Client portal permissions

Portal permissions are held by portal roles. They are separate from console permissions: no portal role can hold a console permission, and no console role can hold a portal one. Self-service pages, such as a person’s own sign-in settings and notification choices, need no permission.

Portal permissions

Area	Permission	Code	Allows	Includes
Billing	View invoices and payments	portal:invoices:read	See invoices, payments, statements, and receipts.
Billing	Pay invoices	portal:invoices:pay	Pay an invoice with a saved or new payment method.	View invoices and payments
Billing	Manage payment methods	portal:payment_methods:manage	Add and remove saved cards and bank accounts.	View invoices and payments
Billing	Manage autopay	portal:autopay:manage	Turn automatic payment on or off and choose the method it uses.	Manage payment methods, View invoices and payments
Billing	View the next bill estimate	portal:estimate:read	See the estimate of the next invoice and what is counted in it.
Quotes and projects	View quotes	portal:quotes:read	See quotes you have sent.
Quotes and projects	Accept and decline quotes	portal:quotes:approve	Sign a quote on the organization’s behalf, or decline it.	View quotes
Quotes and projects	View projects	portal:projects:read	See project status and milestones.
Quotes and projects	Accept milestones	portal:projects:accept	Sign off a project milestone on the organization’s behalf.	View projects
Approvals	View approvals	portal:approvals:read	See approval requests and their outcomes.
Approvals	Respond to approvals	portal:approvals:respond	Approve or decline a request routed to this person or their role.	View approvals
Tickets	View own tickets	portal:tickets:read_own	See tickets this person opened or is copied on.
Tickets	View all tickets	portal:tickets:read_all	See every ticket for the organization.	View own tickets
Tickets	Open tickets	portal:tickets:create	Open tickets and reply to them.	View own tickets
Assets and reports	View assets	portal:assets:read	See devices with warranty and age.
Assets and reports	View reports	portal:reports:read	Run and download the organization’s reports.
Assets and reports	Schedule reports	portal:reports:schedule	Have reports emailed on a schedule.	View reports
Requests	View requests	portal:requests:read	See onboarding and offboarding requests.
Requests	Request onboarding	portal:requests:onboard	Ask you to set up a new employee.	View requests
Requests	Request offboarding	portal:requests:offboard	Ask you to remove an employee.	View requests
Users	View users	portal:users:read	See who has portal access and their roles.
Users	Manage users and roles	portal:users:manage	Invite people, change their roles and groups, and remove them.	View users
Remote access	Use remote access	portal:remote:use	Connect to devices this person has been granted.
Remote access	Grant remote access	portal:remote:grant	Give people remote access to devices, within your limits.	View users
Audit	View the audit log	portal:audit:read	See what your team and the client’s portal users did in this organization.
Audit	Export the audit log	portal:audit:export	Download the audit log with its hashes for offline verification.	View the audit log

Tickets the portal never shows, even with View all tickets: tickets with no requester, such as alerts, compliance findings, and project tasks your team files for itself.

Ready-made roles

Role	Holds
Owner	Every portal permission the ceiling allows. Cannot be edited.
Billing	Pay invoices, Manage payment methods, Manage autopay, View the next bill estimate, View quotes, and what they include.
Approver	Accept and decline quotes, Accept milestones, Respond to approvals, and what they include.
IT contact	View all tickets, Open tickets, View assets, Use remote access, Request onboarding, Request offboarding, View reports, and what they include.
Read only	Every read permission: invoices, the estimate, quotes, projects, approvals, all tickets, assets, reports, requests, users, and the audit log.

Console permissions

These console permissions control the portal from your side. Every console role that holds client:manage is given all six.

Code	Allows
clientportal:read	See a client’s portal settings, users, roles, requests, and approvals, and Settings > Client portal.
clientportal:manage	Turn a client’s portal on or off; set the permission ceiling, SSO, directory sync, audit naming, Teams, and the portal defaults.
clientportal:users	Invite, suspend, and offboard portal users; edit portal roles and groups; start, complete, and cancel requests.
clientportal:remote	Set a client’s remote access ceiling, and grant and revoke remote access.
clientportal:branding	Edit your portal branding and a client’s override.
clientportal:domains	Add, re-check, and remove custom domains.

Raising an approval about a ticket needs ticket:write; about a project, milestone, or change order, project:write; about a quote, psa:write. A general approval needs clientportal:manage. See Ask a client to approve something.

Related

• Set portal roles, groups, and the permission ceiling
• Roles and permissions