{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","img"]},"redocly_category":"Getting started","type":"markdown"},"seo":{"title":"Access management using Role-Based Access Control (RBAC)","meta":[{"name":"robots","content":"noindex"}]},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"access-management-using-role-based-access-control-rbac","__idx":0},"children":["Access management using Role-Based Access Control (RBAC)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can view all existing access keys, create new ones, and revoke the permissions associated with any existing keys. The ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/spotnana/basic_rbac_concepts"},"children":["Role-Based Access Control (RBAC)"]}," mechanism allows you to configure specific roles, permissions, and scope for the access keys. For example, an access key with the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Reporting Administrator"]}," role and a scope set to a TMC lets the user generate reports for that TMC and its partner organizations."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Prerequisite"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To create, modify, or revoke access keys, you must have the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Developer Portal Administrator"]}," ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/spotnana/basic_rbac_concepts#available-roles"},"children":["role"]}," assigned to your user profile. Users with the read-only variant of this role can view access keys but cannot create or revoke them. The role is scoped so that you can manage keys only for your own organization, or for the organizations your TMC grants you access to. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/integration/dev-platform/developer-portal-introduction#prerequisites"},"children":["Developer portal prerequisites"]}," for how the role is assigned."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"to-create-a-new-access-key","__idx":1},"children":["To create a new access key"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access Keys"]}," in the left navigation."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/token-access-key.d44c40d7e9da7c5788fd2f63e9c8a2c8c8f2f534c96bfefbb97f86a55b87ecb6.ab49d4c1.png","alt":"Select access keys from left nav bar","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enter a descriptive name for the access key. You can use this name to identify the key later, for example when you need to change its permissions. Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create Access Key"]},"."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-create-access-key.ac6d6b67835f8e349850845f7ba58f9293d6a59f2a7aa833b0c7bbd3d0847d82.ab49d4c1.png","alt":"Enter a name and create the access key","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The client ID and client secret for the new access key are displayed. Save these credentials now, as you cannot view them again after this step."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-save-credentials.1c79dcc1846e05bcf0a52ef3e9ba77921d100242dcb448487f0bf9b5b2a551cf.ab49d4c1.png","alt":"Save your credentials page showing the client ID and client secret","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After you've securely stored the access key credentials, select the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["I have saved my credentials securely"]}," checkbox."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-credentials-checkbox.4178d3911d1d299b7cefa003fe0bdbb9914401124a489b29ed066d2be30b0403.ab49d4c1.png","alt":"I have saved my credentials securely checkbox selected","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Continue to configure permissions"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Configure Permissions"]}," page, configure the permissions for the new access key."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can also assign or modify permissions later from the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access Keys"]}," page. If no permissions are configured, the key has the access privileges of a traveler by default."]}]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-configure-permissions.5bcae9d1f2f9b6a9453823c5c060541d9505d00dba8f835a9c3b94ca333f5db7.ab49d4c1.png","alt":"Configure permissions page","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this page to assign a specific group or a role to the access key."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#assigning-the-access-key-to-a-group"},"children":["assigning groups"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#assigning-a-role-and-scope-to-an-access-key"},"children":["assigning roles"]}," to an access key topic for more information."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/spotnana/basic_rbac_concepts"},"children":["RBAC concepts"]}," to understand more on how Role-Based Access Control works on Spotnana."]}]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once the permissions are configured, click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Done"]},"."]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The new access key is displayed in the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access Keys"]}," page. This page lists all the access keys created for this company. You can identify your access key in the list using the access key name you used in step 3."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The permissions for an access key can be modified at any time. In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Actions"]}," column of the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access Keys"]}," page, click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["View"]}," for the access key whose permissions you want to modify."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-access-keys-list-view.c2f942d432953fe3c95e729a1eb353b7d75f5811945b30bbec9327097fe2a771.ab49d4c1.png","alt":"Access key row with the View action","framed":false,"withLightbox":false,"align":"center","border":"1px solid black"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Overview"]}," page of the selected access key is displayed. From here you can modify the existing permissions."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-access-key-overview.2ece7667db4a63deac8e265cd335e1b39e5d0a3fbf8cb342217fd34f689a01ee.ab49d4c1.png","alt":"Access key overview page","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"assigning-a-role-and-scope-to-an-access-key","__idx":2},"children":["Assigning a role and scope to an access key"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Spotnana provides you with a list of predefined roles and scopes you can assign to an access key. This ensures that users with this access key can access only specific features within the Spotnana platform."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/spotnana/basic_rbac_concepts#roles"},"children":["roles"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/spotnana/basic_rbac_concepts#scopes"},"children":["scope concepts"]}," to learn more."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"to-assign-a-role-and-scope","__idx":3},"children":["To assign a role and scope"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Configure Permissions"]}," page (step 7 in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#to-create-a-new-access-key"},"children":["creating a new access key"]},"), click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Assign role"]},"."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-assign-role-button.cc3e74a7f5ad2bb076dda10b4054490c4bbfe2b61853557d4c7a03e2ca2831d0.ab49d4c1.png","alt":"Assigned roles section with the Assign role button","framed":false,"withLightbox":false,"align":"center","border":"1px solid black"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select the roles you want to assign to the access key. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/spotnana/basic_rbac_concepts#available-roles"},"children":["available roles"]}," to understand the permissions granted by each role."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-select-roles.8dd0a11f07868435ae530ec98b15583e11876d7ce58e8a6b4e79065d8dac6c80.ab49d4c1.png","alt":"Assign role dialog with the list of roles","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can select more than one role in this dialog."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After selecting the roles, click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Define Scopes"]},". On this step, specify where in the Spotnana platform the selected roles apply to the access key. For example, the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Agent"]}," role with the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Booking TMC"]}," scope allows the agent to service travelers within that TMC. You can select more than one scope; access is granted when any one of the selected scopes matches. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/spotnana/basic_rbac_concepts#scopes"},"children":["scope concepts"]}," to learn more."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-define-scope.c56092e579939cb38e923626ffa7b29ee1ec0c8e7008668105df96fe631a1964.ab49d4c1.png","alt":"Define scope step of the Assign role dialog","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Specific companies"]},", you are prompted to choose the companies where the access key can be used."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Assign"]},"."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"assigning-the-access-key-to-a-group","__idx":4},"children":["Assigning the access key to a group"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A group is a predefined set of roles and scopes. Assigning an access key to a group grants the key all the access defined by that group."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For example, the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Company Travel Arrangers"]}," group contains the predefined roles and permissions that allow users to book travel on behalf of other travelers. Assigning an access key to this group grants that level of access to the key. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/spotnana/basic_rbac_concepts#user-groups"},"children":["RBAC user groups"]}," to learn more."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"to-assign-an-access-key-to-a-group","__idx":5},"children":["To assign an access key to a group"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Configure Permissions"]}," page (step 7 in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#to-create-a-new-access-key"},"children":["creating a new access key"]},"), click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Assign group"]},"."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-assign-group-button.500bf516ca9c1b54e698fb576442cbe6d37c47272c121fb47eaf3e90d0b2ae59.ab49d4c1.png","alt":"Assigned groups section with the Assign group button","framed":false,"withLightbox":false,"align":"center","border":"1px solid black"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select a group from the list of available options. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/spotnana/basic_rbac_concepts#user-groups"},"children":["RBAC user groups"]}," to learn more about the available groups and permissions."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-select-group.2c79a1938f64e56e856486a22281020cd798fe4e880106c46d962ac9e0ef1d41.ab49d4c1.png","alt":"Assign group dialog with the list of groups","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},". The access key is now assigned to the selected group. Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["View roles"]}," to see the roles, permissions, and scope associated with this group."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-assigned-group.f398f57a70a82015958813de7c99b751f34709dfd9e0233a48a750fd6f17667f.ab49d4c1.png","alt":"Assigned group row with the View roles action","framed":false,"withLightbox":false,"align":"center","border":"1px solid black"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["An access key can be part of more than one group. Repeat steps 1 through 3 to assign the access key to each group."]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"to-revoke-the-permission-for-an-existing-access-key","__idx":6},"children":["To revoke the permission for an existing access key"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access Keys"]}," in the left navigation."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/token-access-key.d44c40d7e9da7c5788fd2f63e9c8a2c8c8f2f534c96bfefbb97f86a55b87ecb6.ab49d4c1.png","alt":"Select access keys from left nav bar","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You'll see a list of access keys that are currently active. Find the access key you wish to revoke using its client ID or name."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["View"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Overview"]}," page, click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Revoke"]},"."]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/rbac-delete-access-key.16efec9e3874c3f58f4a9ffc810ff21956cf07b25cb3cf5ec8172437812daf02.ab49d4c1.png","alt":"Revoke button and the Delete Access Key warning","framed":false,"withLightbox":false,"width":"60%","height":"60%","align":"center","border":"1px solid black"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delete Access Key"]}," warning is displayed. Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delete"]}," to revoke the access key and its permissions."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Revoking an access key immediately and permanently cuts off API access for that key. Any system still using it will start receiving authentication errors. Before revoking a key that is in active use, ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#to-create-a-new-access-key"},"children":["create a new replacement access key"]}," and update your systems to use the new credentials. A revoked key cannot be restored."]}]}]},"headings":[{"value":"Access management using Role-Based Access Control (RBAC)","id":"access-management-using-role-based-access-control-rbac","depth":1},{"value":"To create a new access key","id":"to-create-a-new-access-key","depth":2},{"value":"Assigning a role and scope to an access key","id":"assigning-a-role-and-scope-to-an-access-key","depth":2},{"value":"To assign a role and scope","id":"to-assign-a-role-and-scope","depth":3},{"value":"Assigning the access key to a group","id":"assigning-the-access-key-to-a-group","depth":2},{"value":"To assign an access key to a group","id":"to-assign-an-access-key-to-a-group","depth":3},{"value":"To revoke the permission for an existing access key","id":"to-revoke-the-permission-for-an-existing-access-key","depth":2}],"frontmatter":{"seo":{"title":"Access management using Role-Based Access Control (RBAC)"}},"lastModified":"2026-11-05T13:00:56.864Z","pagePropGetterError":{"message":"","name":""}},"slug":"/integration/dev-platform/access-management-rbac","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}