User permissions: sections, campaign groups and report fields
How to narrow an employee's access beyond their role: close sections, leave view-only access, limit campaign groups and hide report metrics.
The Permissions («Права») window is opened from Admin panel → Team («Админ-панель → Команда») with the Permissions button in the user's row. It has three kinds of restrictions: section access, allowed campaign groups and forbidden report fields. The Team section is visible to the owner and the admin.
General rules
- Restrictions are set for the Team lead («Тимлид Баеров»), Buyer («Баер»), Designer («Верстальщик») and Financier («Финансист») roles. The owner and the admin have no Permissions button.
- Restrictions only narrow the access that the role gives. They do not grant access to other people's campaigns.
- New permissions take effect from the user's next action. Their menu items update when they move to another page.
How to set restrictions
- Open Admin panel → Team.
- Click Permissions in the user's row. The “Permissions · login” («Права · логин») window opens.
- In the Section («Раздел») / Access («Доступ») table, choose a value for each section.
- Check Limit campaign groups («Ограничить группы кампаний») if the user needs only some of the groups.
- Enter the allowed groups in the field under the checkbox.
- Fill in Forbidden report fields («Запрещённые поля отчётов») if you need to hide metrics.
- Click Save permissions («Сохранить права»).
The window shows “Saved” («Сохранено»). To see how the panel looks for the employee, use log in as user.
To remove the restrictions, set the sections back to By role («По роли»), clear the checkbox, clear the forbidden fields and save the permissions.
Section access
For each of the eight sections, you choose one of three values; the default is By role.
| Value | What the user gets |
|---|---|
| By role | Access according to the role's rules |
| View («Просмотр») | The section opens, but nothing can be created, edited or deleted in it |
| No access («Нет доступа») | The section disappears from the menu, and its data is not loaded |
The sections:
| Section | What the restriction closes |
|---|---|
| Campaigns («Кампании») | Campaigns, streams, stream templates and campaign groups. With View, all campaigns, including the user's own, open with the “view only” («только просмотр») label |
| Automation rules («Автоматические правила») | The Automation rules section, which is available to a team lead and a media buyer. With View, rules and the log are visible, but you cannot create, edit, check or delete a rule. The section is also closed when the Campaigns or Reports section is closed to the user, or when forbidden report fields are set |
| Shared funnels («Общие воронки») | The Shared funnels section, which is available to a team lead and a media buyer. With View, the funnel list, version numbers and connected streams open, but you cannot view changes, create a funnel or a version, apply it to a stream, unlink a stream or delete a funnel. The section is also closed when the Campaigns, Offers or Landing pages section is closed to the user |
| Offers («Офферы») | Offers, their files and offer groups |
| Landing pages («Лендинги») | Landing pages and their files |
| Reports («Отчёты») | The report builder, the click log, saved reports, CSV exports, the campaign's click and conversion logs, and click counters in stream cards. With No access, Dashboard («Дашборд») also disappears from the menu |
| Domains («Домены») | The domain list, editing and checking a domain, and domain groups: the list, creation, deletion and the Share («Поделиться») button. With View, groups are visible, but you cannot create or delete them or open them to employees |
| Sources («Источники») | With No access, the menu item disappears, and the data of an individual source and the template catalog are not loaded. Choosing a source in the campaign settings remains: for it, the source's name, parameters and postback summary are loaded. View is no different from By role: sources are created and edited only by the owner and the admin |
With View for the Reports section, the user builds reports and exports CSV. They cannot save, edit or delete saved reports, and they cannot delete exports.
The data of a closed section is not loaded in the other sections either:
- Offers or Landing pages — the list of offers or landing pages in the stream window is empty;
- Domains — only the main traffic domain remains available for selection in the campaign parameters;
- Campaigns — reports show the campaign's ID instead of its name;
- Reports — the Campaigns, Offers and Landing pages lists have no metrics, and on the campaign page the summary and the stream click counters show 0.
In the trash, a team lead and a designer do not see the items of a closed section and do not restore the items of a section set to View.
Limiting campaign groups
The Limit campaign groups checkbox leaves the user only the campaigns from the listed groups. The checkbox is cleared by default. The fields from the table appear once you check it.
| Field | What to enter |
|---|---|
| Allowed groups — one per line. Empty: no campaigns. («Разрешённые группы — по одной на строку. Пусто: ни одной кампании.») | Group names exactly as in the campaigns, case-sensitive, each on a new line. Up to 200 groups |
| Allow campaigns without a group («Разрешить кампании без группы») | Check it if the user needs campaigns that have no group set |
How the restriction works:
- Campaigns outside the allowed groups are not visible in the list and do not appear in the user's reports. By direct link, the panel responds “campaign not found” («кампания не найдена»). This applies both to the user's own campaigns and to the ones shared with them.
- A campaign can be created or moved only into an allowed group; otherwise the panel responds “Campaign group unavailable” («Группа кампании недоступна»). Without Allow campaigns without a group checked, you cannot create a campaign without a group.
- A team lead cannot rename, merge or delete campaign groups: “Renaming shared groups is unavailable when groups are limited” («Переименование общих групп недоступно при ограничении групп»).
- Permissions store group names. After you rename a group, enter its new name in the permissions.
An enabled checkbox with an empty group list and without Allow campaigns without a group checked closes all campaigns to the user.
Forbidden report fields
The Forbidden report fields field lists the keys of the columns and groupings that are closed to the user. The example from the field's hint: revenue, cost, ip.
- Keys are separated by commas or spaces. Up to 100 keys.
- A key consists of lowercase Latin letters, digits and
_, starts with a letter and is up to 80 characters long. - Any report metric or grouping key works. Built-in metric keys are in the metrics table, and grouping keys are in the Groupings section. For a custom metric, it is the value of the Key (Latin) («Ключ (латиница)») field.
A forbidden field cannot be chosen as a column or a grouping, and you cannot sort or filter by it. In the report builder, such fields are removed from the lists.
Dependent metrics
The metrics calculated from a field are closed together with it:
| Forbidden | Also closed |
|---|---|
cost | profit, profit_expected, roi, roi_expected, cpa, cpl |
revenue | profit, roi, epc |
revenue_expected | profit_expected, roi_expected |
profit | roi |
profit_expected | roi_expected |
clicks | lp_ctr, cr, epc |
lp_clicks | lp_ctr |
conversions | cr, cpa |
leads | approval, cpl |
sales, rejected | approval |
bots and bot | Closed together |
unique_clicks and unique | Closed together |
click_id | The Subid (click id) filter |
ip | The IPv4 only («Только IPv4») and IPv6 only («Только IPv6») filters |
connection | proxy |
referer | empty_referer |
A custom metric is closed if its formula contains a forbidden field, including a metric with capital letters in its key. Columns by conversion type are closed when any of the conversions, revenue, leads, sales and rejected fields is forbidden.
What is unavailable with forbidden fields
With any forbidden field:
- the Reports section has no Click log («Клик-лог») tab;
- in campaign stats, the Click log («Лог кликов») and Conversion log («Лог конверсий») tabs show “Detailed statistics are unavailable when fields are restricted; use the report builder” («Детальная статистика недоступна при ограничении полей; используйте конструктор отчётов»);
- click counters in stream cards show 0, and the Recent clicks («Последние клики») block on the dashboard is empty;
- in the stream window, “Counters temporarily unavailable” («Счётчики временно недоступны») is shown instead of the click cap counters.
Some screens request a fixed set of metrics. If at least one of them is closed, the metrics are not loaded: the dashboard and the lists show a message, and the summary shows 0.
| Screen | Metrics |
|---|---|
| Dashboard | clicks, conversions, leads, sales, lp_clicks, revenue, cost, profit, roi, cr |
| The Campaigns, Offers and Landing pages lists | clicks, leads, sales, cr, revenue, cost, profit, roi and the columns enabled in the table |
| The summary on the campaign page | clicks, conversions, cr, revenue, profit, roi |
The report builder and CSV export work with the remaining fields. On the Report («Отчёт») tab of campaign stats, you remove a forbidden metric with the Columns («Колонки») button.
After the permissions are saved, this user's finished background CSV exports can no longer be downloaded: “Access rights have changed. Create a new export.” («Права доступа изменились. Создайте новую выгрузку.») For details, see Why the file became unavailable after permissions changed.
Whose data each role sees in reports
Restrictions are applied on top of role-based visibility. For whose campaigns each role sees, see Who sees which campaigns.
A financier sees all of the team's campaigns, and only the Reports section is available to them in the panel. Campaign groups and forbidden fields restrict them the same way as the other roles.
API tokens
API tokens are created by the owner and the admin, so the restrictions from the Permissions window do not apply to them. The fields available to a Summary reports («Сводные отчёты») token are listed in Summary reports access limits.
Expired license
With an expired license, the panel is closed to all users regardless of their permissions. Users with restrictions also see the license status screen — see License expiry.
Messages for a user with restrictions
“Access to the section is restricted by the administrator” («Доступ к разделу ограничен администратором»)
The section is closed or set to View, and the user is trying to change something. The dashboard that opens after login also shows this message if the Reports section is closed.
“Section unavailable: check your role, campaign access and statistics restrictions” («Раздел недоступен: проверьте роль, доступ к кампаниям и ограничения статистики»)
This message appears in the Automation rules and Shared funnels sections. The causes for a team lead and a media buyer:
- the Campaigns section is closed, or it is set to View and the user is changing something;
- for automation rules — the Reports section is closed or forbidden report fields are set;
- for shared funnels — the Offers or Landing pages section is closed.
These sections are unavailable to a designer and a financier with any permissions: they have no menu items for them. For a designer, the page opened by direct link shows “The section is unavailable for your role.” («Раздел недоступен для вашей роли.»), and the panel redirects a financier to the Reports section.
“Access to reports is restricted by the administrator.” («Доступ к отчётам ограничен администратором.»)
No access is set for the Reports section, and the user opened the reports page by a link.
“Could not load the statistics. Check the reports and try again.” («Не удалось загрузить статистику. Проверьте отчёты и повторите попытку.»)
This message appears in the Campaigns, Offers and Landing pages lists: the Reports section is closed, or the list's metrics include a closed field.
“The cost field or its source metrics are restricted by the administrator” («Поле cost или его исходные показатели ограничены администратором»)
The report contains a closed field. The message shows that field's key in place of cost. Remove the column, grouping, sorting or filter with this field.
Errors when saving permissions
These messages appear in the Permissions window for the owner or the admin.
“Permissions have changed. Reload them before saving.” («Права изменились. Перечитайте их перед сохранением.»)
While the window was open, someone else saved this user's permissions. Close the window, open it again and repeat your edit.
“Invalid field” («Некорректное поле»)
Forbidden report fields contains a key that is not among the metrics and groupings, or a key that does not follow the rules.
“Invalid restrictions” («Некорректные ограничения»)
There are more than 100 forbidden fields or more than 200 allowed groups, counting the Allow campaigns without a group option.