HookDeploy uses role-based access control. Each organization member has one role, and each role grants a set of permissions.

Roles

The org owner is always super_admin. Other members are assigned a role on invite.

Permissions

16 permissions, grouped by domain:

Organization

• org.manage — Edit org settings (name, slug)
• org.transfer_ownership — Transfer org to another member

Members

• members.invite — Send invitations
• members.remove — Remove members
• members.change_role — Change member roles

Endpoints

• endpoints.create — Create new endpoints
• endpoints.edit — Edit name, description, forward URL, pause state
• endpoints.delete — Delete endpoints and their requests
• endpoints.view — View endpoint list and details

Requests

• requests.replay — Replay captured requests
• requests.delete — Delete individual requests

Billing

• billing.view — View plan and usage
• billing.update_payment — Update payment method via Stripe Portal
• billing.change_plan — Upgrade, downgrade, cancel

Other

• api_keys.manage — Create and revoke API keys
• audit.view — View audit log

Permission matrix

Role selection guide

Developer — Default for engineers integrating webhooks. Can create endpoints, inspect requests, and replay. Cannot delete endpoints, manage members, or access billing.

Viewer — For PMs, QA, or support staff who need to inspect webhook payloads and replay events but shouldn’t create or modify endpoints.

Admin — For team leads. Everything except ownership transfer. Can manage members, billing, and API keys.

Finance — For accounting or ops teams who manage the subscription but don’t need endpoint access.

Super Admin — Org owner only. One per org (the owner). Can transfer ownership.

How permissions are enforced

Frontend — UI elements are hidden based on the current user’s permissions for the active org. Route guards use <PermissionRequired permission="x"> wrappers.

Database — Row Level Security policies on every table check organization membership and permissions via helper functions:

-- Example: only permitted users can insert endpoints
create policy "permitted_users_insert_endpoints" on public.endpoints for insert
  with check (
    public.user_has_permission(organization_id, 'endpoints.create')
  );

API — API keys are scoped to an organization. The key inherits the permissions of the user who created it (future: role-scoped keys).

Checking permissions in the dashboard

Your effective permissions load on app mount alongside your organization list. If a button or action is missing, you likely lack the required permission — ask an admin to adjust your role.

Next steps

• Members — Invite and manage team members
• API keys — Requires api_keys.manage
• Organizations — Org structure overview