Please use the form below to provide your feedback. Because your feedback is valuable to us, the information you submit in this form is recorded in our issue tracking system (JIRA), which is publicly available. You can track the status of your feedback using the ticket number displayed in the dialog once you submit the form.

Roles

      +
      Roles grant users access to one or more resources. Administrators assign roles to users to enable them to perform the tasks they need to carry out when using Couchbase Server.

      Roles and Privileges

      Roles provide a set of privileges for interacting with a resource. These privileges are often specific. For example, the Data Writer role lets a user write data using key-value operations. This role does not let the user read data. The Data Reader role grants that ability.

      Some roles let you limit the privileges a role grants to specific collections, scopes, or buckets. For example, when granting a user the Data Writer role, you can limit the user so they can only write to a specific collection. You can also enable the user to write data to multiple collections, multiple scopes, or even to all buckets. For detailed information about scopes and collections, see Scopes and Collections.

      You can grant a user multiple roles to tailor their privileges for the tasks they need to perform. For example, you can grant a user the Data Reader role to let them read all data in a specific bucket. In addition, you can grant them the Data Writer role, but limit them to writing data into a specific collection within the bucket. Some roles, such as Query List Index, are so limited that they’re only useful when combined with other roles (Query Select, for example).

      Roles in Relation to Buckets

      Some roles provide privileges to resources across the entire cluster. For example, most administrator roles grant the user access to resources cluster wide. Other roles, such as those dealing with managing data, let the administrator granting the role limit its privileges to specific buckets, scopes, or collections.

      User Categories

      Couchbase Server users fall into three categories: administrators, developers, and applications. Which roles you assign to a user often depend on which category they fall into:

      Administrators

      Users with any of the administrator roles can log into Couchbase Server Web Console and perform administrative tasks. Most of these roles do not grant the ability to read or write data.

      The administrative roles grant their users the ability to carry out specific tasks. For example, a user with the Cluster Admin role can manage all cluster features except for security. Users with the Read-Only Admin role can log into the Couchbase Server Web Console to read cluster settings, statistics, and backup plans, but not change them. The Bucket Admin role allows management only of one or more buckets. See Administrative Roles for details.

      The user interface of the Couchbase Web Console changes based on the role the user has. For example, Couchbase Server only displays the the entire Security page to a user with the Full Admin role. Users with either the Local User Admin or the External User Admin roles can only see the Users & Groups tab on this screen.
      Applications

      An application needs to have a user account to authenticate with Couchbase Server. You often assign these users roles that let them read or write data or other limited privileges. Most of the roles you grant applications do not allow them to log into Couchbase Server Web Console or modify cluster settings. For example, the Data Reader and Data Writer roles let the user read and write data using key-value operations. You can limit these privileges to one or more collections, scopes, or buckets. Other roles appropriate for applications are Manage Scopes, Data DCP Reader, and Data Backup & Restore.

      Developers

      Developers require more privileges for greater access to data and to manage resources than do applications. However, they should not have the unrestricted privileges that most Administrator roles grant. These roles do let users log into the Couchbase Server Web Console, so they can perform tasks in a GUI environment. You can tailor the roles you grant to developers so they have just enough privileges to perform their tasks. For example, the Analytics Admin and Manage Global External Functions roles were designed for interactive users. They let them maintain some parts of the database. However, they lack the ability to change cluster settings like most administrator roles.

      Role Overviews

      The following sections describe the roles defined by Couchbase Server. The list is broken into the same categories that appear within the Couchbase Server Web Console’s Edit User dialog. Each description has a table listing what resources a user with the role can access and any limitations on their access. If a resource does not appear in this table, the role does not grant the user any privileges for it.

      The majority of roles are only available in Couchbase Server Enterprise Edition. The list indicates when a role is available in Couchbase Server Community Edition.

      Administrative Roles

      The following roles grant users the ability to administer some aspects of Couchbase Server.

      Full Admin

      The Full Admin role (admin) grants full privileges to all Couchbase Server features and resources, including security. The role allows the user to log into the Couchbase Server Web Console.

      This role is also available in Couchbase Server Community Edition.

      Read-Only Admin

      The Read-Only Admin role lets the user read Couchbase Server settings and statistics. Users with this role can also read Backup Service data to monitor backup plans and tasks.

      The role lets the user log into the Couchbase Server Web Console.

      This role is also available in Couchbase Server Community Edition.

      Prior to Couchbase Server 8.0, this role allowed the user to read security information including listing users and groups. In 8.0, these permissions were split off into the Read-Only Security Admin role. The Read-Only Admin role now does not allow access to any of the security information.

      + When you upgrade Couchbase Server from a version earlier than 8.0 to 8.0 or later, the upgrade process grants any user with this role the Read-Only Security Admin role as well. Granting this role lets the user retain the privileges they had in prior versions.

      Role: Read-Only Admin (ro_admin)

      Resource

      Permissions

      Restrictions

      Servers

      View configuration and statistics

      Cannot add, failover, remove, modify services, or rebalance

      Buckets

      List buckets, scopes, and collections

      Cannot create, drop, edit settings, read or write data

      Backup

      List repositories and plans

      Cannot add or edit repositories or plans.

      XDCR

      List remote clusters and outgoing replications

      Cannot list incoming replications, or add or edit replications.

      Security

      None.

      All.

      Settings

      View all settings

      Cannot edit settings

      Logs

      View logs

      Cannot collect information

      Indexes

      Can view index settings and stats

      Cannot add, edit, or drop indexes

      Query

      None

      All

      Search

      Can view Search indexes

      Cannot edit or add Search indexes

      Analytics

      None

      All

      Eventing

      None

      All

      Views

      Can list defined views

      Cannot change views

      Security Admin

      The Security Admin role allows the user to manage all security settings except for users and groups.

      This role lets the user log into the Couchbase Server Web Console.

      Role: Security Admin (security_admin)

      Resource

      Permissions

      Restrictions

      Servers

      View configuration and statistics

      Cannot add, failover, remove, modify services, or rebalance

      Buckets

      List buckets, scopes, and collections

      Cannot create, drop, or edit settings, or read or write data

      Backup

      None

      All

      XDCR

      List outgoing replications

      Cannot create, start, alter connections

      Security

      Manage LDAP, SAML, certificates, encryption at rest, audit, and logging settings.

      Cannot view or change users or groups.

      Settings

      View

      Change

      Logs

      View

      Collect Information

      Query

      None

      All

      Search

      None

      All

      Analytics

      None

      All

      Eventing

      None

      All

      Views

      None

      All

      Read-Only Security Admin

      The Read-Only Security Admin role lets the user view all security settings except for listing users and groups.

      This role lets the user log into the Couchbase Server Web Console.

      This role is new in Couchbase Server 8.0. It was created to separate security privileges from the Read-Only Admin role. The upgrade process from prior versions to Couchbase Server 8.0 or later grants this role to users that had the Read-Only Admin. This grant ensures the user retains the privileges they had in prior versions.
      Role: Read-Only Security Admin (ro_security_admin)

      Resource

      Permissions

      Restrictions

      Servers

      View configuration and statistics

      Cannot add, failover, remove, modify services, or rebalance

      Buckets

      List buckets, scopes, and collections

      Cannot create, drop, or edit settings, or read or write data

      Backup

      None

      All

      XDCR

      List outgoing replications

      Cannot create, start, alter connections

      Security

      View LDAP, SAML, certificates, encryption at rest, audit, and logging settings.

      Cannot make any changes to security settings. Cannot view or change users or groups.

      Settings

      View

      Change

      Logs

      View

      Collect Information

      Query

      None

      All

      Search

      None

      All

      Analytics

      None

      All

      Eventing

      None

      All

      Views

      None

      All

      Local User Admin

      The Local User Admin role lets a user manage users defined in the local authentication domain. It also grants the ability to read all cluster statistics such as the settings, logs, and buckets. It does not grant the ability to read data.

      While this role does not allow the user to read or write data, they can create users that can read and write data. This could be considered a privilege escalation, but it’s intentional behavior. This role is intended to manage all non-administrator roles, including those that can read or write data. You can address any possible privilege escalation concerns by auditing the actions of users with this role to see if they create users to get around the data access limitations.

      This role allows users to edit local users, but they cannot grant these users the Full Admin, Read-Only Admin, Local User Admin, or External User Admin roles. They also cannot edit the accounts for any user with those roles (including their own account).

      This role replaced the Local User Security Admin role available in Couchbase Server prior to version 8.0. The Local User Security Admin role had additional administration privileges that were split off into the Security Admin role. When upgrading to 8.0 or restoring a backup from a pre-8.0 version to Couchbase Server 8.0 or later, users with the Local User Security Admin role are granted this role and the Security Admin role. This conversion ensures the user retains the privileges they had in prior versions.

      This role lets users log into the Couchbase Server Web Console.

      Role: Local User Admin (user_admin_local)

      Resource

      Permissions

      Restrictions

      Servers

      View statistics

      Add, failover, remove, modify services, rebalance

      Buckets

      List buckets, scopes, and collections

      Create, drop, edit settings, read or write data

      Backup

      None

      All

      XDCR

      View list of outgoing replications

      View incoming replications, remote clusters, add or edit connections

      Security

      Add, delete, and edit local users. Can add, delete, and edit groups.

      Cannot grant Full Admin, Read-Only Admin, Local or External User Admin, or Security Admin roles to users or groups. Cannot access non-user and group security resources.

      Settings

      View

      Change

      Logs

      View

      Collect Information

      Query

      None

      All

      Search

      None

      All

      Analytics

      None

      All

      Eventing

      None

      All

      Views

      None

      All

      External User Admin

      The External User Admin role lets users manage users defined in the external authentication domain. It also lets the user manage groups and read all cluster statistics. Users with this role cannot grant external users or groups Full Admin, Read-Only Admin, Security Admin, or Local or External User Admin roles. They also cannot edit users with those roles.

      This role replaced the External User Security Admin role available in Couchbase Server prior to version 8.0. The External User Security Admin role had additional administration privileges that were split off into the Security Admin role. When upgrading to 8.0 or restoring a backup from a pre-8.0 version to Couchbase Server 8.0 or later, users with the External User Security Admin role are granted this role and the Security Admin role. This conversion ensures the user retains the privileges they had in prior versions.

      This role lets the user log into the Couchbase Server Web Console.

      Role: External User Admin (user_admin_external)

      Resource

      Permissions

      Restrictions

      Servers

      View statistics

      Add, failover, remove, modify services, or rebalance servers

      Buckets

      List buckets, scopes, and collections

      Create, drop, edit settings, read or write data

      Backup

      None

      All

      XDCR

      View list of outgoing replications

      View incoming replications, remote clusters, add or edit connections

      Security

      Add, delete, edit external users. Add, delete, and edit groups.

      Cannot grant Full Admin, Read-Only Admin, Local or External User Admin, or Security Admin roles to groups or external users. Cannot access security resources besides users and groups.

      Settings

      View

      Change

      Logs

      View

      Collect Information

      Query

      None

      All

      Search

      None

      All

      Analytics

      None

      All

      Eventing

      None

      All

      Views

      None

      All

      Cluster Admin

      The Cluster Admin role lets the user manage of all cluster features except security. Cluster Admins can create, edit, and drop buckets but cannot read or write data.

      This role lets users log into the Couchbase Server Web Console.

      Role: Cluster Admin (cluster_admin)

      Resource

      Permissions

      Restrictions

      Servers

      All

      None

      Buckets

      Create, drop, edit settings

      Read or write data

      Backup

      None

      All

      XDCR

      All

      None

      Security

      None

      All

      Settings

      All

      None

      Logs

      All

      None

      Query

      None

      All

      Search

      None

      All

      Analytics

      None

      All

      Eventing

      Import, Change Settings

      Add, remove, edit functions

      Views

      None

      All

      Eventing Full Admin

      The Eventing Full Admin role lets a user create and manage eventing functions as well as other administration tasks.

      The role lets the user log into the Couchbase Server Web Console.

      Role: Eventing Full Admin (eventing_admin)

      Resource

      Permissions

      Restrictions

      Servers

      View configuration and statistics

      Cannot add, failover, remove, modify services, rebalance

      Buckets

      List buckets, scopes, and collections. Can create, compact, and drop buckets, scopes, and collections. Can read and write data in buckets.

      None

      Backup

      List repositories and plans

      Cannot add or edit repositories or plans

      XDCR

      List outgoing replications

      Cannot list incoming replications or remote clusters. Cannot add or edit replications.

      Security

      None

      All

      Settings

      View all settings and load sample buckets

      Cannot edit settings

      Logs

      View logs

      Cannot collect information

      Indexes

      All

      None

      Query

      All

      None

      Search

      All

      None

      Analytics

      All

      None

      Eventing

      All

      None

      Views

      All

      None

      Backup Full Admin

      The Backup Full Admin role lets the user administer backup-related tasks as well as other aspects of Couchbase Server.

      This role does not grant the ability to back up or restore users. For a user to be able to back up both data and users, you must assign them the Local User Admin and the External User Admin roles in addition to this role.

      This role lets the user log into Couchbase Server Web Console.

      Role: Backup Full Admin (backup_admin)

      Resource

      Permissions

      Restrictions

      Servers

      All

      None

      Buckets

      All, including add and drop buckets and edit, add, and drop documents

      None

      Backup

      All

      None

      XDCR

      All

      None

      Security

      None

      All

      Settings

      All

      None

      Logs

      View logs

      Cannot collect information

      Query

      All

      None

      Indexes

      All

      None

      Search

      All

      None

      Analytics

      All

      None

      Eventing

      All

      None

      Views

      All

      None

      Views Admin

      The Views Admin role lets the user create, modify, and drop views in one or more buckets. When granting this role, you choose the buckets where the user can manage views.

      This role lets the user log into Couchbase Server Web Console.

      Role: Views Admin (views_admin)

      Resource

      Permissions

      Restrictions

      Servers

      View configuration and statistics

      Cannot add, failover, remove, modify services, or rebalance servers

      Buckets

      Can read, write, and edit views for the buckets assigned to them. Can read data (via key-value), statistics, and settings in these buckets.

      Cannot write data to buckets or alter bucket settings

      XDCR

      Can list outgoing replications

      Cannot view incoming replications or change XDCR settings

      Settings

      View all settings

      Cannot edit settings

      Logs

      Can view logs

      Cannot collect data

      Query

      None

      Cannot execute queries

      Search

      Can view Search indexes

      Cannot edit or add Search indexes

      Views

      Can create, drop, and edit views in buckets assigned to them.

      Cannot change views

      External Stats Reader

      The External Stats Reader role grants only allows the user to call the /metrics and /prometheus_sd_config REST API endpoints. Assign this role to the user Prometheus uses when authenticating with Couchbase Server. See Configure Prometheus to Collect Couchbase Metrics for more information.

      This role does not let the user log into the Couchbase Server Web Console.

      Role: External Stats Reader (external_stats_reader)
      Resource Permissions Restrictions

      Metrics API

      Able to call /metrics and /prometheus_sd_config REST API endpoints

      None

      Application Telemetry Writer

      This role lets the user report application telemetry through SDK calls. Assign this role to application users that need to report telemetry information to Couchbase Server.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Application Telemetry Writer (application_telemetry_writer)
      Resource Permissions Restrictions

      Application Telemetry

      Able to write to telemetry metric websockets

      None

      Bucket Roles

      The following roles give users privileges to manage or access buckets. See Buckets for more information about buckets.

      Bucket Admin

      The Bucket Admin role lets the user manage one or more buckets. These management abilities include stopping and starting XDCR for a bucket. When granting this role, you choose which buckets the user can manage.

      This role lets the user log into Couchbase Server Web Console.

      Role: Bucket Admin (bucket_admin)
      Resource Permissions Restrictions

      Servers

      List servers, view server configuration

      Cannot view configuration, add, failover, remove, modify services, or rebalance servers.

      Buckets

      Can drop, compact and edit buckets assigned to them. Can add, edit, and drop scopes and collections in the buckets.

      Cannot read, insert, or mutate documents.

      XDCR

      Can start and stop replications for buckets assigned to them.

      Cannot add, remove, or edit XDCR connections.

      Settings

      View all cluster settings

      Cannot change cluster settings.

      Logs

      Can view logs.

      Cannot collect information

      Search

      Can list Search indexes.

      Cannot create, drop, or edit Search indexes.

      Eventing

      All

      None

      Manage Scopes

      The Manage Scopes role lets a user create and delete scopes and collections within one or more buckets. When granting this role, you choose the buckets where the user can create scopes and collections. The user does not have the ability to read, write, or alter data. Use this role to allow applications to manage a bucket’s scopes and collections.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Manage Scopes (scope_admin)
      Resource Permissions Restrictions

      Buckets

      Can add and drop scopes and collections in the buckets assigned to them.

      Cannot read, insert, or mutate documents.

      Application Access

      The Application Access role lets a user read and write data in one or more buckets. This role does not grant the ability to query data via SQL++—the user can only access data via keys. When granting this role, you choose the buckets where the user can read and write data. As its name implies, this role is intended for use by applications instead of interactive users.

      This role is deprecated. Couchbase Server 5.0 added this role to replace an old method of password authentication to access buckets. To transition away from bucket passwords, the upgrade process to Couchbase Server 5.0 created new users with the bucket’s name and password and assigned this role. Do not grant this role to users. Instead, use one of the query or data roles.

      Versions of Couchbase Server prior to 5.5 referred to this role as Bucket Full Access.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Application Access (bucket_full_access)
      Resource Permissions Restrictions

      Buckets

      Can read and write data in buckets assigned to them.

      Cannot alter bucket, scope, or collection settings.

      Data Roles

      These roles give users the ability to read and write data in buckets via key-value operations. See Work with Documents to learn about key-value operations.

      Data Reader

      The Data Reader role lets the user read data from one or more collections via key-value retrieval. It does not grant the ability to run SQL++ queries (see Query & Index Roles for roles that do). When granting this role, you choose the collections where the user can read data. Grant this role to users for applications that need to read data via key-value operations.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Data Reader (data_reader)

      Resource

      Permissions

      Restrictions

      Buckets

      Read data from collections, scopes, and buckets assigned to them. Can read some bucket metadata, XATTR mappings, and pools on buckets assigned to them.

      Cannot write data

      Query

      None

      All

      Data Writer

      The Data Writer role lets the user write data to one or more collections via key-value operations. It does not grant the ability to run SQL++ queries (see Query & Index Roles for roles that do). When granting this role, you choose the collections where the user can write data. Grant this role to users for applications that need to write data via key-value operations.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Data Writer (data_writer)

      Resource

      Permissions

      Restrictions

      Buckets

      Write data to collections, scopes, and buckets assigned to them.

      Cannot read data

      Query

      None

      All

      Data DCP Reader

      The Data DCP Reader role lets the user start a Database Change Protocol (DCP) stream for one or more collections, scopes, or buckets. When granting this role, you choose the collections, scopes, and buckets where the user can start DCP streams. Grant this role to users for applications that need to start DCP streams.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Data DCP Reader (data_dcp_reader)

      Resource

      Permissions

      Restrictions

      Buckets

      Can start DCP streams for collections, scopes, and buckets assigned to them. Can also read data and XATTRs from these collections, scopes, and buckets.

      Cannot write data

      Query

      None

      All

      Data Monitor

      The Data Monitor role lets the user read statistics for a bucket, scope, or collection. When granting the role, you decide which statistics the user can read. Use this role for applications that need to read statistics.

      In versions of Couchbase Server prior to 5.5, this role was called Data Monitoring.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Data Monitor (data_monitoring)

      Resource

      Permissions

      Restrictions

      Buckets

      Can read statistics for buckets, scopes, and collections assigned to them.

      None

      Views Roles

      The following roles grant users privileges with Views. Also see the related administrator role Views Admin.

      Views were deprecated in Couchbase Server 7.0. See Views Reference for more information.

      Views Reader

      The Views Reader role lets a user read data from views in one or more buckets. When granting this role, you choose which buckets contain views the user can read. Grant this role to users you create for applications that need to read data from views.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Views Reader (views_reader)

      Resource

      Permissions

      Restrictions

      Buckets

      Can read data from views in the buckets they have access to. Can read data via key-value from these buckets.

      Cannot write data to buckets, alter bucket settings, or alter views.

      Views

      Can read data from views in buckets assigned to them.

      Cannot change views

      Query & Index Roles

      These roles grant users the ability to perform queries and work with indexes.

      Query CURL Access

      The Query CURL Access role lets the user call the SQL++ curl function in their queries.

      The Query CURL Access role allows users to run GET and POST requests to any system on the network Couchbase Server uses for client connections. If your cluster is not configured to use a private network for internal communication, they also have access to the entire cluster. They can interact with any system on this network.

      This role only grants the user the ability to read data returned by the SQL++ curl function. Usually, you assign additional roles to the user to allow them to read and write data.

      For more information about the SQL++ curl function, see CURL Function.

      This role lets the user log into Couchbase Server Web Console.

      Role: Query Curl Access (query_external_access)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration or add, failover, remove, modify services, or rebalance servers

      Buckets

      List buckets

      Cannot list scopes or collections. Cannot create, drop, or edit buckets. Cannot read data other than the results of the SQL++ curl function call. Cannot write data.

      Query

      Can execute SQL++ curl function calls

      Cannot execute any other queries. Cannot use the Query Workbench in Couchbase Server Web Console.

      Query System Catalog

      The Query System Catalog role lets the user query the system catalog using SQL++. This access include querying system:indexes, system:prepareds, and tables listing current and past queries. Assign this role to developers who need to query these tables when troubleshooting and debugging queries.

      The role grants Couchbase Server Web Console access.

      Role: Query System Catalog (query_system_catalog)
      Resource Permissions Restrictions

      Servers

      List servers.

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Buckets

      List buckets and view bucket settings

      Cannot list scopes or collections, create, drop, edit settings, read or write data

      Query

      Can query system tables

      Cannot perform any other query actions. Cannot use the Query Workbench in Couchbase Server Web Console.

      Manage Global Functions

      The Manage Global Functions role lets the user create and drop global user-defined SQL++ functions. See CREATE FUNCTION.

      This role grants Couchbase Server Web Console access.

      Role: Manage Global Functions (query_manage_global_functions)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Buckets

      List buckets

      Cannot list scopes or collections, create, drop, edit settings, read or write data

      Query

      Can execute CREATE FUNCTION and DROP FUNCTION statements

      Cannot perform any other queries, including calling global functions. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Execute Global Functions

      The Execute Global Functions role lets the user call global SQL++ user-defined functions.

      This role lets the user log into Couchbase Server Web Console.

      Role: Execute Global Functions (query_execute_global_functions)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Buckets

      List buckets

      Cannot list scopes or collections, create, drop, edit settings, read or write data

      Query

      Can execute global user-defined functions

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Manage Scope Functions

      The Manage Scope Functions role lets the user create and drop user-defined SQL++ functions for one or more scopes. When granting this role, You select the scopes where the user can manage user-defined functions. See CREATE FUNCTION.

      This role lets the user log into Couchbase Server Web Console.

      Role: Manage Scope Functions (query_manage_functions)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Buckets

      List buckets

      Cannot list scopes or collections, create, drop, edit settings, read or write data

      Query

      Can execute CREATE FUNCTION and DROP FUNCTION statements to create user-defined functions in specific scopes

      Cannot perform any other queries, including calling the functions. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Query Select

      The Query Select role lets the user execute SELECT statements on the data in one or more collections. See Select Data with Queries. When granting this role, you choose the collections where the user execute SELECT statements.

      This role lets the user log into Couchbase Server Web Console.

      Role: Query Select (query_select)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Buckets

      Can list buckets. Can read data from specific collections.

      Cannot list scopes or collections, create, drop, edit settings, read or write data

      Query

      Can execute SELECT statements on data in one or more collections. Can read data from one or more collections.

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change any settings

      Query Update

      The Query Update role lets the user execute UPDATE statements to mutate existing documents in specific collections. See UPDATE for more information. When granting this role, you select which collections contain documents the user can mutate.

      This role lets the user log into Couchbase Server Web Console.

      Role: Query Update (query_update)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Buckets

      List buckets and view bucket settings

      Cannot list scopes or collections, create, drop, edit settings

      Query

      Can execute UPDATE statements on documents in one or more collections

      Cannot perform any other queries. Cannot create new documents. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Query Insert

      The Query Insert role lets the user execute the SQL++ INSERT statement to add new documents to one or more collections. See INSERT for more information. When granting this role, you select the collections where the user can add documents.

      This role lets the user log into Couchbase Server Web Console.

      Role: Query Insert (query_insert)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Buckets

      List buckets and view bucket settings

      Cannot list scopes or collections, create, drop, edit settings

      Query

      Can execute INSERT statements to create documents in one or more collections

      Cannot perform any other queries. Cannot mutate existing documents. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Query Delete

      The Query Delete role lets the user execute the SQL++ DELETE satatement to delete documents from one or more scopes. See DELETE for more information. When granting this role, you select the collections where the user can delete documents.

      This role lets the user log into Couchbase Server Web Console.

      Role: Query Delete (query_delete)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Buckets

      List buckets and view bucket settings

      Cannot list scopes or collections. Cannot edit bucket settings.

      Query

      Can execute DELETE statements to delete documents from one or more collections

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Query Use Sequential Scans

      The Query Use Sequential Scan role allows users' queries to perform a sequential scan of a keyspace. The query planner only uses a sequential scan when no suitable index exists for the keyspace. Only queries by users with this role can use a sequential scan to query data because scanning a large unindexed keyspace can be expensive. See Sequential Scans for more information.

      Administrator roles automatically have permission to perform sequential scans when necessary.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Query Use Sequential Scans (query_use_sequential_scans)
      Resource Permissions Restrictions

      Query

      Can execute a query in a collection that lacks a primary and secondary index

      Cannot perform any other queries

      Query Manage Index

      The Query Manage Index role allows the user to manage indexes for one or more collections. When granting this role, you select the collections where the user can manage indexes.

      This role lets the user log into Couchbase Server Web Console.

      Role: Query Manage Index (query_manage_index)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Buckets

      List buckets and view bucket settings

      Cannot list scopes or collections, create, drop, edit settings. Cannot read or write data.

      Index

      Can create, drop, and view indexes for the collections whose indexes they have been given permission to manage

      Cannot use the Query Workbench in Couchbase Server Web Console

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Query List Index

      This role lets the user list indexes defined for one or more buckets, scopes, or collections. When granting this role, you select the buckets, scopes, or collections where the user can list indexes.

      This role lets the user log into Couchbase Server Web Console.

      Role: Query List Index (query_list_index)
      Resource Permissions Restrictions

      Servers

      List servers and view statistics

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Buckets

      List and view statistics for buckets, scopes, and collections

      Cannot create, drop, or edit bucket, scope, or collection settings. Cannot read or write data.

      Index

      Can get list of indexes via the stats endpoint (see Index Statistics REST API)

      Cannot add, drop, or edit indexes. Cannot use the Index Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Execute Scope Functions

      The Execute Scope Functions role lets the user execute SQL++ user-defined functions defined within a scope. When you grant this role, you select the scopes where the user can call user-defined functions.

      This role lets the user log into Couchbase Server Web Console.

      Role: Execute Scope Functions (query_execute_functions)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Query

      Can execute scope user-defined functions in specific scopes

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Manage Global External Functions

      The Manage Global External Functions role lets the user manage global external language functions. See External Libraries for more information about external functions.

      This role lets the user log into Couchbase Server Web Console.

      Role: Manage Global External Functions (query_manage_global_external_functions)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Query

      Can execute CREATE FUNCTION statements to create global external functions

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Execute Global External Functions

      The Execute Global External Functions role lets a user execute globally defined external functions. See External Libraries for more information about external functions.

      This role lets the user log into Couchbase Server Web Console.

      Role: Execute Global External Functions (query_execute_global_external_functions)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Query

      Can execute globally defined external functions

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Manage Scope External Functions

      The Manage Scope External Functions role lets the user create and drop external language functions defined at the scope level. When you grant this role, you choose the scopes where the user can manage external functions. See External Libraries for more information about external functions.

      This role lets the user log into Couchbase Server Web Console.

      Role: Manage Scope External Functions (query_manage_external_functions)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Query

      Can call globally defined external functions

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Execute Scope External Functions

      The Execute Scope External Functions role lets the user call external functions defined in a scope. When you grant this role, you choose the scopes where the user can call external functions. See External Libraries for more information about external functions.

      This role lets the user log into Couchbase Server Web Console.

      Role: Execute Scope External Functions (query_execute_external_functions)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Query

      Can call globally defined external functions

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Manage Sequences

      This role lets the user manage sequences for one or more scopes. See Sequence Operators for more information about sequences. When you grant this role, you choose the scopes where the user can manage sequences.

      This role lets the user log into Couchbase Server Web Console.

      Role: Manage Sequences (query_manage_sequences)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Query

      Can create and alter sequences in buckets assigned to them

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console. Cannot manage sequences in buckets they do have not assigned to them.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Use Sequences

      This role lets the user incorporate sequences into their queries in one or more scopes. When you grant this role, you choose the scopes where the user can use sequences. See Sequence Operators for more information about sequences.

      This role lets the user log into Couchbase Server Web Console.

      Role: Manage Sequences (query_use_sequences)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers

      Query

      Can use sequences in scopes assigned to them.

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console. Cannot manage sequences.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Query Manage System Catalog

      This role lets a user manage all system catalogs for query automatic workload reports using SQL++ statements.

      This role lets the user log into Couchbase Server Web Console.

      Role: Query Manage System Catalog (query_manage_system_catalog)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Query

      Can manage query workload system catalogs

      Cannot perform any other queries. Cannot use the Query Workbench in Couchbase Server Web Console.

      Settings

      View cluster settings

      Cannot view any other settings or change settings.

      Search Roles

      The following roles give users privileges to the Search Service features.

      Search Admin

      The Search Admin role lets the user manage the Search Service in one or more buckets. When you grant this role, you choose the buckets where the user can manage search.

      In versions of Couchbase Server earlier than 5.5, this role was named FTS Admin.

      This role lets the user log into Couchbase Server Web Console.

      Role: Search Admin (fts_admin)

      Resource

      Permissions

      Restrictions

      Servers

      Can list servers.

      Cannot view or edit server configuration or statistics. Cannot rebalance, failover, add, or remove servers.

      Buckets

      Can list buckets, scopes, and collections. Can view documents.

      Cannot edit documents or change bucket settings

      Settings

      Can view cluster settings

      Cannot view other settings nor change any settings

      Query

      None

      All

      Search

      Can add, edit, and drop Search indexes on the buckets they have access to.

      Cannot manage Search indexes of buckets they do not have access to.

      Search Reader

      The Search Reader role lets the user execute searches using Full-Text Search indexes in one or more buckets. When you grant this role, you choose the buckets in which the user can execute searches.

      In versions of Couchbase Server prior to 5.5, this role was referred to as FTS Searcher.

      This role lets the user log into Couchbase Server Web Console.

      Role: Search Reader (fts_searcher)

      Resource

      Permissions

      Restrictions

      Servers

      Can list servers.

      Cannot view or edit server configuration or statistics. Cannot rebalance, failover, add, or remove servers.

      Buckets

      Can list buckets

      Cannot read documents

      Settings

      Can view cluster settings

      Cannot view other settings nor change any settings

      Query

      None

      All

      Search

      Can use Search indexes in the buckets they have access to

      Cannot add, drop, or change settings for Search indexes

      Analytics Roles

      The following roles give uses privileges for the Analytics Service. See Analytics Service for more information.

      Analytics Reader

      The Analytics Reader role lets the user query all analytic datasets. For more information, see Analyze Large Datasets.

      This role lets the user log into Couchbase Server Web Console.

      Role: Analytics Reader (analytics_reader)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Settings

      View cluster settings

      Cannot view any other settings or change settings.

      Analytics

      Can read any analytic data. Can use the Couchbase Server Web Console’s Analytics query editor.

      Cannot change analytic configuration.

      Analytics Admin

      The Analytics Admin role lets users manage Analytics Service links, scopes, and datasets for all buckets. For more information, see Analyze Large Datasets.

      This role lets the user log into Couchbase Server Web Console.

      Role: Analytics Admin (analytics_admin)
      Resource Permissions Restrictions

      Servers

      List servers

      Cannot view configuration. Cannot add, failover, remove, modify services, or rebalance servers.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Analytics

      Can add or drop Analytics Service links, scopes, and dataset

      None

      Analytics Select

      The Analytics Select role lets the user query analytic datasets for one or more buckets, scopes, or collections. When you grant this role, you choose the buckets, scopes, and collections where the user can execute queries.

      This role lets the user log into Couchbase Server Web Console.

      Role: Analytics Select (analytics_select)

      Resource

      Permissions

      Restrictions

      Servers

      Can list servers.

      Cannot view or edit server configuration or statistics. Cannot rebalance, failover, add, or remove servers.

      Settings

      Can view cluster settings

      Cannot view other settings nor change any settings

      Analytics

      Can query analytics data in the buckets they have access to

      Cannot add or drop Analytic scopes, links, or collections or change their settings

      Analytics Manager

      The Analytics Manager role lets the user manage and query the analytic datasets for one or more buckets. They can also manage Analytics Service local links. When you grant this role, you choose the buckets where the user can manage and query analytics.

      This role lets the user log into Couchbase Server Web Console.

      Role: Analytics Manager (analytics_manager)

      Resource

      Permissions

      Restrictions

      Servers

      Can list servers.

      Cannot view or edit server configuration or statistics. Cannot rebalance, failover, add, or remove servers.

      Settings

      Can view cluster settings

      Cannot view other settings nor change any settings

      Analytics

      Can query analytics data in the buckets they have access to. Can manage analytics in these buckets, including local links and adding/dropping analytics collections.

      Cannot manage analytics in other buckets

      Eventing Roles

      These roles control a user’s access to the Eventing Service. Also, see Eventing Full Admin for the Eventing-related administrator role. For more information about Eventing, see Run a Function on Data Change.

      Eventing Manage Scope Functions

      The Eventing Manage Scope Functions role lets the user manage the eventing functions in one or more scopes. When you grant this role, you choose the scopes where the user can manage eventing functions.

      In addition to this role, the user must have the Data DCP Reader on the collections they want their functions to listen to. They must also have read and write permissions on one or more collections to store the function’s event data.

      This role lets the user log into Couchbase Server Web Console.

      Role: Eventing Manage Scope Functions (eventing_manage_functions)

      Resource

      Permissions

      Restrictions

      Server

      Can list servers

      Cannot view server settings or statistics. Cannot edit server settings, failover, or rebalance servers.

      Settings

      Can view cluster settings

      Cannot view other settings or change any settings

      Eventing

      Can add Eventing functions to a scope assigned to them. Can change eventing settings for the scopes.

      None

      XDCR Roles

      The following roles give users the ability to manage XDCR settings and features.

      XDCR Admin

      The XDCR Admin role grants the user the ability to manage XDCR connections.

      This role lets the user log into Couchbase Server Web Console.

      Role: XDCR Admin (replication_admin)
      Resource Permissions Restrictions

      Servers

      View configuration and statistics

      Cannot add, failover, remove, modify services, or rebalance servers

      Buckets

      List buckets, scopes, and collections

      Cannot create, drop, edit settings, read or write data

      Backup

      None

      All

      XDCR

      All

      None

      Security

      None

      All

      Settings

      View

      Change

      Logs

      View

      Collect Information

      Query

      None

      All

      Search

      None

      All

      Analytics

      None

      All

      Eventing

      None

      All

      Views

      None

      All

      XDCR Inbound

      The XDCR Inbound role lets the user create inbound XDCR streams for one or more buckets. When granting this role, you choose the buckets where the user can create inbound XDCR connections. Assign this role to the user that you’ll specify when creating an XDCR reference. See Create a Reference for more information.

      Versions of Couchbase Server prior to 5.5 called this role Replication Target.

      This role does not let the user log into Couchbase Server Web Console.

      Role: XDCR Inbound (replication_target)
      Resource Permissions Restrictions

      XDCR

      Can create inbound connections on buckets they have been granted permissions on.

      Cannot create outbound connections or alter other XDCR settings.

      Backup Roles

      The following role gives users the ability to backup and restore data. Also see the Administrative role Backup Full Admin.

      Data Backup & Restore

      The Data Backup & Restore lets users back up and restore data in one or more buckets. When you grant this role, you choose the buckets the user can back up. This role is not intended for interactive users. Grant this role to users for applications that need to back up and restore data.

      This role does not let the user access some important cluster-level data, so it cannot fully backup the cluster. See Bucket Level in the cbbackupmgr backup documentation for details.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Data Backup & Restore (data_backup)

      Resource

      Permissions

      Restrictions

      Buckets

      Can read, write, and manage buckets assigned to them.

      None

      Backup

      Can backup bucket data, bucket SQL++ metadata, and analytics

      Cannot backup other data

      Security

      Can view settings for SAML, certificates, encryption at rest, audits, and other settings

      Cannot change settings

      Indexes

      Can build, create, and list

      Cannot backup, read, or manage

      Bucket Analytics

      Can manage and select buvket analytics

      Cannot read bucket analytics

      Analytics

      Can select and back up analytics

      Cannot read analytics synonyms

      Mobile Roles

      The mobile roles support connections with the Sync Gateway and related features. See the Sync Gateway Introduction for more information.

      Sync Gateway

      The Sync Gateway role gives the user full access to the data Sync Gateway’s data stored in Couchbase Server. This role also lets the user manage indexes and read some cluster information. Only assign this role to the user that you create for the Sync Gateway to use when connecting to Couchbase Server. Choose one or more buckets that contain mobile data that you want this user to manage. See Configure Server for Sync Gateway for more information.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Sync Gateway (mobile_sync_gateway)
      Resource Permissions Restrictions

      Sync Gateway Data

      Can perform all actions on data (including flushing) and views on the Sync Gateway data stored in the Couchbase Server buckets you grant them access to. Can view settings of these buckets.

      Cannot change bucket settings

      Query

      Can execute queries on data in buckets containing Sync Gateway data

      None

      Indexes

      Add and drop indexes and view index statistics in the buckets containing Sync Gateway data

      None.

      Settings

      View cluster settings

      Cannot view any other settings or change settings

      Sync Gateway Architect

      The Sync Gateway Architect role lets the user manage Sync Gateway databases, users, and roles. You choose one or more collections, scopes, or buckets where the user can manage Sync Gateway data. This role also grants access to the Sync Gateway’s metrics via the /metrics REST API endpoint. For information about Sync Gateway users and roles, see Access Control Concepts.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Sync Gateway Architect (sync_gateway_configurator)
      Resource Permissions Restrictions

      Sync Gateway Data

      None

      Cannot read or write Sync Gateway application data

      Sync Gateway Users & Roles

      Can add, remove, and edit Sync Gateway users and roles

      None

      Sync Gateway Metrics

      Can read metrics

      Cannot change metric settings

      Sync Gateway Application

      The Sync Gateway Application role lets the user manage Sync Gateway users, roles, and data. It also allows the user to read and write application data through the Sync Gateway. You choose one or more collections, scopes, or buckets where this user can manage mobile users and roles. For information about Sync Gateway users and roles, see Access Control Concepts.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Sync Gateway Application (sync_gateway_app)
      Resource Permissions Restrictions

      Collection: Data

      Can read and write application data

      None

      Sync Gateway Users & Roles

      Can add, remove, and edit Sync Gateway users and roles

      None

      Sync Gateway Application Read Only

      The Sync Gateway Application Read Only role lets the user read Sync Gateway users and role settings. It also lets them read Sync Gateway data. For information about Sync Gateway users and roles, see Access Control Concepts.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Sync Gateway Application Read Only (sync_gateway_app_ro)
      Resource Permissions Restrictions

      Collection: Data

      Can read application data

      Cannot write application data

      Sync Gateway Users & Roles

      Can read Sync Gateway users and roles

      Cannot add, drop, or edit users or roles

      Sync Gateway Replicator

      The Sync Gateway Replicator role lets the user manage Sync Gateway replications.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Sync Gateway Replicator (sync_gateway_replicator)
      Resource Permissions Restrictions

      Sync Gateway Replication Collection

      Can read and write replication settings

      None

      Sync Gateway Dev Ops

      The Sync Gateway Dev Ops role lets the user manage the Sync Gateway’s node-level configuration. It also grants access to Sync Gateway’s /metrics endpoint for Prometheus integration.

      This role does not let the user log into Couchbase Server Web Console.

      Role: Sync Gateway Dev Ops (sync_gateway_dev_ops)
      Resource Permissions Restrictions

      Sync Gateway Node Configuration

      Can read and write node-level settings

      None

      Sync Gateway Metrics

      Can read metrics

      Cannot change metric settings