Roles and Permissions

Every dashboard user in LendAPI has exactly one role. The role decides which parts of the dashboard appear in the user's sidebar, which tabs they can open on an application, and which actions they can take.

LendAPI ships with four built-in roles (Admin, Manager, Analyst, Auditor) that cover most teams. When you need something more precise, such as a loan officer who can update application status but cannot export data, you can create a custom role and choose its access module by module, tab by tab, and action by action.

Permissions are enforced by the LendAPI servers, not only hidden in the interface. If a role does not allow an action, the request is refused even if someone calls the underlying endpoint directly.

Key concepts

• Role: a named set of permissions. Each user has one role.
• Built-in role: Admin, Manager, Analyst or Auditor. Defined by LendAPI. You can assign them but not edit or delete them. Shown with a System badge.
• Custom role: a role you create in Manage Roles. Shown with a Custom badge.
• Available for: who a custom role is for. Parent roles are for your own team. Tenant roles are for users of your sub-tenants (for example merchants or brokers). Set when the role is created and cannot be changed.
• Module: a main area of the dashboard, usually one sidebar entry, such as Agent Dashboard, Product Studio or Settings.
• Tab: a section inside a module. Agent Dashboard, Tenants and Settings have tabs you can permission separately.
• Sub-action: a specific action inside a tab, such as Export applications. Turned on or off with a checkbox.
• Access level: None, View or Edit. Applies to modules and tabs.

How permissions work

Access levels

Edit includes View, and View includes None. Some areas are read-only by nature and only offer None and View: Stats, Decision Tree Report, View Leads, and the Underwriting, Integration, Activity and Arc AI tabs. The Settings Profile tab is the opposite: it only offers View and Edit, because every user can always see their own account.

Modules, tabs and sub-actions

Permissions form a hierarchy. A tab can never give more access than its module, and sub-actions only apply once their tab is set to Edit.

flowchart LR
    R["<b>Role</b><br/>e.g. Loan Officer"] --> M["<b>Module</b><br/>e.g. Agent Dashboard<br/><i>None · View · Edit</i>"]
    M --> T["<b>Tab</b><br/>e.g. Application<br/><i>None · View · Edit</i>"]
    T --> S["<b>Sub-actions</b><br/>e.g. Create, Export,<br/>Update status<br/><i>On / Off</i>"]

For example, a Loan Officer role might have Agent Dashboard: Edit, its Application tab at Edit, and only the Update status sub-action turned on. That user can open applications and move them between stages, but cannot export them.

When changes take effect

Role changes apply the next time the affected user signs in. This includes editing a role's permissions and assigning a user a different role. Anyone already signed in keeps their current access until they sign out and back in.

📘

Need the change right away?

Ask the user to sign out and back in. To cut off someone's access entirely, disable them in Settings → Users (see Users and Teams).

Role types and access

Built-in roles

Built-in roles cannot be edited, cloned or deleted. You can use Manager, Analyst or Auditor as the starting point for a custom role (Admin is not offered as a starting point).

Sub-tenant users can be given the built-in Admin or Analyst role, or any custom role whose Available for is Tenant. A sub-tenant Admin has full access to their own sub-tenant's Agent Dashboard, Leads and Tenants pages (and Branches, if enabled), not to your parent workspace's configuration. See Sub-tenants.

Permission reference

These are the rows in the role editor, in the order they appear. Rows for optional features only appear when that feature is turned on for your workspace. Expand a section when you need it.

Scope of Tenant roles

A custom role with Available for: Tenant only shows three areas in the editor: Agent Dashboard, Tenants, and Stats (under Tools), plus the user's own Profile. Sub-tenant users can never be given access to your Product Studio, rules, templates or other parent configuration.

Manage roles in the dashboard

Only Admins of your own (parent) workspace can manage roles. Managers and sub-tenant Admins cannot.

Open Manage Roles

1. Go to Settings → Users.
2. Click Manage Roles. (The button is unavailable while you are in Sandbox mode; switch to Live first.)

The list shows built-in roles first, then your custom roles. Columns show the Role, who it is Available for, the Description, the Type (System or Custom) and how many Users have it.

Create a custom role

1. On Manage Roles, click + Role.
2. Enter a Role name, for example Loan Officer. The names Admin, Analyst, Auditor and Manager are reserved, and names must be unique in your workspace.
3. Under Available for, choose Parent (your own team) or Tenant (sub-tenant users). You cannot change this later.
4. Optionally add a Description so other admins know who the role is for.
5. Optionally pick a role in Start from existing role. Its permissions are copied into the new role as a starting point.
6. Click Create Role. The role's permission page opens.
7. Under Module Access, set each module and tab to None, View or Edit, and tick the sub-actions you want. Use Search modules to find a row quickly, or the control at the top to set every module at once.
8. Click Save, then confirm in the Update role permissions? dialog.

A role must have at least one module above None before you can save it. If another role already has exactly the same permissions, LendAPI warns you with Similar role already exists; choose Create Anyway to keep both.

Edit a custom role

1. On Manage Roles, click View Role (the arrow icon) on the role's row to open its permission page.
2. Change levels or sub-actions under Module Access, then click Save and confirm.
3. To rename the role or change its description, click the Edit Role (pencil) icon on the role's row in the list.

Built-in roles also have View Role. Their page is read-only, so you can see exactly what they grant.

To copy permissions from another role, click Clone on the role's page and pick a role. This replaces all current module settings in the editor; an Undo link appears for a few seconds. Nothing is stored until you click Save.

🚧

Sub-actions reset when a tab drops below Edit

If you lower the Application, Tasks or Tenant List tab from Edit to View or None, its sub-actions are cleared. Raising the tab back to Edit does not restore them, so tick them again before saving.

Assign a role to a user

There is no separate assign step. You choose the role when you add or edit a user in Settings → Users (for your team) or in a sub-tenant's Users tab (for sub-tenant users). The Role list includes the built-in roles and the custom roles available for that kind of user. See Users and Teams.

Delete a custom role

1. On Manage Roles, click Delete Role on the row (or the trash icon on the role's page).
2. If nobody has the role, confirm with Delete Role.
3. If users have the role, choose a replacement under Assign role and click Confirm & Delete. All those users move to the replacement role. A Parent role can only be replaced by another Parent role; a Tenant role can be replaced by another Tenant role or by the built-in Admin or Analyst.

Review changes

Each role's page lists its assigned users and a history of changes: who changed which permission, from what to what, and when.

Reference and tips

Parent and sub-tenant roles

If your workspace uses sub-tenants, two kinds of users sign in to LendAPI:

🚧

Tenants → Users: Edit can grant sub-tenant Admin

Who can give a sub-tenant user a role is controlled by the Tenants → Users tab. Anyone with Edit on that tab can add sub-tenant users and choose any role offered for them, including the sub-tenant Admin role. Grant Tenants → Users: Edit only to people you trust to manage your partners' access.

Within your own team, the rule is stricter: only an existing Admin can give someone the Admin role, and the last active Admin cannot be demoted, disabled or removed.

API access

Roles and user role assignments are managed in the dashboard. They are not part of the public LendAPI REST API, and API keys are not tied to a user role. See Authentication for how API keys work.

Who can manage roles

Managing roles requires the built-in Admin role. Assigning roles to your team requires Settings → Users: Edit; assigning roles to sub-tenant users requires Tenants → Users: Edit.

Best practices

• Start from the closest existing role. Use Start from existing role or Clone and adjust, instead of building from scratch.
• Grant the minimum. Give View unless the person needs to change something. Keep Unhide masked fields and Export applications for people who need sensitive data.
• Be careful with sensitive rows. Data, Customers, Tenants and Integrations are flagged in the editor because they expose personal data, partner data or credentials.
• Plan for the next login. After changing a role, tell affected users to sign out and back in.
• Review custom roles after new features ship. When LendAPI adds a new tab, existing custom roles may start with None for it.
• Keep at least two Admins so you are never locked out of Manage Roles.

Related guides