Search documentation

Search documentation pages and headings.

Skip to content

Getting started · How-to guide

Organizations

Understand organization roles and resource permissions.

Organizations are the top-level entity that groups users together. Each organization can have multiple members with different roles that determine what actions they can perform. This documentation covers the roles, permissions, and options involved with organizations.

Key Concepts#

  • Organization: A group or team that contains members and resources like courses, learners, and collections.
  • Member: A user who belongs to an organization with an assigned role.
  • Role: Defines what actions a member can perform within the organization.

Roles#

Kokobi project access defines four roles: Owner, Admin, Support, and Member. Owner and Admin have full project access, Support can impersonate learners for support purposes, and Member has read access to the core organization resources.

1. Member (Default)#

The Member role is designed for regular users who need to view organization content but don't require administrative privileges.

Most organization members should have the Member role.

2. Admin#

The Admin role has comprehensive permissions to manage all resources within the organization, except for certain owner-only privileges.

Only give the Admin role to trusted individuals who need full control over resources and organization settings.

3. Owner#

The Owner role has complete control over the organization with all administrative permissions plus ownership-specific capabilities.

The Owner role is given to the creator of the organization.

4. Support#

The Support role is narrowly scoped to learner impersonation for troubleshooting and assistance.

Project Permission Matrix#

The live matrix below is derived directly from Kokobi's project access configuration. It covers the Owner, Admin, Support, and Member roles, along with the maximum permissions available to user and organization API keys.

These project permissions protect Kokobi resources and API operations. Centralized Better Auth organization permissions, such as organization membership and role administration, are a separate authorization layer and are not represented in this matrix.

Role grants

ResourceActionOwnerAdminSupportMember
FolderfolderReadreadAllowedAllowedNot allowedAllowed
FolderfolderCreatecreateAllowedAllowedNot allowedNot allowed
FolderfolderUpdateupdateAllowedAllowedNot allowedNot allowed
FolderfolderDeletedeleteAllowedAllowedNot allowedNot allowed
CoursecourseReadreadAllowedAllowedNot allowedAllowed
CoursecourseCreatecreateAllowedAllowedNot allowedNot allowed
CoursecourseShareshareAllowedAllowedNot allowedNot allowed
CoursecourseUpdateupdateAllowedAllowedNot allowedNot allowed
CoursecourseArchivearchiveAllowedAllowedNot allowedNot allowed
CoursecourseDeletedeleteAllowedAllowedNot allowedNot allowed
CollectioncollectionReadreadAllowedAllowedNot allowedAllowed
CollectioncollectionCreatecreateAllowedAllowedNot allowedNot allowed
CollectioncollectionShareshareAllowedAllowedNot allowedNot allowed
CollectioncollectionUpdateupdateAllowedAllowedNot allowedNot allowed
CollectioncollectionArchivearchiveAllowedAllowedNot allowedNot allowed
CollectioncollectionDeletedeleteAllowedAllowedNot allowedNot allowed
LearnerlearnerReadreadAllowedAllowedNot allowedAllowed
LearnerlearnerCreatecreateAllowedAllowedNot allowedNot allowed
LearnerlearnerUpdateupdateAllowedAllowedNot allowedNot allowed
LearnerlearnerDeletedeleteAllowedAllowedNot allowedNot allowed
LearnerlearnerImpersonateimpersonateAllowedAllowedAllowedNot allowed
WebhookwebhookReadreadAllowedAllowedNot allowedAllowed
WebhookwebhookCreatecreateAllowedAllowedNot allowedNot allowed
WebhookwebhookUpdateupdateAllowedAllowedNot allowedNot allowed
WebhookwebhookDeletedeleteAllowedAllowedNot allowedNot allowed
OrganizationorganizationReadreadAllowedAllowedNot allowedAllowed
OrganizationorganizationUpdateupdateAllowedAllowedNot allowedNot allowed
DomaindomainReadreadAllowedAllowedNot allowedNot allowed
DomaindomainCreatecreateAllowedAllowedNot allowedNot allowed
DomaindomainDeletedeleteAllowedAllowedNot allowedNot allowed

API-key assignable permissions

ResourceActionUser keyOrganization key
FolderfolderReadreadNot allowedAllowed
FolderfolderCreatecreateNot allowedAllowed
FolderfolderUpdateupdateNot allowedAllowed
FolderfolderDeletedeleteNot allowedAllowed
CoursecourseReadreadNot allowedAllowed
CoursecourseCreatecreateNot allowedAllowed
CoursecourseShareshareNot allowedAllowed
CoursecourseUpdateupdateNot allowedAllowed
CoursecourseArchivearchiveNot allowedAllowed
CoursecourseDeletedeleteNot allowedAllowed
CollectioncollectionReadreadNot allowedAllowed
CollectioncollectionCreatecreateNot allowedAllowed
CollectioncollectionShareshareNot allowedAllowed
CollectioncollectionUpdateupdateNot allowedAllowed
CollectioncollectionArchivearchiveNot allowedAllowed
CollectioncollectionDeletedeleteNot allowedAllowed
LearnerlearnerReadreadNot allowedAllowed
LearnerlearnerCreatecreateNot allowedAllowed
LearnerlearnerUpdateupdateNot allowedAllowed
LearnerlearnerDeletedeleteNot allowedAllowed
LearnerlearnerImpersonateimpersonateNot allowedNot allowed
WebhookwebhookReadreadNot allowedAllowed
WebhookwebhookCreatecreateNot allowedAllowed
WebhookwebhookUpdateupdateNot allowedAllowed
WebhookwebhookDeletedeleteNot allowedAllowed
OrganizationorganizationReadreadNot allowedAllowed
OrganizationorganizationUpdateupdateNot allowedNot allowed
DomaindomainReadreadNot allowedAllowed
DomaindomainCreatecreateNot allowedAllowed
DomaindomainDeletedeleteNot allowedAllowed