User Roles
Every user in a tenant has a role that controls what they can do in the dashboard and REST API. Roles are hierarchical: each role can do everything the roles below it can.
Tenant roles
| Role | Description |
|---|---|
| OWNER | Full control of the tenant, including assigning the OWNER role to other members. Only owners can change another owner's role or remove members. |
| ADMIN | Everything MEMBER can do, plus managing tenant members, invites, and API tokens. |
| MEMBER | Everything VIEWER can do, plus mutating actions: triggering, replaying, and cancelling runs, managing workflows, crons, schedules, webhooks, and alerts. |
| VIEWER | Read-only access. Can view runs, workflows, workers, events, logs, and metrics, but cannot trigger or modify anything. |
Roles are assigned when a member is invited and can be changed later from Settings > Members. A member cannot change their own role.
API token permissions
Read-only API tokens use the VIEWER permissions for tenant-scoped REST operations. They cannot use gRPC. Unrestricted tokens bypass REST role checks and can use gRPC, but neither token type can list, create, or revoke API tokens. Those operations require an admin or owner session.
Organization roles
Organizations (Hatchet Cloud) have two roles:
| Role | Description |
|---|---|
| OWNER | Manages the organization: members, invites, tenants, SSO, and user groups. Added to every tenant as tenant OWNER. |
| MEMBER | Gets tenant access through explicit grants or user groups, with the tenant role each grant specifies. |
Payload visibility
Members with the MEMBER or VIEWER tenant role can additionally be restricted from viewing payloads. When the Can view payloads flag is disabled for a member, they can still see runs, statuses, and errors, but task inputs and outputs, event payloads, and log payloads are hidden in the dashboard and REST API.
A few rules:
- OWNER and ADMIN always see payloads, regardless of the flag.
- API tokens always include payloads, including read-only tokens. The member-level payload visibility flag does not apply to them. See API Tokens for token permissions.
- The flag defaults to true everywhere it can be set.
The flag can be set in the following places:
- On a tenant member, from Settings > Members.
- On a tenant or organization invite, so the restriction applies as soon as the invite is accepted.
- On a user group, applying to every member synced by that group. If a user matches multiple groups, the most restrictive group wins.
Changes to member roles and payload visibility are recorded in audit logs.
Last updated on November 5, 2026