Skip to navigation
AppsService RequestsMake services available

Access control in Service Requests

Service Requests uses role-based and group-based permissions. Roles control access to the application and its data. Groups control access to individual services.

To set roles and groups, use Admin Essentials in Itential Platform. In Authorization, assign roles to users and groups. For more information, see Authorization.

Permissions required

To see and request a service, you need the following permissions:

  • service-requests:write: Grants access to the Service Requests page and lets you submit and schedule requests.
  • triggers:write: Grants access to the data for the manual triggers that Service Requests presents as services.

Which services you can see

Beyond the permissions, groups determine which services you see. Each service takes its read and write groups from its automation. You set these groups in the automation in Operations Manager. You can’t set them in Service Requests.

  • If the automation has no read groups, everyone with the service-requests:write and triggers:write permissions sees the service.
  • If the automation has read groups, you must also be in one of its read or write groups to see the service.

Services that you aren’t authorized to request don’t appear in Service Requests. For more information about setting groups, see Access control for automations.

What access allows

Being in a read group is enough to request a service and to create a schedule for it.

To edit, pause, resume, or delete a schedule, you must be in one of the write groups of the automation. This applies to schedules that other users created, too.

If the automation has no groups at all, anyone with the service-requests:write permission can also edit, pause, resume, and delete its schedules.

If your access to a service is revoked, you can’t request the service again, but the requests that you already made remain visible in All Requests.

Limit who can use Service Requests

To prevent a user from seeing Service Requests, don’t grant them the service-requests:write permission. Users who run automation only from Operations Manager or the API don’t need the permission.

Next steps