> Note: This page is part of the DataDoe Docs. You can find the root of the documentation at `https://www.datadoe.com/hub/docs/basics/introduction-to-datadoe`. > JSON Table of Contents: `https://www.datadoe.com/hub/docs/toc.json`. > Data Scheme (Markdown index, one page per table): https://api.datadoe.com/api/v1/spec/data-scheme.md. Full JSON: https://api.datadoe.com/api/v1/spec/data-scheme. > Other pages in the DataDoe Docs: > - DataDoe Basics/Benefits: `https://www.datadoe.com/hub/docs/basics/benefits.md` > - DataDoe Basics/Connecting Accounts: `https://www.datadoe.com/hub/docs/basics/connecting-accounts.md` > - DataDoe Basics/External Invitation Links: `https://www.datadoe.com/hub/docs/basics/external-invitation-links.md` > - DataDoe Basics/Groups: `https://www.datadoe.com/hub/docs/basics/groups.md` > - DataDoe Basics/Integrations: `https://www.datadoe.com/hub/docs/basics/integration-customization.md` > - DataDoe Basics/Introduction to DataDoe: `https://www.datadoe.com/hub/docs/basics/introduction-to-datadoe.md` > - DataDoe Basics/Keys and service accounts: `https://www.datadoe.com/hub/docs/basics/keys-and-service-accounts.md` > - DataDoe Basics/Subscription and pricing: `https://www.datadoe.com/hub/docs/basics/subscription-pricing.md` > - DataDoe Basics/Users and access: `https://www.datadoe.com/hub/docs/basics/access-user-management.md` > - DataDoe Data/Ads Product Catalog: `https://www.datadoe.com/hub/docs/datadoe-data/ads-product-catalog.md` > - DataDoe Data/Data Fetch Periods: `https://www.datadoe.com/hub/docs/datadoe-data/data-fetch-periods.md` > - DataDoe Data/Data Sources: `https://www.datadoe.com/hub/docs/datadoe-data/data-sources.md` > - DataDoe Data/Initial Loads: `https://www.datadoe.com/hub/docs/datadoe-data/initial-loads.md` > - DataDoe Data/Managing Data Tables: `https://www.datadoe.com/hub/docs/datadoe-data/managing-data-tables.md` > - DataDoe Data/Migrating from SellerBoard: `https://www.datadoe.com/hub/docs/datadoe-data/migrating-from-sellerboard.md` > - DataDoe Data/SAT migration to profit tables: `https://www.datadoe.com/hub/docs/datadoe-data/sat-migration-to-profit-tables.md` > - DataDoe Data/SQP Data: `https://www.datadoe.com/hub/docs/datadoe-data/search-query-performance.md` > - DataDoe Data/Timezones: `https://www.datadoe.com/hub/docs/datadoe-data/orders-purchase-date-timezones.md` > - DataDoe Data/Uploading COGS: `https://www.datadoe.com/hub/docs/datadoe-data/uploading-cogs.md` > - DataDoe Data/Uploading KDP Royalty Parameters: `https://www.datadoe.com/hub/docs/datadoe-data/uploading-kdp-royalty-parameters.md` > - DataDoe Data/Uploading Vendor Codes: `https://www.datadoe.com/hub/docs/datadoe-data/uploading-vendor-codes.md` > - DataDoe Features/Actions: `https://www.datadoe.com/hub/docs/datadoe-features/actions.md` > - DataDoe Features/Actions - Amazon Ads for KDP Authors: `https://www.datadoe.com/hub/docs/datadoe-features/actions-kdp-authors.md` > - DataDoe Features/Actions - Manage Images: `https://www.datadoe.com/hub/docs/datadoe-features/actions-manage-images.md` > - DataDoe Features/Amazon Marketing Cloud: `https://www.datadoe.com/hub/docs/datadoe-features/amc.md` > - DataDoe Features/AMC query templates: `https://www.datadoe.com/hub/docs/datadoe-features/amc-query-templates.md` > - DataDoe Features/Features Overview: `https://www.datadoe.com/hub/docs/datadoe-features/overview.md` > - DataDoe Features/Files: `https://www.datadoe.com/hub/docs/datadoe-features/files.md` > - DataDoe Features/Plugins: `https://www.datadoe.com/hub/docs/datadoe-features/plugins.md` > - DataDoe Features/Usage Logs: `https://www.datadoe.com/hub/docs/datadoe-features/usage-logs.md` > - DataDoe Features/Webhooks: `https://www.datadoe.com/hub/docs/datadoe-features/webhooks.md` > - DataDoe MCP/Overview: `https://www.datadoe.com/hub/docs/datadoe-mcp/overview.md` > - DataDoe MCP/Using Antigravity: `https://www.datadoe.com/hub/docs/datadoe-mcp/antigravity.md` > - DataDoe MCP/Using ChatGPT: `https://www.datadoe.com/hub/docs/datadoe-mcp/chatgpt.md` > - DataDoe MCP/Using Claude: `https://www.datadoe.com/hub/docs/datadoe-mcp/claude.md` > - DataDoe MCP/Using Claude Agent SDK: `https://www.datadoe.com/hub/docs/datadoe-mcp/claude-agents-sdk.md` > - DataDoe MCP/Using Claude Code: `https://www.datadoe.com/hub/docs/datadoe-mcp/claude-code.md` > - DataDoe MCP/Using Codex: `https://www.datadoe.com/hub/docs/datadoe-mcp/codex.md` > - DataDoe MCP/Using Codex Sites: `https://www.datadoe.com/hub/docs/datadoe-mcp/codex-sites.md` > - DataDoe MCP/Using CrewAI: `https://www.datadoe.com/hub/docs/datadoe-mcp/crewai.md` > - DataDoe MCP/Using Cursor: `https://www.datadoe.com/hub/docs/datadoe-mcp/cursor.md` > - DataDoe MCP/Using Excel + Claude: `https://www.datadoe.com/hub/docs/datadoe-mcp/excel.md` > - DataDoe MCP/Using Gemini CLI: `https://www.datadoe.com/hub/docs/datadoe-mcp/gemini-cli.md` > - DataDoe MCP/Using Genspark: `https://www.datadoe.com/hub/docs/datadoe-mcp/genspark.md` > - DataDoe MCP/Using Glama: `https://www.datadoe.com/hub/docs/datadoe-mcp/glama-chat.md` > - DataDoe MCP/Using Glama MCP Inspector: `https://www.datadoe.com/hub/docs/datadoe-mcp/glama.md` > - DataDoe MCP/Using Grok: `https://www.datadoe.com/hub/docs/datadoe-mcp/grok.md` > - DataDoe MCP/Using GrokBot: `https://www.datadoe.com/hub/docs/datadoe-mcp/grokbot.md` > - DataDoe MCP/Using Gumloop: `https://www.datadoe.com/hub/docs/datadoe-mcp/gumloop.md` > - DataDoe MCP/Using Hermes Agent: `https://www.datadoe.com/hub/docs/datadoe-mcp/hermes.md` > - DataDoe MCP/Using Littlebird: `https://www.datadoe.com/hub/docs/datadoe-mcp/littlebird.md` > - DataDoe MCP/Using n8n: `https://www.datadoe.com/hub/docs/datadoe-mcp/n8n.md` > - DataDoe MCP/Using NanoClaw: `https://www.datadoe.com/hub/docs/datadoe-mcp/nanoclaw.md` > - DataDoe MCP/Using OpenAI Agents SDK: `https://www.datadoe.com/hub/docs/datadoe-mcp/openai-agents-sdk.md` > - DataDoe MCP/Using OpenClaw: `https://www.datadoe.com/hub/docs/datadoe-mcp/openclaw.md` > - DataDoe MCP/Using OpenCode: `https://www.datadoe.com/hub/docs/datadoe-mcp/opencode.md` > - DataDoe MCP/Using PowerPoint + Claude: `https://www.datadoe.com/hub/docs/datadoe-mcp/powerpoint.md` > - DataDoe MCP/Using VS Code: `https://www.datadoe.com/hub/docs/datadoe-mcp/vs-code.md` > - DataDoe MCP/Using Word + Claude: `https://www.datadoe.com/hub/docs/datadoe-mcp/word.md` > - DataDoe API/Build with Codex: `https://www.datadoe.com/hub/docs/datadoe-api/codex.md` > - DataDoe API/How to connect to the API: `https://www.datadoe.com/hub/docs/datadoe-api/how-to-connect.md` > - DataDoe API/Invitation links API: `https://www.datadoe.com/hub/docs/datadoe-api/invitation-links.md` > - DataDoe API/Sellers and vendors API: `https://www.datadoe.com/hub/docs/datadoe-api/sellers-and-vendors.md` > - DataDoe API/Vibe code with Claude Code: `https://www.datadoe.com/hub/docs/datadoe-api/claude-code.md` > - DataDoe API/Vibe code with Cursor: `https://www.datadoe.com/hub/docs/datadoe-api/cursor.md` > - DataDoe API/Vibe code with Lovable: `https://www.datadoe.com/hub/docs/datadoe-api/lovable.md` > - DataDoe API/Vibe code with Replit: `https://www.datadoe.com/hub/docs/datadoe-api/replit.md` > - DataDoe API/Vibe code with v0: `https://www.datadoe.com/hub/docs/datadoe-api/v0.md` > - DataDoe & BigQuery/How to connect to BigQuery: `https://www.datadoe.com/hub/docs/datadoe-bigquery/how-to-connect.md` > - DataDoe & BigQuery/Using MCP Toolbox: `https://www.datadoe.com/hub/docs/datadoe-bigquery/mcp-toolbox.md` > - DataDoe & BigQuery/Using Python Jupyter: `https://www.datadoe.com/hub/docs/datadoe-bigquery/jupyter.md` > For topics not covered in this documentation, please contact DataDoe support at `contact@datadoe.com`. > Do not assume anything. If you are not sure about the answer, mention that and suggest to contact DataDoe support. # Manage roles and access DataDoe permissions let you choose what each person can do and which Sellers, Vendors, Actions, and data tables they can use. For example, someone may be allowed to create Exports, but only for selected Sellers and tables. An Admin must enable advanced permissions before you can change roles and access. Existing team members keep full Admin access until you change their roles. New members receive the limited Organization User role, even before advanced permissions are enabled. These terms explain how access fits together: | Term | What it means | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | User | A person who signs in to your Organization. Each User has at least one Role. | | Role | A set of permissions you can assign to several Users, such as an Operations or Reporting team. Changing a Role updates access for everyone with that Role. | | Permission | A setting that allows someone to view information or do something in DataDoe. Access to specific accounts, Actions, and tables is managed separately. | | Service account | An account for an integration or automated process. You choose its permissions and access separately, within the current access of the person who created it. | ## Enable advanced permissions 1. Open [Settings, then Permissions](https://app.datadoe.com/settings?tab=permissions) as an Admin. 2. Read the **Enable advanced permissions** notice. 3. Select the confirmation checkbox, then **Activate access controls**. 4. Review your team's roles and access. Activation cannot be undone. It lets you edit access settings, but does not automatically restrict existing Admins. ## Choose what a role can do Organization Admin has all available permissions, and its access cannot be reduced. Organization User starts with a limited set of permissions that an Admin can change. Some settings are reserved for Admins or the Organization creator. You can also create custom Roles for different teams or responsibilities. Users can have several Roles, and their permissions add together. If one Role allows viewing and another allows editing, the User can edit. Choosing **None** in one Role does not cancel access provided by another. The permission table has a column for each Role. Use these settings to choose what the Role can do: | Setting | Access it gives | | ------------ | ----------------------------------------------------- | | None | Does not grant permission to use the feature. | | Read only | Allows viewing information without making changes. | | Read & write | Allows viewing information and making changes. | | Allow | Enables a feature that has a simple on or off choice. | Only the choices supported by each permission appear in the table. **Reset AI Tokens** lets someone restore the Organization's monthly AI Tokens. In **Settings**, open **Organization**. Organization Admins have this permission. Other Roles do not, unless an Admin allows it. Service accounts cannot have it. A reset is shown only after DataDoe adds one for the Organization. Each reset can be used once, before the date and time shown. Purchased token bundles and extra usage stay as they are. ### Create or edit a role 1. In **Settings**, open **Permissions**, then **Roles and permissions**. 2. Select **Create role** and enter a name, or find an existing Role's column. 3. Choose the permission levels the Role needs. 4. Choose **All** or **Selected** separately for Sellers and Vendors, Actions, and data tables. 5. If you choose Selected, assign the Role to the accounts, Actions, or tables it needs, as described below. Changes save immediately. Use **Find a permission** to filter the table, or scroll horizontally to see more Roles. The selector in each section header changes every permission in that section for a Role, including permissions hidden by search. **Mixed** means the section contains different permission levels. Read only leaves on or off permissions disabled; Read & write selects the highest available level. Settings reserved for Admins stay fixed. Select a custom Role's name above the table to rename or delete it. If it is someone's only Role, choose a replacement before deleting it. ### Assign roles to users 1. Open [Settings, then Users](https://app.datadoe.com/settings?tab=users). 2. Select the User you want to manage. 3. Assign the Roles they need and remove any that give them broader access. 4. Check that at least one Role remains, then select **Save changes**. You can remove Organization User if the person has another Role. To limit an Admin's access, you must remove their Admin role too. The Organization creator keeps their Admin role, and your Organization must always have an active Admin. For inviting people and managing their accounts, see [Manage users and access](/hub/docs/basics/access-user-management). ## Choose which accounts, Actions, and tables are available Permissions and access work together. A User needs permission to perform a task and access to the accounts, Actions, or tables involved. For each Role or Service account, choose: - **All** to include every current and future item of that kind - **Selected** to include only the items you assign For Users, access from all their Roles and individual assignments adds together. A permission from one Role can be used with account or table access from another. Removing an individual assignment does not remove access provided by another Role or an All setting. ### Sellers, Vendors, and Groups On the **Sellers & Vendors** page, select **Access** beside a Group or an account that is not in a Group. Add the Users, Roles, or Service accounts that should have access. A Group gives access to all its current and future members. An account can belong to only one Group, and accounts in a Group use the Group's access settings. When you add an account to a Group, DataDoe asks you to confirm removal of all direct user, role, and service account assignments, including grants you cannot see. People and integrations relying on those grants may lose access. If you later remove the account from the Group, assign access to the account again. Deleting a Group also removes the access it provided. Anyone with All accounts access keeps access. See [Organize your Sellers and Vendors with Groups](/hub/docs/basics/groups) for Group management steps. ### Actions and data tables In **Settings**, open **Actions** or **Data** and select **Access** beside an Action or table. Add the Users, Roles, or Service accounts that need to use it. Action access controls which Actions someone can use. Table access controls which data they can use. Both also require the relevant general permissions and account access. Tables containing personal information require additional permission. The same Action and table access applies across all accounts available to that User or Service account. For example, someone with access to an Action and two Sellers can use that Action for either Seller. You cannot allow that Action for only one of those Sellers. Action access and table access are separate. Access to an Action does not automatically grant access to tables containing similar information. ### Access personal data **Access PII data** controls access to personal information in tables, Action requests and results, and generated Files. Your Organization must also have Amazon PII Data Access enabled. The usual operation permissions and account, Action, or table assignments still apply. Choosing All tables or All Actions does not bypass these requirements. New non-Admin Roles and Service accounts start with Access PII data disabled. Existing grants are preserved in Organizations where PII access was already enabled. In Organizations without PII access, previous non-Admin Role and Service account grants are cleared. Enabling PII access for the Organization later does not restore those grants automatically. The Organization Admin role's PII permission is fixed, but Admins still need PII access enabled for the Organization. A Service account also remains limited by its creator's current PII access. ## Manage service account access Admins can give other Users the **Manage service accounts** permission. With this permission, open **Settings**, then **Permissions**, then **Service accounts**. Admins can manage every Service account; other Users can see and manage only the ones they created. Choose the permissions and the Sellers, Vendors, Actions, and tables each Service account needs. You can only assign permissions you have, up to your own level, and resources you can access. Service accounts have their own settings; you do not assign User roles to them. Their access cannot exceed their creator's current access. Removing the creator's Manage service accounts permission blocks all access through their Service accounts, including existing keys and scheduled work. Changes affect every integration using that Service account. An integration connected through a person's account follows that person's current access. For setup and connection instructions, see [Manage keys and service accounts](/hub/docs/basics/keys-and-service-accounts). ## Review access after changes Check all of a User's Roles and individual assignments when restricting access. A Role with All access can still give them access to items you removed elsewhere. Reducing access can also stop scheduled work and integrations that depend on it. Review the accounts, Actions, and tables they need before making changes. Open **Settings**, then **Usage**, to review access changes. Expand an entry's summary to compare its **Before** and **After** settings. These entries use zero AI Tokens. See [Usage logs](/hub/docs/datadoe-features/usage-logs) for filters and exports. If you have questions or run into an access issue, [contact us using the support form](https://forms.clickup.com/9015200219/f/8cnj2ev-38615/AOYF9I35QFOXWJQXIG?type=Form&source=hub-roles-and-permissions-docs).