Join us from October 8-10 in New York City to learn the latest tips, trends, and news about GraphQL Federation and API platform engineering.Join us for GraphQL Summit 2024 in NYC
Docs
Start for Free

Members, Roles, and Permissions

Learn which roles have which permissions and how to invite and remove organization members


A organization can have any number of members, and each member can be assigned a role that defines their capabilities within the organization.

Organization-wide member roles

Each organization member has one of the following roles:

NameDescriptionSupported plan types
Org AdminHas management access to the entire organization, including its members, graphs, and configuration.All
Graph AdminHas management access to the organization's graphs, but not to members or organization-level configuration. Intended for developers who are considered admins to the graph.Enterprise only
ContributorCan push new schemas to graphs, but cannot configure graph settings or integrations. Intended for backend developers who are authorized to make changes to graphs. Cannot push schema changes or report metrics for protected variants.Enterprise only
DocumenterHas all permissions of the Observer role, plus the ability to edit graph READMEs, descriptions, and similar non-operational metadata.Enterprise only
ObserverHas view-only access to the organization's graph data, such as schemas and metrics. Can also execute queries in the Explorer. Intended for backend developers who are not authorized to make changes to graphs.Enterprise only
ConsumerHas view-only access to the organization's API schemas, but not supergraph or subgraph schemas, or metrics. Can also execute queries in the Explorer. Intended for application developers building clients against a graph.

This role is available to all plan types. For plans that charge per user, Consumers do not count as billed users.
All
Billing ManagerHas management access to organization-level configuration and billing. Can also remove members (but not invite them). No access to graphs. Learn more.

This role is available to all paid plan types. For plans that charge per user, Billing Managers do not count as billed users.
All paid plan types

Only members with the Org Admin role can assign roles to other members. You can see which role you have in a particular organization from your user settings page, or from the organization's Members tab.

Graph-specific member roles

You can override a member's organization-wide role for individual . For example, if a member has the Observer role in your organization, you can assign them the Contributor role for a that they need extra access to.

NOTE

A member's graph-specific role must have more permissions than their organization-wide role.

Members with the Graph Admin or Org Admin role can assign graph-specific roles from the Permissions tab of the graph's Settings page.

Hidden graphs

If a graph is made hidden, then only users with explicit overrides (as well as Org Admins) can see the graph.

Graph admin override

The Graph Admin and Org Admin roles have exactly the same permissions for a particular graph, so you can only grant a Graph Admin override, not an (equivalent) Org Admin override.

Default on graph creation

When Contributors in an organization create a new graph, they are automatically granted the Graph Admin role for that graph.

Role permissions

Organization management permissions

ActionOrg AdminGraph AdminContributorObserver / DocumenterConsumer
Manage organization configuration (name, avatar, etc.)
Delete the organization
View and edit billing information
Invite members
Remove members
Export audit logs (enterprise only)
Manage which users have access to graphs

Graph management permissions

ActionOrg AdminGraph AdminContributorObserver / DocumenterConsumer
View and manage graph API keys
Manage graph integrations (Slack, Datadog, etc.)
Delete and rename graphs
Create graphs
Create new variantsNon-protected variants only
Push schemas to a graphNon-protected variants only
Manage Explorer settings (URL, etc)Non-protected variants only
Report graph usage metrics 1Non-protected variants only
See the schemas of subgraphs in federated graphs
View graph usage metrics and traces 2
Edit variant READMEsDocumenter only
Query graphs with the Explorer
View graph schemas and changelogs

NOTE

  1. When you report metrics from GraphOS Router or Apollo Server you should use a . For non-protected , the graph API key role must be Contributor, Org Admin, or Admin. For protected variants, only Org and Graph Admin roles can report metrics.

  2. Currently, graph usage metrics and traces are not displayed to Consumers via the Studio web app, but they are not blocked at the API layer. We intend to remove this capability from Consumers, but for the time being you should understand that Consumers are not fully prevented from accessing these metrics and traces.

Schema checks permissions

Learn more about schema checks.

ActionOrg AdminGraph AdminContributorObserver / DocumenterConsumer
Modify schema checks configuration
Override flagged checks
Run schema checks

Schema proposals permissions

This feature is only available with a GraphOS Enterprise plan.
You can test it out by signing up for a free Enterprise trial.

The table below shows default settings. You can configure which roles can create, edit, and approve proposals.

ActionOrg AdminGraph AdminContributorObserver / DocumenterConsumer
Change proposal status
Create proposals
Edit proposals
Add reviewers
View proposals
Make comments
Approve proposals

Contract permissions

This feature is only available with a GraphOS Enterprise plan.
You can test it out by signing up for a free Enterprise trial.

Learn more about contracts.

ActionOrg AdminGraph AdminContributorObserver / DocumenterConsumer
Create and modify contracts and contract variants
View existing contracts

Billing managers

Members with the Billing Manager role can't see or manage graphs in their organizations, but they can:

  • Remove members from the organization
  • View and edit billing information (including changing the billing plan)
  • Manage organization configuration (name, avatar, etc.)

Notably, Billing Managers can't invite new members to the organization or update roles.

Graph API key roles

Each graph API key also has a corresponding member role. This role can be any of Graph Admin (the default), Contributor, Documenter, Observer, or Consumer. A graph API key provides access only to its associated graph. It does not provide access to actions associated with organizations or users.

An additional role called Persisted Query Publisher is only available for , not for organization members. The role is only available for API keys for graphs in Enterprise organizations. API keys with this role can run the rover persisted-queries publish command to publish to persisted query lists. The role provides no other read or write access to the graph.

This role is appropriate for use in client development teams' deployment processes. If your graph uses persisted queries, some client teams may need to publish their operations to your graph's but should not be able to view your graph's schema, changelogs, or use other Consumer-level features.

Otherwise, a graph API key is equivalent in privileges to a user with the same role for the graph. For example, you can use a Consumer key to fetch a graph's schema, and you can use a Graph Admin key to manage integrations.

A few operations aren't listed in the table above because they are only supported by graph API keys, not for users in the graph's organization. These are primarily operations that are performed by your , such as usage reporting (traces and performance metrics).

NOTE

Before January 2021, graph keys did not have roles. Keys created before that date (shown as Legacy Admin keys) can perform the following operations:

  • Create new s
  • Run
  • View and manage graph API keys
  • Push schemas to a graph
  • See the schemas of in federated graphs
  • View graph schemas and changelogs
  • Modify schema checks configuration

Inviting members

NOTE

For organizations using single sign-on (SSO), access to GraphOS is exclusively managed through your identity provider (IdP). Any invitation links created before SSO setup will be automatically revoked and you won't be able to create new invitation links once SSO is enabled.

Org Admins can invite individual members by email address from your organization's Members tab in GraphOS Studio. Organization admins can also create a persistent invite link from the organization's Settings tab, which can be shared to invite any number of members. Using either method, an org admin can specify which role a new member receives.

⚠️ CAUTION

Never share invite links publicly. Anyone with the link can join your organization. If an invite link becomes compromised, an admin should revoke it from the Settings > Invite links section.

Removing members

Both Org Admins and Billing Managers can remove members from your organization's Members tab in GraphOS Studio.

Previous
GraphOS Organizations
Next
Plans and Billing
Rate articleRateEdit on GitHubEditForumsDiscord

© 2024 Apollo Graph Inc., d/b/a Apollo GraphQL.

Privacy Policy

Company