Tonic Fabricate uses account and workspace permissions to control user and API access to create and manage datasets and to manage account membership.
In this guide, we'll show you how to:
- Add workspaces to your account
- Add users to your account
- Assign account roles to users
- Add API keys to your account
- Grant workspace permissions to users and API keys
Overview of the Fabricate permissions structure
Let's start with a quick overview of the Fabricate account and workspace structure:
Each Fabricate account represents an organization. A Fabricate account has one or more users and also can have one or more API keys. API keys are used to authenticate Fabricate API requests.
Each account also has one or more workspaces. Each database is created within a workspace.
Within an account, each account user is assigned an account role. The account role determines whether the user can manage account settings or can only manage workspaces and databases.
Account users and API keys are granted access to workspaces.
Within the workspace, each user and API key is assigned a workspace role, which determines whether the user or API key can create and configure databases, manage workspace access, or merely generate data for existing databases.
Let's see how all of that is set up.
Account and workspace roles
We'll start with the available roles.
A user's access to an account and to workspaces is based on their assigned account and workspace roles.
API keys also are assigned workspace roles.
Account roles
An account user can have one of the following account roles:
- Owner: Every account must have at least one owner. The first user in the account is automatically an owner. Other users can be assigned as owners.
Account owners have full access to manage the account. They can:- Create and manage workspaces.
- Add and remove account users.
- Change assigned account roles.
- Add and remove API keys.
- Member: An account member can only create and manage workspaces in the account. They do not have other access to manage the account.
Workspace roles
Within a workspace, a user or API key can have one of the following workspace roles:
- Owner: Every workspace must have at least one owner. The user who creates the workspace is automatically an owner. Other users and API keys also can be assigned as owners.
Owners have full access to the workspace. They can:- Create and manage databases.
- Manage workspace access.
- Editor: A workspace editor can create and manage databases. They cannot manage access to the workspace.
- Viewer: A workspace viewer can view the databases in a workspace and generate data. They cannot change any database configuration.
Adding workspaces to an account
Next, we'll show you how to manage workspaces in an account.
Click the user menu at the bottom left, then click Switch Workspaces.
On the Switch Workspaces panel, click New Workspace.
Provide a name for the workspace, then click Save.
A new workspace is created with you as the workspace owner.
Adding users to an account
Let's move to managing the users in an account.
The list of account users is on the account settings page. To display the account settings page, in the user menu, click My Account.
On the My Account page, the Users list contains the list of account users, including:
- Their assigned account role. You can use the dropdown list to change their account role.
- Their access to account workspaces.
To remove an account user, click their Remove option. You cannot remove the only account owner.
To add users, click Invite Users.
On the Invite Users panel, provide a list of email addresses for the users to add. You can optionally grant the new account users access to all of the current account workspaces.
Note that the workspace access only applies to the workspaces that exist when you add the users. Access is not automatically granted to future workspaces.
When you're finished, click Send Invitations.
By default, the new users are added as account members.
Adding API keys to an account
Also on the My Account page, the API Keys list contains the API keys for the account.
To add an API key, click Create New API Key.
On the New API Key panel, provide a name for the new API key. By default, the new API key is granted editor access to all of the current account workspaces. To not grant any workspace access to the new API key, uncheck the checkbox. You can also select a different workspace role to grant to the API key.
Note that the access is only granted to the workspaces that exist when you create the API key. Access is not automatically granted to future workspaces.
When you're finished, click Create API Key.
Assigning users and API keys to workspaces
You manage workspace access from the workspace settings.
To display the workspace settings, in the user menu, click Switch Workspaces.
On the Switch Workspaces panel, hover the mouse over the workspace, then click the settings icon.
On the workspace settings page, the Permissions list shows the users and API keys that have access to the workspace. The list includes their workspace role. You can use the dropdown list to change the assigned role.
To remove access from an account or API key, click its Remove option. You cannot remove the only workspace owner.
To add an account user to the workspace, click Add User, then click the user.
To add an account API key to the workspace, click Add API Key, then click the API key.
By default, the user or API key is added as a workspace viewer. You can then use the Account Role dropdown list to change the assigned role.
Recap
In Tonic Fabricate, an account represents an organization. Each Fabricate database is created within an account workspace.
Fabricate uses account roles and workspace roles to manage access to Fabricate features and functions.
Account owners can add users and API keys to the account, and change each user's assigned account role. New users and API keys can be granted access to all of the account workspaces.
Account members can create and manage account workspaces. Within a workspace, a workspace owner can grant workspace access to account users and API keys.
Want to learn more about Tonic Fabricate? Get started for free or connect with our team today.
