---
title: "Client portal permissions"
description: "Every portal permission, what it allows, which permissions it includes, and the console permissions that control the portal from your side."
url: "https://support.outpostplatform.com/client-portal/permissions/"
product: "depot"
type: "reference"
status: "draft"
ai_summary: "MSP plan. The 26 portal permissions by area (Billing, Quotes and projects, Approvals, Tickets, Assets and reports, Requests, Users, Remote access, Audit), with their codes and what they include, the ready-made roles, and the six console permissions clientportal:read, manage, users, remote, branding, domains."
availability:
  plans: ["msp"]
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/client-portal/permissions.md"
license: "CC BY 4.0"
---

# Client portal permissions

Portal permissions are held by portal roles. They are separate from console
permissions: no portal role can hold a console permission, and no console role
can hold a portal one. Self-service pages, such as a person's own sign-in
settings and notification choices, need no permission.

## Portal permissions

| Area | Permission | Code | Allows | Includes |
| --- | --- | --- | --- | --- |
| Billing | **View invoices and payments** | `portal:invoices:read` | See invoices, payments, statements, and receipts. | |
| Billing | **Pay invoices** | `portal:invoices:pay` | Pay an invoice with a saved or new payment method. | View invoices and payments |
| Billing | **Manage payment methods** | `portal:payment_methods:manage` | Add and remove saved cards and bank accounts. | View invoices and payments |
| Billing | **Manage autopay** | `portal:autopay:manage` | Turn automatic payment on or off and choose the method it uses. | Manage payment methods, View invoices and payments |
| Billing | **View the next bill estimate** | `portal:estimate:read` | See the estimate of the next invoice and what is counted in it. | |
| Quotes and projects | **View quotes** | `portal:quotes:read` | See quotes you have sent. | |
| Quotes and projects | **Accept and decline quotes** | `portal:quotes:approve` | Sign a quote on the organization's behalf, or decline it. | View quotes |
| Quotes and projects | **View projects** | `portal:projects:read` | See project status and milestones. | |
| Quotes and projects | **Accept milestones** | `portal:projects:accept` | Sign off a project milestone on the organization's behalf. | View projects |
| Approvals | **View approvals** | `portal:approvals:read` | See approval requests and their outcomes. | |
| Approvals | **Respond to approvals** | `portal:approvals:respond` | Approve or decline a request routed to this person or their role. | View approvals |
| Tickets | **View own tickets** | `portal:tickets:read_own` | See tickets this person opened or is copied on. | |
| Tickets | **View all tickets** | `portal:tickets:read_all` | See every ticket for the organization. | View own tickets |
| Tickets | **Open tickets** | `portal:tickets:create` | Open tickets and reply to them. | View own tickets |
| Assets and reports | **View assets** | `portal:assets:read` | See devices with warranty and age. | |
| Assets and reports | **View reports** | `portal:reports:read` | Run and download the organization's reports. | |
| Assets and reports | **Schedule reports** | `portal:reports:schedule` | Have reports emailed on a schedule. | View reports |
| Requests | **View requests** | `portal:requests:read` | See onboarding and offboarding requests. | |
| Requests | **Request onboarding** | `portal:requests:onboard` | Ask you to set up a new employee. | View requests |
| Requests | **Request offboarding** | `portal:requests:offboard` | Ask you to remove an employee. | View requests |
| Users | **View users** | `portal:users:read` | See who has portal access and their roles. | |
| Users | **Manage users and roles** | `portal:users:manage` | Invite people, change their roles and groups, and remove them. | View users |
| Remote access | **Use remote access** | `portal:remote:use` | Connect to devices this person has been granted. | |
| Remote access | **Grant remote access** | `portal:remote:grant` | Give people remote access to devices, within your limits. | View users |
| Audit | **View the audit log** | `portal:audit:read` | See what your team and the client's portal users did in this organization. | |
| Audit | **Export the audit log** | `portal:audit:export` | Download the audit log with its hashes for offline verification. | View the audit log |

Tickets the portal never shows, even with **View all tickets**: tickets with
no requester, such as alerts, compliance findings, and project tasks your team
files for itself.

## Ready-made roles

| Role | Holds |
| --- | --- |
| **Owner** | Every portal permission the ceiling allows. Cannot be edited. |
| **Billing** | Pay invoices, Manage payment methods, Manage autopay, View the next bill estimate, View quotes, and what they include. |
| **Approver** | Accept and decline quotes, Accept milestones, Respond to approvals, and what they include. |
| **IT contact** | View all tickets, Open tickets, View assets, Use remote access, Request onboarding, Request offboarding, View reports, and what they include. |
| **Read only** | Every read permission: invoices, the estimate, quotes, projects, approvals, all tickets, assets, reports, requests, users, and the audit log. |

## Console permissions

These console permissions control the portal from your side. Every console
role that holds `client:manage` is given all six.

| Code | Allows |
| --- | --- |
| `clientportal:read` | See a client's portal settings, users, roles, requests, and approvals, and **Settings** > **Client portal**. |
| `clientportal:manage` | Turn a client's portal on or off; set the permission ceiling, SSO, directory sync, audit naming, Teams, and the portal defaults. |
| `clientportal:users` | Invite, suspend, and offboard portal users; edit portal roles and groups; start, complete, and cancel requests. |
| `clientportal:remote` | Set a client's remote access ceiling, and grant and revoke remote access. |
| `clientportal:branding` | Edit your portal branding and a client's override. |
| `clientportal:domains` | Add, re-check, and remove custom domains. |

Raising an approval about a ticket needs `ticket:write`; about a project,
milestone, or change order, `project:write`; about a quote, `psa:write`. A
general approval needs `clientportal:manage`. See
[Ask a client to approve something](/client-portal/approvals/).

## Related

- [Set portal roles, groups, and the permission ceiling](/client-portal/roles-and-ceiling/)
- [Roles and permissions](/depot/roles-and-permissions/)