Getting Started
Overview Quickstart
Monitors
Overview Monitor Types Intervals & Probes Advanced Options
Status Pages
Overview Setup Customization Custom Domains Uptime History
Incidents
Overview Managing Incidents Maintenance Windows
Agent
Installation Configuration Upgrading Uninstallation Requirements Troubleshooting
Plugins
Overview Redis MySQL PostgreSQL MongoDB Nginx Apache PHP-FPM Memcached RabbitMQ Elasticsearch Meilisearch Varnish HAProxy Docker VictoriaMetrics mdadm (RAID)
API
Overview Authentication Monitors Incidents Status Pages Errors
RUM & Replay
Overview Quickstart Session Replay Custom Events Error Tracking Troubleshooting
OTLP & Tracing
Overview Distributed Traces Structured Logs Custom Metrics Language SDKs Troubleshooting
Observability Apps
Overview Creating Apps Quota Management Domain Whitelist Top-Up Credits
Alert Manager
Overview Anomaly Detection Alert Channels Thresholds
Teams
Overview Roles & Permissions Invitations Seats & Billing
Billing
Overview Plans & Quotas Top-up Credits Invoices & Portal
Security
Overview Two-Factor Auth API Tokens Sessions

Roles & Permissions

Every team member has exactly one role: owner, admin, member, or viewer. The role is the single source of truth for what that person can do — it is read from the membership record only and is independent of any platform-level admin status.

The four roles

  • Owner — Full control. Manages billing, the team, ownership transfer, and company deletion, in addition to all resources. There is exactly one owner per team.
  • Admin — Manages members and all shared resources, but cannot touch billing, transfer ownership, or delete the company.
  • Member — Manages all shared resources (monitors, servers, status pages, alerts, observability, incidents). Cannot manage members or billing.
  • Viewer — Read-only. Can view all the team's resources but cannot change anything.

Capability matrix

Reads require team membership only — any role, including viewer, can view the team's resources. Mutations require the matching capability.

Capability Owner Admin Member Viewer
View resources (read) ✅ ✅ ✅ ✅
Manage monitors ✅ ✅ ✅ ❌
Manage servers ✅ ✅ ✅ ❌
Manage status pages ✅ ✅ ✅ ❌
Manage alerts ✅ ✅ ✅ ❌
Manage observability ✅ ✅ ✅ ❌
Manage incidents ✅ ✅ ✅ ❌
Manage team (invite / change role / remove member) ✅ ✅ ❌ ❌
Manage billing ✅ ❌ ❌ ❌
Transfer ownership ✅ ❌ ❌ ❌
Delete company ✅ ❌ ❌ ❌

The six resource capabilities — manage_monitors, manage_servers, manage_status_pages, manage_alerts, manage_observability, manage_incidents — are granted as a group to every non-viewer role. Viewer gets none of them.

What each capability allows

  • manage_team — Send invitations, change another member's role, and remove members. Held by owner and admin.
  • manage_billing — View and change the subscription, payment method, and top-ups. Owner only.
  • transfer_ownership — Hand ownership to another existing member. Owner only.
  • delete_company — Delete the team and its resources. Owner only.

Owner protection invariants

The owner is special and is protected by rules enforced at the data layer, not just the UI:

  • The owner cannot be demoted or removed. Role changes and member removal refuse to act on the owner. Ownership only changes through transfer.
  • Exactly one owner per team. teams.owner_id and the owner's membership row are kept in lockstep inside a single transaction during transfer.
  • You cannot change your own role. This is blocked in the team controller regardless of your role.
  • Admins manage members but not the owner. An admin can invite, re-role, and remove members, but cannot affect the owner, billing, or company deletion.
  • The owner cannot simply leave. Attempting to leave as the owner is rejected with a prompt to transfer ownership first. See Invitations for the leave and transfer flows.

Assignable roles

When inviting or re-roling a member, only admin, member, and viewer are assignable. The value owner is never accepted by invite, add-member, or role-change operations — an invalid or owner role silently falls back to member. Becoming owner happens only through ownership transfer.

Next Steps

On this page