# User Roles

Each of the new API users should obtain a role to define access restrictions for direct API connections. Set the role in the `user_type` field when you create a new user.

* `ADMIN` is a system administrator, who has unlimited access to all system objects, but can't change the analyses' statuses;
* `OPERATOR` is a system operator, who can view all system objects and choose the analysis result via the **Make Decision** button (usually needed if the [status](/oz-knowledge/guides/developer-guide/api/oz-api/statuses-in-api.md) is `OPERATOR_REQUIRED`);
* `CLIENT` is a regular consumer account, who can upload media files, process analyses, view results in personal folders, generate reports for analyses.
  * `can_start_analysis_biometry` – an additional flag to allow access to [BIOMETRY](/oz-knowledge/guides/developer-guide/api/oz-api/basic-scenarios/biometry.md) analyses (enabled by default);
  * `can_start_analysis_quality` – an additional flag to allow access to [LIVENESS](/oz-knowledge/guides/developer-guide/api/oz-api/basic-scenarios/liveness.md) (QUALITY) analyses (enabled by default);
  * `can_start_analysis_collection` – an additional flag to allow access to [BLACK LIST](/oz-knowledge/guides/developer-guide/api/oz-api/basic-scenarios/collection.md) analyses (enabled by default).
* `CLIENT ADMIN` is a company administrator that can manage their company account and users within it. Additionally, `CLIENT ADMIN` can view and edit data of all users within their company, delete files in folders, add or delete report templates with or without attachments, the reports themselves and single analyses, check statistics, add new blacklist collections.
* `CLIENT OPERATOR` is similar to `OPERATOR` within their company.
* `CLIENT SERVICE` is a service user account for automatic connection purposes. Authentication with this user creates a long-live access token (5 years by default). The token lifetime for regular uses is 15 minutes by default (parameterized) and, also by default, the lifetime of a token is extended with each request (parameterized).

<details>

<summary>For API versions below 6.0</summary>

For API 5.3 and below, to create a CLIENT user with admin or service rights, you require to set the corresponding flags to true:

* `is_admin` – if set, the user obtains access to other users' data within this admin's company.
* `is_service` is a flag that marks the user account as a service accountfor automatic connection purposes. Authentication with this user creates a long-live access token (5 years by default). The token lifetime for regular uses is 15 minutes by default (parameterized) and, also by default, the lifetime of a token is extended with each request (parameterized).

</details>

Here's the detailed information on access levels.

#### Company

<table data-header-hidden><thead><tr><th width="166"></th><th></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><br></td><td>Create</td><td>Read</td><td>Update</td><td>Delete</td></tr><tr><td>ADMIN</td><td>+</td><td>+</td><td>+</td><td>+</td></tr><tr><td>OPERATOR</td><td>-</td><td>+</td><td>-</td><td>-</td></tr><tr><td>CLIENT</td><td>-</td><td>their company data</td><td>-</td><td>-</td></tr><tr><td>CLIENT SERVICE</td><td>-</td><td>their company data</td><td>-</td><td>-</td></tr><tr><td>CLIENT  OPERATOR</td><td>-</td><td>their company data</td><td>-</td><td>-</td></tr><tr><td>CLIENT ADMIN</td><td>-</td><td>their company data</td><td>their company data</td><td>their company data</td></tr></tbody></table>

#### Folder

<table data-header-hidden><thead><tr><th width="166"></th><th></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><br></td><td>Create</td><td>Read</td><td>Update</td><td>Delete</td></tr><tr><td>ADMIN</td><td>+</td><td>+</td><td>+</td><td>+</td></tr><tr><td>OPERATOR</td><td>+</td><td>+</td><td>+</td><td>-</td></tr><tr><td>CLIENT</td><td>their folders</td><td>their folders</td><td>their folders</td><td>-</td></tr><tr><td>CLIENT SERVICE</td><td>within their company</td><td>within their company</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT  OPERATOR</td><td>within their company</td><td>within their company</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT ADMIN</td><td>within their company</td><td>within their company</td><td>within their company</td><td>within their company</td></tr></tbody></table>

#### Report template

<table data-header-hidden><thead><tr><th width="167"></th><th></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><br></td><td>Create</td><td>Read</td><td>Update</td><td>Delete</td></tr><tr><td>ADMIN</td><td>+</td><td>+</td><td>+</td><td>+</td></tr><tr><td>OPERATOR</td><td>+</td><td>+</td><td>+</td><td>-</td></tr><tr><td>CLIENT</td><td>-</td><td>within their company</td><td>-</td><td>-</td></tr><tr><td>CLIENT SERVICE</td><td>-</td><td>within their company</td><td>-</td><td>-</td></tr><tr><td>CLIENT  OPERATOR</td><td>within their company</td><td>within their company</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT ADMIN</td><td>within their company</td><td>within their company</td><td>within their company</td><td>within their company</td></tr></tbody></table>

#### Report template attachments

<table data-header-hidden><thead><tr><th width="166"></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><br></td><td>Create</td><td>Read</td><td>Delete</td></tr><tr><td>ADMIN</td><td>+</td><td>+</td><td>+</td></tr><tr><td>OPERATOR</td><td>+</td><td>+</td><td>-</td></tr><tr><td>CLIENT</td><td>-</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT SERVICE</td><td>-</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT  OPERATOR</td><td>within their company</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT ADMIN</td><td>within their company</td><td>within their company</td><td>within their company</td></tr></tbody></table>

#### Report

<table data-header-hidden><thead><tr><th width="167"></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><br></td><td>Create</td><td>Read</td><td>Delete</td></tr><tr><td>ADMIN</td><td>+</td><td>+</td><td>+</td></tr><tr><td>OPERATOR</td><td>+</td><td>+</td><td>-</td></tr><tr><td>CLIENT</td><td>in their folders</td><td>in their folders</td><td>-</td></tr><tr><td>CLIENT SERVICE</td><td>within their company</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT  OPERATOR</td><td>within their company</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT ADMIN</td><td>within their company</td><td>within their company</td><td>within their company</td></tr></tbody></table>

#### Analysis

<table data-header-hidden><thead><tr><th width="168"></th><th></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><br></td><td>Create</td><td>Read</td><td>Update</td><td>Delete</td></tr><tr><td>ADMIN</td><td>+</td><td>+</td><td>+</td><td>+</td></tr><tr><td>OPERATOR</td><td>+</td><td>+</td><td>+</td><td>-</td></tr><tr><td>CLIENT</td><td>in their folders</td><td>in their folders</td><td>-</td><td>-</td></tr><tr><td>CLIENT SERVICE</td><td>within their company</td><td>within their company</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT  OPERATOR</td><td>within their company</td><td>within their company</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT ADMIN</td><td>within their company</td><td>within their company</td><td>within their company</td><td>within their company</td></tr></tbody></table>

#### Collection

<table data-header-hidden><thead><tr><th width="170"></th><th></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><br></td><td>Create</td><td>Read</td><td>Update</td><td>Delete</td></tr><tr><td>ADMIN</td><td>+</td><td>+</td><td>+</td><td>+</td></tr><tr><td>OPERATOR</td><td>-</td><td>+</td><td>-</td><td>-</td></tr><tr><td>CLIENT</td><td>-</td><td>within their company</td><td>-</td><td>-</td></tr><tr><td>CLIENT SERVICE</td><td>within their company</td><td>within their company</td><td>-</td><td>-</td></tr><tr><td>CLIENT  OPERATOR</td><td>-</td><td>within their company</td><td>-</td><td>-</td></tr><tr><td>CLIENT ADMIN</td><td>within their company</td><td>within their company</td><td>within their company</td><td>within their company</td></tr></tbody></table>

#### Person

<table data-header-hidden><thead><tr><th width="173"></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><br></td><td>Create</td><td>Read</td><td>Delete</td></tr><tr><td>ADMIN</td><td>+</td><td>+</td><td>+</td></tr><tr><td>OPERATOR</td><td>-</td><td>+</td><td>-</td></tr><tr><td>CLIENT</td><td>-</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT SERVICE</td><td>within their company</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT  OPERATOR</td><td>-</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT ADMIN</td><td>within their company</td><td>within their company</td><td>within their company</td></tr></tbody></table>

#### Person image

<table data-header-hidden><thead><tr><th width="177"></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><br></td><td>Create</td><td>Read</td><td>Delete</td></tr><tr><td>ADMIN</td><td>+</td><td>+</td><td>+</td></tr><tr><td>OPERATOR</td><td>-</td><td>+</td><td>-</td></tr><tr><td>CLIENT</td><td>-</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT SERVICE</td><td>-</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT  OPERATOR</td><td>-</td><td>within their company</td><td>-</td></tr><tr><td>CLIENT ADMIN</td><td>within their company</td><td>within their company</td><td>within their company</td></tr></tbody></table>

#### User

<table data-header-hidden><thead><tr><th width="177"></th><th></th><th></th><th></th><th></th></tr></thead><tbody><tr><td><br></td><td>Create</td><td>Read</td><td>Update</td><td>Delete</td></tr><tr><td>ADMIN</td><td>+</td><td>+</td><td>+</td><td>+</td></tr><tr><td>OPERATOR</td><td>-</td><td>+</td><td>their data</td><td>-</td></tr><tr><td>CLIENT</td><td>-</td><td>their data</td><td>their data</td><td>-</td></tr><tr><td>CLIENT SERVICE</td><td>-</td><td>within their company</td><td>their data</td><td>-</td></tr><tr><td>CLIENT  OPERATOR</td><td>-</td><td>within their company</td><td>their data</td><td>-</td></tr><tr><td>CLIENT ADMIN</td><td>within their company</td><td>within their company</td><td>within their company</td><td>within their company</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://doc.ozforensics.com/oz-knowledge/guides/developer-guide/api/oz-api/user-roles.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.