> For the complete documentation index, see [llms.txt](https://docs.replicacyber.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.replicacyber.com/admin-guide/user-management/roles-and-permissions.md). # Roles and Permissions Replica uses role-based access control. Assign one or more roles to each user to define their access. Users inherit the combined permissions of all assigned roles. ## Roles Overview | Role | Description | | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin | A set of administrative permissions for overseeing Replica and its users, granting management of all created resources across the platform, regardless of assignment | | API | A set of permissions for creating and managing personal API keys and Replica Jobs | | Audit | A set of permissions for access to audit, log, and monitoring data | | Copy Paste | A set of permissions that grant access to Replica Clipboard and copy/paste into and out of the secure environments | | Core | The standard set of permissions for a typical Replica user | | File Transfer | A set of permissions that allow file transfers into and out of the secure environments | | Guest | Limited access to interact with existing VEs only | | Integration Admin | An administrative set of permissions granting access to manage system integrations | | Isolation | A limited set of permissions to trigger a VE creation and launch it | ## Permissions

Permission	Admin	API	Audit	Copy Paste	Core	File Transfer	Guest	Integration Admin	Isolation
`account_read` Allows the viewing of your account details	X	X	X		X		X		X
`account_update` Allows the updating of your account details	X	X	X		X		X		X
`all_customer_data_modify` Allows Visibility and Modifiability of all customer visible resources	X
`api_key_create` Allows creation of personal API Keys		X
`api_key_read` Allows viewing of personal API Keys		X
`api_key_revoke` Allows revoking of personal API Keys		X
`api_key_update` Allows updating of personal API Keys		X
`bulk_environment_create` Allows bulk creation of many environments at once
`bulk_environment_status_read` Allows viewing bulk environments statuses
`enclave_assign` Allows the assignment or reassignment of an enclave					X
`enclave_create` Allows the creation of new enclaves					X
`enclave_delete` Allows the deletion of an enclave					X
`enclave_file_delete` Allows deletion of files in an enclave					X
`enclave_file_download` Allows the download of files in an enclave to the users computer						X
`enclave_file_export` Allows the exporting of files in an enclave to other in platform enclaves					X
`enclave_file_upload` Allows the uploading of files from the users computer to an enclave						X
`enclave_files_read` Allows the viewing of files in enclaves					X
`enclave_read` Allows the viewing of enclaves					X
`environment_access_read` Allows the viewing of VE access (who is currently in it or last accessed)					X		X
`environment_assign` Allows the assignment or reassignment of a VE					X
`environment_clipboard_copy` Allows copy from a VE to host computer's clipboard				X			X		X
`environment_clipboard_open` Allows the opening / access to the Replica toolbox's clipboard				X			X		X
`environment_clipboard_paste` Allows paste from a user's host computer's clipboard into a VE				X			X		X
`environment_clone` Allows the cloning of VEs					X
`environment_create` Allows the creation of a VE					X
`environment_credentials_read` Allows the viewing the admin credentials for a VE					X		X
`environment_delete` Allows the deletion of a VE					X
`environment_details_read` Allows the viewing of a VEs details					X		X
`environment_events` Allows access to real time events to and from VEs					X		X		X
`environment_file_delete` Allows the deleting of files from a VE's Files					X	X	X		X
`environment_file_download` Allows the downloading of files from a VE's Files					X	X	X		X
`environment_file_export` Allows the exporting of files from a VE to other in platform environments or enclaves					X		X		X
`environment_file_upload` Allows the uploading of files from the users host computer to a VE's Files					X	X	X		X
`environment_files_read` Allows the reading of VE's Files					X		X		X
`environment_image_update` Allows the in place update of a VE's OS image					X
`environment_isolate` Allows the launching of a VE via the isolated route					X		X		X
`environment_launch` Allows the launching of a VE					X		X		X
`environment_name_update` Allows the naming or renaming a VE					X		X
`environment_network_traffic_read` Allows the viewing of VE's network traffic	X		X
`environment_observe` Allows the observing a running VE					X		X
`environment_phone_number_read` Allows the viewing of a phone number attached to a VE					X		X
`environment_playback_read` Allows the viewing of VE session recordings					X		X
`environment_pool_assign` Allows the assigning of a VE pool					X
`environment_read` Allows the viewing of environments					X		X
`environment_restart` Allows the restarting of a VE					X
`environment_router_read` Allows the viewing of the egress a VE is connected to					X		X
`environment_router_update` Allows the changing of a VE's egress					X		X
`environment_snapshot_restore` Allows the restoring of a VE's state from a previous snapshot					X
`environment_snapshot_take` Allows the snapshotting of a VE's state					X		X
`external_link_assign` Allows the assignment or reassignment of an external link in the admin section	X
`external_link_create` Allows the creation of an external link in the admin section	X
`external_link_delete` Allows the deletion of an external link in the admin section	X
`external_link_navigate` Allows a user to navigate to an external link					X		X
`external_link_read` Allows the viewing of the list of external link resources in the admin section	X
`external_link_update` Allows the updating of an external link in the admin section	X
`global_assignment_modify` Allows assignment of a resource to global	X
`group_assign` Allows the assignment or reassignment of a group to another group (subgroup creation)	X
`group_create` Allows the creation of a group	X
`group_read` Allows the viewing of groups	X
`group_update` Allows the updating of groups	X
`guest_file_request_create` Allows the creation of a file request					X
`guest_file_request_delete` Allows the deletion of a file request					X
`guest_file_request_read` Allows the viewing of file request					X
`guest_file_request_update` Allows the updating of a file request					X
`hardware_device_delete` Allows the deletion of a hardware device	X
`hardware_device_details_read` Allows the viewing of details of a hardware device	X
`hardware_device_read` Allows the viewing of hardware devices	X
`hardware_device_renew` Allows the renewing or recycling of a hardware device	X
`hardware_environment_delete` Allows the deletion of a hardware VEs	X
`hardware_environment_read` Allows the viewing of hardware VEs	X
`hardware_environment_register` Allows the registration of hardware VEs	X
`hardware_pool_create` Allows the creation of a hardware pool	X
`hardware_pool_delete` Allows the deletion of a hardware pool	X
`hardware_pool_details_read` Allows the viewing of a hardware pool's details	X
`hardware_pool_device_read` Allows the viewing of hardware pools' devices	X
`hardware_pool_device_register` Allows the registration of hardware pool's devices	X
`hardware_pool_read` Allows the viewing of hardware pools	X
`image_assign` Allows the assignment or reassignment of images in the image catalog	X
`image_read` Allows the viewing of images in the image catalog	X				X
`integration_create` Allows creation of system level API integrations								X
`integration_read` Allows viewing of system level API integrations								X
`integration_revoke` Allows revoking of system level API integrations								X
`integration_update` Allows updating of system level API integrations								X
`job_assign` Allows the assignment or reassignment of jobs	X	X
`job_create` Allows the creation of jobs	X	X
`job_delete` Allows the deletion of jobs	X	X
`job_read` Allows the viewing of jobs	X	X
`job_update` Allows the updating of jobs	X	X
`notification_read` Allows the viewing of notifications in admin section	X
`notification_receive` Allows the receiving of notifications	X		X		X		X		X
`notification_send` Allows the sending of notifications in the admin section	X
`phone_number_assign` Allows the assignment or reassignment of phone numbers	X
`phone_number_call_forwarding_update` Allows the updating of call forwarding numbers	X				X
`phone_number_name_update` Allows the naming or renaming of a phone number	X				X
`phone_number_read` Allows the viewing of a Phone number attached to a VE					X
`phone_number_sms_read` Allows the viewing of SMS messages					X
`phone_number_sms_send` Allows the sending of SMS messages					X
`phone_number_voice_click_to_call` Allows the click to call feature for a phone number					X
`profile_assign` Allows the assignment or reassignment of a profile					X
`profile_create` Allows the creation of a profile					X
`profile_delete` Allows the deletion of a profile					X
`profile_read` Allows the viewing profiles					X
`profile_update` Allows the updating of profiles					X
`proxy_config_assign` Allows the assignment or reassignment of a proxy configuration	X
`proxy_config_create` Allows the creation of a proxy configuration	X
`proxy_config_delete` Allows the deletion of a proxy configuration	X
`proxy_config_read` Allows the viewing of proxy configurations	X
`replica_logging_access` Allows access to Replica logging	X		X
`replica_monitoring_access` Allows access to Replica monitoring dashboard	X		X
`router_activate` Allows the activation of a router	X
`router_assign` Allows the assignment or reassignment of a router	X
`router_create` Allows the creation of a router	X
`router_deactivate` Allows the deactivation of a router	X
`router_delete` Allows the deletion of a router	X
`router_languages_read` Allows the viewing of languages set for routers	X				X
`router_log_read` Allows the viewing of router logs	X
`router_read` Allows the viewing of routers	X				X		X
`router_update` Allows the updating of routers	X
`sms_device_create` Allows the creation of an SMS device	X
`sms_device_delete` Allows the deletion of an SMS device	X
`sms_device_read` Allows the viewing of SMS devices	X
`sms_device_update` Allows the updating of SMS devices	X
`storage_minio_create` Allows the creation of MinIO storage configurations	X
`storage_minio_delete` Allows the deletion of MinIO storage configurations	X
`storage_s3_create` Allows the creation of S3 storage configurations	X
`storage_s3_delete` Allows the deletion of S3 storage configurations	X
`swagger_read` Allows access to Swagger API documentation	X	X
`task_read` Allows access to Agentic/non-Agentic tasks.	X				X
`telephony_provider_delete` Allows the deletion of a telephony provider	X
`telephony_provider_read` Allows the viewing of telephony providers	X
`telephony_provider_update` Allows the updating of telephony providers	X
`translation_aws_textract_delete` Allows the deletion of an AWS Textract configuration	X
`translation_aws_textract_update` Allows the updating of an AWS Textract configuration	X
`translation_aws_translate_delete` Allows the deletion of an AWS Translate configuration	X
`translation_aws_translate_update` Allows the updating of an AWS Translate configuration	X
`user_create` Allows the creation of a user	X
`user_import` Allows the importing of users	X
`user_otp_update` Allows the updating of a user's OTP settings	X
`user_password_update` Allows the updating of a user's password	X
`user_read` Allows the viewing of users	X
`user_update` Allows the updating of users	X
`zone_assign` Allows the assignment or reassignment of a zone	X
`zone_copy` Allows the copying of a zone	X
`zone_create` Allows the creation of a zone	X
`zone_delete` Allows the deletion of a zone	X
`zone_enabled_update` Allows the enabling or disabling of a zone	X
`zone_name_update` Allows the naming or renaming of a zone	X
`zone_open_access` Allows open access to a zone	X
`zone_read` Allows the viewing of zones					X

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.replicacyber.com/admin-guide/user-management/roles-and-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.