# Roles and permissions

The SAS Portal API has several roles, defined below, each of which gives a user permission to
make certain API calls. Roles are assigned to the user's Google Account.

The first user of a SAS customer's organization is the Admin, who's automatically added during
the sign-up process. The Admin can then add other users and assign them roles, including the Admin
role.

> [!NOTE]
> **Note:** Currently, user role assignment is done by the SAS API Support team. If you need to assign roles to users, send your requests to [sas-api-support@google.com](mailto:sas-api-support@google.com) and indicate the Google Account and role needed in a CSV file.

## User roles

There are two roles that can be assigned to users:

- [`role_admin`](https://developers.google.com/spectrum-access-system/guides/roles-and-permissions#admin)
- [`role_cpi`](https://developers.google.com/spectrum-access-system/guides/roles-and-permissions#cpi)

> [!NOTE]
> **Note:** Each user can be assigned to *one or more* of these roles.

### role_admin

This role has full administrative privileges for all of the child
[resources](https://developers.google.com/spectrum-access-system/guides/resource-management) under the parent resource to which it has
been granted access. They set up the organization's structure within the SAS Portal and manage user
access.

### role_cpi

This role is for users that are Certified Professional Installers (CPIs). To claim this role,
users need to prove that they have an active CPI certification. They do so with the
[`ValidateInstaller()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/validate)
method. Only users with a validated `role_cpi` role can use the
[`SignDevice()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/signDevice)
method to submit the installation parameters of CBSDs that require CPI installation.

## Methods

The following table shows which roles can use each type of method:

| Methods | Roles |
|---|---|
| [`GetCustomer()`](https://developers.google.com/spectrum-access-system/reference/rest/customers/get) | `role_admin` `role_cpi` |
| [`ListCustomers()`](https://developers.google.com/spectrum-access-system/reference/rest/customers/list) | `role_admin` `role_cpi` |
| [`CreateDevice()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/create) | `role_admin` `role_cpi` |
| [`GetDevice()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/get) | `role_admin` `role_cpi` |
| [`ListDevices()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/list) | `role_admin` `role_cpi` |
| [`UpdateDevice()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/patch) | `role_admin` `role_cpi` |
| [`CreateSignedDevice()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/createSigned) | `role_admin` `role_cpi` |
| [`UpdateSignedDevice()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/updateSigned) | `role_admin` `role_cpi` |
| [`GenerateSecret()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/generateSecret) | `role_admin` `role_cpi` |
| [`ValidateInstaller()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/validate) | `role_admin` `role_cpi` |
| [`SignDevice()`](https://developers.google.com/spectrum-access-system/reference/rest/customers.devices/signDevice) | `role_cpi` (validated) |