​

Roles & Permissions

Conto uses role-based access control (RBAC) to manage what each team member can do within an organization.

​

Roles

​

Permission Matrix

​

Managing Members

​

Invite a Member

Go to Settings > Team > Invite Member. Enter the email and select a role.

​

Change a Role

Changing roles requires team management permission (Owner or Admin), and role changes are enforced by hierarchy: you can only change or remove members whose role is strictly below your own. An Admin can manage Managers, Members, and Viewers, but not another Admin. Owners can manage anyone, including other Owners, and only an Owner can promote a member to Owner. The last Owner cannot be demoted or removed without transferring ownership first.

​

Managing Your Own Sessions

Every signed-in user can review and revoke their own active browser sessions. This is an account security action and does not depend on the user’s organization role.

• GET /api/sessions lists active sessions with a revocable session ID, current-session marker, recognizable device label, IP address, sign-in time, and last-active time.
• DELETE /api/sessions/{id} signs out one session owned by the current user.
• POST /api/sessions/terminate-all signs out every other active session while keeping the current browser signed in.

The session response does not include authentication tokens, user IDs, device fingerprints, or audit metadata. If you do not recognize a device or IP address, revoke that session and rotate any credentials that may have been exposed.

​

API Key Scopes

Organization API keys use scopes that map to these permissions. When creating a key, you can select a preset or pick individual scopes: See Admin SDK > Scopes for the full scope list.