You're viewing **Apigee Edge** documentation.  
[Go to the
**Apigee X** documentation](http://cloud.google.com/apigee/docs/api-platform/system-administration/apigee-roles). info

Each Apigee Edge organization comes with a few built-in roles that you can assign to
administrative users:

- **Organization Administrator** - Super user. Has full CRUD access to resources in the organization. In an Edge for Private Cloud installation, the most powerful role is the [System
  administrator role](https://docs.apigee.com/api-platform/system-administration/system-administrator-role), which also has access to system-level functions that the Organization Administrator doesn't.
- **Read-only Organization Administrator** - Has read-only access to resources in the organization.
- **Operations Administrator** - Deploys and tests APIs; has read-only access to other resources.
- **Business User** - Creates and manages API products, developers, developer apps, and companies; creates custom reports on API usage; has read-only access to other resources.
- **User** - Creates API proxies and tests them in the test environment; has read-only access to other resources.

The built-in roles control the level of access in both the management UI and the management
API.

To see the permissions set for each built-in role (as an Organization Administrator or a
Read-only Organization Administrator), select **Admin \> Organization Roles \>
name_of_role** in the management UI.

> [!NOTE]
> **Note:**The permissions in a default role cannot be changed. If needed, consider creating a custom role with desired permissions if a default role is not suitable for a specific use case.

If your organization includes Apigee Sense or API monitoring, then the admin console will also
display the following roles:

- Sense: **Sense Operator** and **Sense User** . For more about Sense roles, see [Apigee Sense built-in roles](https://docs.apigee.com/sense/sense-built-in-roles).
- API Monitoring: **API Monitoring Administrator** and **API Monitoring User** . For more about API Monitoring roles, see [API Monitoring roles](https://docs.apigee.com/api-monitoring/access#api_monitoring_roles).

## Example role permission

The following example in the management UI shows the permissions for the User role. Notice
that it has different deployment permissions:

- /deployments URI (GET)
- /environments/\*/applications/\*/revisions/\*/deployments (GET)
- /environments/test/applications/\*/revisions/\*/deployments (GET, PUT, DELETE)

![Users role permissions for deployment, showing PUT permissions on only deployments to the test environment.](https://docs.apigee.com/static/api-platform/images/role_users_deploy.png)

So what does this mean? What can someone in the User role deploy?

- First, the PUT permission is what allows deployment.
- Second, the more granular (specific) permission takes precedence where there is a permissions overlap, as there is with multiple deployment permissions here. (Precedence in permissions that overlap is described more fully in [Creating roles with the
  API](https://docs.apigee.com/api-platform/system-administration/managing-roles-api)).

In this example, the most granular permission is the "Deploy API to test environment
permission" with a URI of /environments/test/applications/\*/revisions/\*/deployments. It's the
/test/ part that makes it the most specific. It means someone in the User role can deploy any API
proxy (/applications/\*) with any revision (/revisions/\*) to the test environment (/test/).

Someone in this role, on the other hand, would not be able to deploy to any other environment,
because of the GET (read-only) permission on /environments/\*/, where the wildcard (\*) signifies
*any* . (The GET permission on /deployments allows the user to get deployment details with
the [API](https://docs.apigee.com/api/deployments)).

## About the Developer Administrator role

When a developer portal is provisioned, the **Developer Administrator** role is
added to your organization, typically with the `devadmin+{org_name}@google.com` user assigned to it.
This role is used solely for the purpose of configuring the connection between
Drupal-based developer portals (or custom portals using Apigee platform APIs) and your Edge organization. See [Communicating between the portal and Edge](https://docs.apigee.com/api-platform/publish/drupal/communicating-between-developer-services-portal-and-edge).

If you want to assign the Developer Administrator role to another user account, create the account in your
organization and contact support to assign the role.

> [!NOTE]
> It is recommended that you create a generic user account that all developer administrators can use. If you assign the role to an individual user account, communication may be impacted if the user account is deleted after transferring or leaving the company, for example.

Alternatively, you can create a custom role with the same permissions as the Developer Administrator role using the script described in
[Assign the
Developer Administrator role](https://www.drupal.org/docs/8/modules/apigee-edge/configure-the-connection-to-apigee-edge) in the Apigee Edge Drupal 8 module documentation.

The connection between the portal and your Edge organization can be viewed in Drupal under
**Configuration \> Dev Portal \> Application Settings** in the Drupal admin menu (you must be logged into
Drupal as an administrator). If the connection is shown as failed,
you must contact [Apigee Edge Support](https://docs.apigee.com/api-platform/troubleshoot/support) to change
the connection information. See [Creating a developer portal](https://docs.apigee.com/api-platform/publish/drupal/creating-developer-portal) for
more.