---
title: Roles
description: Who in an organisation may make each dashboard write, checked by the API on every request.
canonical: https://tollrelay.com/docs/roles
lastmod: 2026-10-11
---

# Roles

Who in an organisation may make each dashboard write, checked by the API on every request.

- Every member reads every screen. Support reads and makes no write.
- The API reads the person's role from the organisation's own region on every request. A role in a token or a header is never read, so a change or a removal holds on the next request.
- A write the role does not allow answers 403 with the code scope_missing.
- A person with no membership, or one that has ended, is answered 404 for the organisation, never 403.
- An organisation always keeps an owner. The last owner is never demoted or removed, and the answer is 409 with the code last_owner.
- The person who creates an agent is never its sole approver, unless they are the only person at the company who can sign: that version answers sole_signer true.
- The person who creates an organisation while signed in becomes its owner.

## Who may write

| Write | Route | Owner | Admin | Finance | Support |
| --- | --- | --- | --- | --- | --- |
| Set whether an agent announces itself to sites | `POST /identity/machines/{mid}/edge` | Yes | Yes | No | No |
| Start the business check | `POST /org/kyb/start` | Yes | Yes | No | No |
| Create a pass | `POST /identity/machines` | Yes | Yes | No | No |
| Mint a pass's identity token | `POST /identity/machines/{mid}/token` | Yes | Yes | No | No |
| Revoke a pass | `POST /identity/machines/{mid}/revoke` | Yes | Yes | No | No |
| Register a new device's key | `POST /identity/machines/{mid}/keys` | Yes | Yes | No | No |
| Approve a new device's key | `POST /identity/machines/{mid}/keys/{fingerprint}/approve` | Yes | Yes | No | No |
| Revoke a device's key | `POST /identity/machines/{mid}/keys/{fingerprint}/revoke` | Yes | Yes | No | No |
| Start proving a domain | `POST /identity/domains` | Yes | Yes | No | No |
| Prove a domain | `POST /identity/domains/{domain}/prove` | Yes | Yes | No | No |
| Set the device policy | `POST /org/device-policy` | Yes | No | No | No |
| Set a pass's limit | `POST /mandates` | Yes | Yes | No | No |
| Change a pass's limit | `PUT /mandates/{mid}` | Yes | Yes | No | No |
| Propose an open mandate | `POST /mandates/{mid}/versions` | Yes | Yes | No | No |
| Sign or refuse an open mandate | `POST /mandates/{mid}/versions/{version}/decision` | Yes | Yes | No | No |
| Approve or refuse a purchase above the line | `POST /approvals/{aid}/decision` | Yes | Yes | No | No |
| Mark a pass that should not have passed | `POST /record/{rid}/mark` | Yes | Yes | No | No |
| Post an entry to the record | `POST /record` | Yes | Yes | No | No |
| Connect a wallet | `POST /wallets` | Yes | No | Yes | No |
| Push signed limits into a wallet | `POST /wallets/{wid}/push` | Yes | No | Yes | No |
| Export an evidence bundle | `POST /evidence/bundles` | Yes | No | Yes | No |
| Change a member's role | `POST /org/members/{uid}/role` | Yes | No | No | No |
| Remove a member | `POST /org/members/{uid}/remove` | Yes | No | No | No |