Roles and permissions
| If you authenticated your CircleCI account with GitLab or the CircleCI GitHub App, the content on this page applies to you. |
Manage user access to organizations and projects with CircleCI roles and associated permissions. By default, users can access projects based on roles set at an organization level. For more granular control, you can assign roles at the project level. Manage roles for groups of users with groups.
Quickstart
For instructions on managing roles and permissions, see the Manage roles and permissions page. For more information on managing project roles for groups of users, see the manage-groups page.
Organization role permissions matrix
The table below shows the permissions associated with each CircleCI organization role:
| ACTIONS | ORGANIZATION ROLES | ||
|---|---|---|---|
Organization | Admin | Contributor | Viewer |
Create namespace | Yes | No | No |
Manage namespace | Yes | No | No |
View org settings | Yes | Yes | Yes |
Manage org settings | Yes | No | No |
View org access | Yes | Yes | Yes |
Manage org access | Yes | No | No |
View org credentials | Yes | Yes | Yes |
View org policies | Yes | Yes | Yes |
Manage org policies | Yes | No | No |
View org connections | Yes | Yes | Yes |
Manage org connections | Yes | No | No |
Manage org credentials | Yes | No | No |
View org audit logs | Yes | No | No |
View plan | Yes | Yes | No |
Manage plan | Yes | No | No |
Insights | Admin | Contributor | Viewer |
View org insights | Yes | Yes | Yes |
Runner | Admin | Contributor | Viewer |
View runners | Yes | Yes | Yes |
Manage runners | Yes | No | No |
Projects | Admin | Contributor | Viewer |
View projects | Yes | Yes | Yes |
Create projects | Yes | Yes | No |
Manage project settings | Yes | No | No |
Contexts | Admin | Contributor | Viewer |
View contexts | Yes | Yes | Yes |
Use contexts | Yes | Yes | No |
Edit context variables | Yes | Yes | No |
Manage contexts | Yes | Yes | No |
Orbs | Admin | Contributor | Viewer |
Create/update orb | Yes | No | No |
View private orb | Yes | Yes | Yes |
Publish development orb | Yes | Yes | No |
Publish orb | Yes | No | No |
Webhooks | Admin | Contributor | Viewer |
View org webhooks | Yes | Yes | No |
Manage org webhooks | Yes | No | No |
View project webhooks | Yes | Yes | No |
Manage project webhooks | Yes | No | No |
Schedule | Admin | Contributor | Viewer |
View schedule | Yes | Yes | Yes |
Edit schedule | Yes | No | No |
Triggers | Admin | Contributor | Viewer |
View triggers | Yes | Yes | Yes |
Trigger re-run via the CircleCI web app | Yes | Yes | No |
Edit triggers | Yes | No | No |
Pipelines | Admin | Contributor | Viewer |
View pipelines | Yes | Yes | Yes |
Edit pipelines | Yes | No | No |
Releases | Admin | Contributor | Viewer |
Create environment integration | Yes | Yes | No |
Delete environment integration | Yes | No | No |
View environment integration | Yes | Yes | Yes |
Create environment integration token | Yes | Yes | No |
Revoke environment integration token | Yes | No | No |
List environment integration token | Yes | Yes | Yes |
View components | Yes | Yes | Yes |
View releases | Yes | Yes | Yes |
Project role permissions matrix
The table below shows the permissions associated with each CircleCI project role:
| ACTIONS | PROJECT ROLES | ||
|---|---|---|---|
Projects | Admin | Contributor | Viewer |
View projects | Yes | Yes | Yes |
View project access | Yes | Yes | Yes |
View project credentials | Yes | Yes | Yes |
Manage project | Yes | No | No |
Webhooks | Admin | Contributor | Viewer |
View project webhooks | Yes | Yes | Yes |
Manage project webhooks | Yes | No | No |
Schedule | Admin | Contributor | Viewer |
View schedule | Yes | Yes | Yes |
Edit schedule | Yes | No | No |
Triggers | Admin | Contributor | Viewer |
View triggers | Yes | Yes | Yes |
Trigger build | Yes | Yes | No |
Edit triggers | Yes | No | No |
Contexts | Admin | Contributor | Viewer |
View contexts | Yes | Yes | No |
Use contexts | Yes | Yes | No |
Edit context variables | No | No | No |
Manage contexts | No | No | No |
Pipelines | Admin | Contributor | Viewer |
View pipelines | Yes | Yes | Yes |
Edit pipelines | Yes | No | No |
Releases | Admin | Contributor | Viewer |
Restore component version | Yes | Yes | No |
Restart component | Yes | Yes | No |
Scale component | Yes | Yes | No |
Cancel release | Yes | Yes | No |
Promote release steps | Yes | Yes | No |
Retry release | Yes | Yes | No |
Permissions scope
Your CircleCI roles and associated permissions are not derived from the permissions set in your VCS (version control system). Your CircleCI role permissions do not allow you to bypass permissions in the VCS.
For example, you may be an Organization Administrator within CircleCI, which gives you access to view and modify organization and project settings within your CircleCI organization. However, you will not be able to edit a project’s .circleci/config.yml hosted in your VCS without your user also having the write permissions within that VCS’s repository project. Your CircleCI user’s VCS permissions are determined by its associated VCS identity.
Role hierarchy across groups and individuals
Users can have roles assigned to them both individually and as part of a group. The highest role always applies. For example, if a user has the role of admin assigned for a project, and that user is also part of a group with the role of contributor for the project, the user will still have admin permissions for the project.