** | Define and modify Data Manager schemas and field definitions. | ## Integration | Permission | Description | | - | - | | **Manage API relay** | Configure the API relay for proxying requests to external APIs. | | **Manage commands** | Create and configure scheduled or event-driven commands. | | **Manage connections** | Configure connections to external services. | | **Manage scripts** | Create and edit integration scripts. | | **Run commands** | Execute commands manually. | | **Run scripts** | Execute integration scripts manually. | The Scripts and Commands permissions exist on self-hosted Curator only. On Curator SaaS, Manage API relay is the only Integration Automation permission. ## Security | Permission | Description | | - | - | | **Manage authentication settings** | Configure authentication settings. Only a superuser can change the sign-in method, the SAML and OAuth provider fields, the username attribute or claim, SAML strict mode, and Multi-factor Authentication, or reset the settings to their defaults. | ## Curator | Permission | Description | | - | - | | **Manage API keys** | Create, view, and revoke API keys for external integrations. | | **Manage backups** | Open the Backups page, and download and restore backups. | | **Manage bad request logging** | Turn the **Log bad requests** switch on the Request Log on or off. | | **Manage Curator settings** | Edit global platform settings, including general configuration, branding, and feature toggles. | | **Manage Curator updates** | View and apply software updates. | | **Manage custom code** | Add and change the Head Insert and Custom CSS of themes, pages, and the Terms of Service, Unrestricted HTML on pages and in the Terms of Service, and the JavaScript Snippet of Tableau dashboards. Save loading screens that contain code. Upload HTML, JavaScript, CSS, XML, and SVG files. See [Custom Code Permission](#custom-code-permission). | | **Manage URL redirects** | Configure URL redirect rules within the portal. | ### Custom Code Permission Head Insert, Custom CSS, and Unrestricted HTML run on every page a user opens, so they need **Manage custom code** in addition to the permission for the area. Without it, an administrator who can edit themes, pages, or the Terms of Service sees these fields locked and the Unrestricted HTML and embed code options hidden, and saving keeps the existing custom code as it was. Turning custom code on or off also needs the permission. The same applies to the **JavaScript Snippet** of a Tableau dashboard, and the REST API refuses a `javascript_snippet` sent with an API key. Loading screens show their content as it was saved, so a loading screen with scripts, styles, or other code needs **Manage custom code** as well as **Manage loading screens**. See [Loading Screens](https://docs.curator.interworks.com/site_content_design/loading_screens/loading_screens.md#custom-code-in-loading-screens). HTML, JavaScript, CSS, XML, and SVG files also run code when someone opens them, so uploading one to **Content** > **Files** needs **Manage custom code** as well. The same applies to renaming a file to one of these types and to turning **Download Only** off on a file that holds one. A file with **Download Only** on is exempt, because Curator always sends it as a download. Without the permission, saving shows "Uploading HTML, JavaScript, CSS, XML or SVG files requires the Manage Custom Code permission." Upload fields elsewhere in the backend refuse these files too, except SVG images. See [Files](https://docs.curator.interworks.com/site_content_design/files/files.md#html-javascript-css-xml-and-svg-files). When Curator is upgraded to the release that adds this permission, every administrator and role with **Manage Curator settings**, **Manage pages**, or **Manage terms of service** receives it, so nobody loses access they had. The later release that adds the file upload check also gives it to every administrator and role with **Manage files**, and the release that adds the JavaScript Snippet check gives it to every administrator and role with **Manage Tableau dashboards**. Remove it from the administrators who should not change custom code. ### MCP Tokens MCP tokens need no dedicated permission. Every backend user can generate, edit, and revoke their own tokens from **MCP Tokens** in the username dropdown. A token can only do what its owner can do, and each MCP tool checks the owner's permissions when it runs. The MCP tools that change content use the existing permissions: **Manage pages** for pages, **Manage navigation** for menu items, **Manage files** for files, **Manage Curator settings** for themes, and **Manage API keys** for REST API keys. Changing a theme's custom CSS also needs **Manage custom code**. See [MCP](https://docs.curator.interworks.com/curator_api/api_docs/mcp.md). ## Power BI | Permission | Description | | - | - | | **Power BI administrator** | Full access to all Power BI integration features, including the Power BI settings page. | ## Sigma | Permission | Description | | - | - | | **Sigma administrator** | Full access to all Sigma integration features. | ## Tableau | Permission | Description | | - | - | | **Manage Tableau dashboards** | Add, edit, and organize Tableau content in the portal. | | **Manage Tableau settings** | Configure the Tableau Server or Tableau Cloud connection. | | **Manage Tableau users** | Manage Tableau user provisioning and portal-to-Tableau user mappings. | | **Tableau status** | View the Tableau server status page. | ## ThoughtSpot | Permission | Description | | - | - | | **Manage ThoughtSpot users** | Manage ThoughtSpot user provisioning and access. | | **ThoughtSpot administrator** | Full access to all ThoughtSpot integration features. | ## Translator | Permission | Description | | - | - | | **Translator administrator** | Full access to all Translator integration features. | ## User management | Permission | Description | | - | - | | **Manage backend users** | Create, edit, and delete backend administrator accounts and their permissions. Required to manage other admins. | | **Manage frontend users** | Create, edit, and delete frontend (end-user) accounts. | | **Manage SAML IdP settings** | Configure SAML IdP settings for single sign-on with Curator or Tableau Server users. | ### Granting Permissions to Other Administrators An administrator who is not a superuser can only grant permissions they hold themselves. The Backend Administrators form lists only those permissions. They can also only manage an administrator whose permissions they all hold, counting the permissions the account gets from its role. To edit, change the password of, delete, restore, or unsuspend an account that holds a permission you do not, ask a superuser or an administrator who holds every permission on that account. Opening such an account sends you back to the list with this error: ```text theme={null} You do not have permission to manage this administrator. ``` Importing backend users follows the same rules. When an administrator who is not a superuser imports backend users, each account keeps its superuser status and role, only the permissions the importer holds change, and accounts the importer cannot manage are not changed. No import brings in password reset or account activation codes. ### Superuser Accounts Apart from the permissions on this page, a backend administrator account can be a **Superuser**, such as the first administrator account created when Curator was installed. A superuser can access every area of the backend, whatever permissions are checked on its account. Superuser accounts are protected. Only another superuser can edit, delete, restore, unsuspend, or reset the password of a superuser account. An administrator who is not a superuser gets this error when trying to change one, even with every permission checked, including **Manage backend users**: ```text theme={null} You do not have permission to manage this administrator. ``` > [!NOTE] > > The Backend Administrators page does not show or change whether an account is a superuser, so checking more > permissions will not clear this error. No administrator can change their own superuser status or their own > permissions either. To remove a former employee's superuser account, sign in with another superuser account and > delete it from **Settings** > **Curator** > **Backend Administrators**. If nobody in your organization can sign in > with a superuser account, contact InterWorks Support. ### Frontend Accounts of Linked Administrators When a backend user has [Link to frontend user](https://docs.curator.interworks.com/site_administration/backend_administrators/overview.md#link-to-frontend-user) turned on, the frontend account with the same username can sign them in to the backend. Only someone who can manage that backend user can create, rename, change the email or password of, or delete that frontend account. For a linked superuser, that means another superuser. For any other linked administrator, it means a superuser or an administrator with **Manage backend users**. **Manage frontend users** alone is not enough, and the save fails with: ```text theme={null} This username belongs to a linked backend administrator. ``` The same rule applies to group imports, REST API keys, and the Tableau and ThoughtSpot passwords Curator sets for that user. Users can still change their own password. ## System | Permission | Description | | - | - | | **Manage backend preferences** | Manage backend preferences and settings like Locale and timezone. | | **Manage mail settings** | Configure outgoing mail server settings. | | **Manage mail templates** | Edit email templates used for system notifications. | | **View system logs** | Access system, event, and error logs, and download the debug and event log diagnostic files. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.