User roles and access

When users sign in to InfluxDB 3 Explorer, the roles assigned to each user determine which pages and actions Explorer displays.

• How Explorer decides what to display
• Pages and the access they require
• Actions and the access they require
• Databases in selectors
• When access is refused
• Servers that don’t require sign-in
• Custom roles

How Explorer decides what to display

Explorer uses your server permissions and its own page and action restrictions to determine what to display. Opening a restricted Explorer page directly doesn’t grant access. InfluxDB independently checks each API request.

An action hidden in Explorer can still be available through the CLI or API if your server permissions allow it. For example, Members can manage resource tokens through the CLI or API, but Explorer restricts token management to administrators.

The access of a user is the combination of all roles assigned to the user.

Pages and the access they require

The following table shows which pages each built-in role can open. A page that a role can’t open doesn’t appear in the navigation.

Every user can open Get Help and the Servers, CL Builder, and Integrations pages under Configure.

After sign-in, Explorer opens System Overview for a user who can open it and Configure > Servers for every other user.

A user without any roles holds only the basic permissions of the server and sees only the pages that don’t require access.

Actions and the access they require

The server allows the Member role to create and delete tokens with the influxdb3 CLI or the API. Explorer offers token management only to administrators.

Databases in selectors

Database selectors, such as the database list in Query Data and Write Data, list only the databases that the user can use for that task:

• Query Data lists the databases that the user can read.
• Write Data lists the databases that the user can write to.

The server lists only the databases that a user can read or describe. A database that a user can only write to doesn’t appear in any selector.

When access is refused

If a user opens a page that their roles don’t allow, Explorer displays a message inside the page instead of the page content–for example:

Your role does not allow you to manage tokens
You are signed in with the Member role. Ask an administrator to grant access, or to run:
influxdb3 update user-roles <user-id> --role <role>

The message names the roles of the user. If Explorer can’t read the roles of the user, the message says Your roles on this deployment could not be read. If the user doesn’t have any roles, the message says Your account holds no roles on this deployment.

To give a user access, an administrator changes the roles of the user or runs influxdb3 update user-roles.

Servers that don’t require sign-in

When the server doesn’t require sign-in, Explorer has no user roles to check. The token that you store with the server connection decides what Explorer can do, and the server refuses requests that the token doesn’t allow. In this case, Explorer displays messages about the token instead of roles–for example, Plugins need an admin token.

Custom roles

InfluxDB 3 Enterprise can also have custom roles. For more information, see Custom roles in the InfluxDB 3 Enterprise documentation.