Staff roles and what they can do
Every comrce staff account has exactly one staff role. The role decides which areas of the admin console the account sees and which actions it may take. It also decides which colleagues it may manage. Four roles build on each other. The other three each unlock one area only.
How it works
Section titled “How it works”The seven roles
Section titled “The seven roles”| Role in the console | Code name | In one sentence |
|---|---|---|
| Super Admin | SuperAdmin | Everything, including API clients, languages and approving account deletions |
| Admin | OrdinaryAdmin | Manages companies, members, invitations, the team, Marketplace and News |
| Supporter | Supporter | Reads companies and users, impersonates customers, reads customers’ logs |
| Partner | Accounter | Reads companies and users only |
| Marketplace Editor | MarketplaceEditor | Edits the whole Marketplace and manages the accounts of partner users |
| Marketplace Partner | MarketplacePartner | Edits only the Marketplace partners assigned to them |
| News Editor | NewsEditor | Writes and publishes News |
Four roles build on each other, starting with the staff role Partner. Each includes everything the one before it can do: Partner → Supporter → Admin → Super Admin.
Marketplace Editor, Marketplace Partner and News Editor stand apart. Each unlocks only its own area. Supporter and Partner include none of these three roles’ permissions.
Which role reaches which page
Section titled “Which role reaches which page”In the table, ✓ means can open and use. R means read only, and – means not shown.
| Area and action | Super Admin | Admin | Supporter | Partner | Marketplace Editor | Marketplace Partner | News Editor |
|---|---|---|---|---|---|---|---|
| Admin console and own Settings | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Request deletion of own account | – | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| API Keys | ✓ | – | – | – | – | – | – |
| Languages | ✓ | – | – | – | – | – | – |
| Companies: list, company and membership pages | ✓ | ✓ | R | R | – | – | – |
| Edit a company, transfer ownership, change a member’s role, permissions or status | ✓ | ✓ | – | – | – | – | – |
| Invite a new company, see pending company invitations | ✓ | ✓ | – | – | – | – | – |
| Users: customer list and detail | ✓ | ✓ | R | R | – | – | – |
| Impersonate a customer with their service PIN | ✓ | ✓ | ✓ | – | – | – | – |
| Turn off a customer’s two-factor authentication (2FA) | ✓ | ✓ | ✓ | – | – | – | – |
| Export companies and customer users | ✓ | ✓ | – | – | – | – | – |
| Approve or cancel a customer’s account deletion | ✓ | – | – | – | – | – | – |
| Hub Team: team list | ✓ | ✓ | R | R | partners only | – | – |
| Invite team members | ✓ | ✓ | – | – | partners only | – | – |
| Change a team member’s role | ✓ | ✓ | – | – | – | – | – |
| Delete a team member | ✓ | ✓ | only Partner | – | partners only | – | – |
| Logs | ✓ | ✓ | customer events only | – | one partner’s logs | – | – |
| Marketplace: sections, services, filters, order | ✓ | ✓ | – | – | ✓ | – | – |
| Marketplace partners, partner pages, translations | ✓ | ✓ | – | – | ✓ | own partners | – |
| News: articles and categories | ✓ | ✓ | – | – | – | – | ✓ |
Which roles you can assign
Section titled “Which roles you can assign”Inviting someone into a role, changing a colleague’s role and deleting a team member each need authority over that role. What you can do depends on your own role:
| Your role | Invite and delete | Change a colleague’s role |
|---|---|---|
| Super Admin | Admin, Supporter, Partner, Marketplace Editor, Marketplace Partner, News Editor | from and to the same six roles |
| Admin | Supporter, Partner, Marketplace Editor, Marketplace Partner, News Editor | from and to the same five roles |
| Marketplace Editor | Marketplace Partner only | – |
| Supporter | deletes Partner only, invites nobody | – |
| Partner, Marketplace Partner, News Editor | nobody | – |
As a Super Admin, you can assign every other role. As an Admin, you can assign every role except the Super Admin and Admin roles. You cannot move a colleague out of a role you could not assign. Nobody can change, invite or delete a Super Admin in the console. Nobody can change their own role.
The same rule decides who may turn off someone’s 2FA. On a customer account it takes Super Admin, Admin or Supporter. On a staff account it takes authority over the colleague’s role. So nobody can turn it off for a Super Admin.
The second view, from the target role’s side:
| Target role | Who has authority over it |
|---|---|
| Super Admin | nobody |
| Admin | Super Admin |
| Supporter | Super Admin, Admin |
| Partner | Super Admin, Admin, Supporter |
| Marketplace Editor | Super Admin, Admin |
| News Editor | Super Admin, Admin |
| Marketplace Partner | Super Admin, Admin, Marketplace Editor |
What staff see
Section titled “What staff see”- The sidebar shows an entry only when your role may use the area.
- A colleague’s page shows the role field and the delete button only when you have authority over their role. The role list and the invite dialog offer only the roles you can assign.
- A direct link to a page your role cannot use shows You do not have permission to view this page.. Some detail pages show an error message instead, because the data does not load.
- A staff invitation always carries a staff role. An invitation with a customer role is refused when it is sent and when it is accepted.
- Customers have no staff role. Their accounts never see the console.
Example
Section titled “Example”Nordwind Handels GmbH asks support for help with a missing invoice. Four colleagues see different things:
| Colleague | Role | Can do |
|---|---|---|
| Jonas Becker | Super Admin | Everything below, plus create an API client for Nordwind’s ERP connector and import a language |
| Sabine Krüger | Admin | Change Lena Hoffmann’s member permissions, transfer ownership of Nordwind, invite a new Supporter |
| Paul Neumann | Supporter | Open Nordwind and its members read-only, ask Lena for her service PIN and impersonate her, read the logs |
| Katrin Vogel | Partner | Look up Nordwind’s members and tools. She cannot change anything or impersonate |
Paul finds the cause while impersonating Lena but cannot change her permissions. He asks Sabine, who has the Admin role.
What it does not do
Section titled “What it does not do”- A staff account has one staff role at a time. Roles are not combined, and changing the role replaces it.
- Staff roles do not grant access to customers’ tools or data outside comrce Hub. Staff accounts cannot sign in to partner applications through API clients.
- Marketplace Editor, Marketplace Partner and News Editor include no other role’s permissions. A News Editor cannot see companies, and an Admin cannot open API clients or languages.
- Company roles (Owner, Member, Partner) are separate. They describe a customer’s place in their own company. The company role Partner and the staff role Partner share a name but nothing else.
Where you see it
Section titled “Where you see it”- The sidebar: only the entries your role may use. See The comrce Hub admin console.
- Hub Team: each colleague’s role, the invite dialog and the role change. See The team list and Team member lifecycle.
- Pages for one role only: API client management and language management for Super Admin.
- Impersonation for support roles: Impersonating a customer.
- Marketplace partners’ own access: Partner self-service.