Managing users and roles
What each role may do, how to invite, edit and deactivate users and how driver and portal logins are created.
Per:Amministratore2 min di lettura
In questa pagina
Roles and permissions
Owners and administrators pass every role check; all other roles must be explicitly allowed for an action, otherwise insufficient_role is returned. All signed-in roles can read. Customers, carriers and drivers only see their own data.
| Role | Write permissions (excerpt) | Copilot |
|---|---|---|
| Owner | Everything | All tools |
| Administrator | Everything incl. company, users, API keys, webhooks, integrations, autonomy, driver logins | All tools |
| Dispatcher | Partners, fleet, orders, tours, assignments, documents, emails, rates, quotes, invoices, customs cases, agents, proposals, freight exchange, warehouse (the only role with stock bookings) | All except creating invoices |
| Accounting | Partners, orders, rates, quotes, invoices incl. paid/cancel, accounting export, sanctions status, pallets, documents, agents, proposals | Read + create invoices |
| Customs | Partners, customs cases, sanctions screening, documents, agents, proposals | Read only |
| Read-only | No write access, no uploads | Read only |
| Driver | Own tours, stop reports, position, pallets, uploads | Tours, order, navigation, explanations |
| Customer (portal) | Read/create own orders, accept/reject quotes, uploads | Limited |
| Carrier (portal) | Read/respond to own assignments, uploads | Limited |
Inviting a user
- Settings → users → invite user.
- Enter email, first name, last name (required), role (dispatcher by default), language, phone and optionally a password (at least 8 characters).
- Save. A duplicate email is rejected with
email_taken.
Nota: No invitation email is sent. Without a password, the user cannot sign in until one is set – share the initial password through a secure channel. Driver, customer and carrier cannot be selected here.
Editing, resetting passwords, deactivating
- Edit: role, language, phone. Entering a new password in the optional password field resets it – there is no self-service “forgot password”.
- Deactivate: the user can no longer sign in, audit log references are kept. You cannot deactivate yourself. Reactivate reverses it.
- Sessions: a sign-in is valid for 12 hours, renewal for 30 days. Deactivated users are rejected on their next request (
user_inactive).
Driver and portal logins
- Drivers: fleet → drivers → create login (owner/administrator only): email + password create a user with the driver role, linked to that driver. If the driver already has a login:
driver_already_has_login. - Customer and carrier portal: these logins are created via the API, e.g.
POST /userswith{ "role": "CUSTOMER", "partnerId": "<partner ID>", … }. Without a partner link the portal reportsportal_user_without_partner.
Nota: Platform administrator is not a role but a user flag that can only be set directly in the database – not via the interface.
Articoli correlati
- Setting up your company (tenant)Maintain master data, number ranges, bank details, AI instructions, defaults and branding – plus the recommended setup order.
- Partners and fleetMaintain customers and carriers with contacts, addresses, rates and pallet account, and create vehicles and drivers including driver logins.
- Troubleshooting for administratorsTypical symptoms – from mock mode and missing emails to webhook and sign-in problems – with cause and fix.
- Getting started with LogCon.aiSign in, choose your language and theme, find your way around the navigation and understand what your role is allowed to do.