Roles and permissions

A role is a group of permissions which you assign to a user. Each permission controls access to a page or parts of a page in the Merchant Admin Interface (MAI). If you assign a role to a user, they can access the pages controlled by the permissions associated with that role. You can pick and choose which roles to assign to a user.

The available roles and associated permissions are listed below in the order in which they appear in the Creating a user page that is used to assign roles to users. Note that all roles are listed twice in the Creating a user page - once for the production and once for the test environment, so you can assign a user the same role for both environments or just for one or them. However, they are described once only below.

For more information refer to Test and production roles. For details about assigning roles, refer to the How does User Management work? page.

Roles

Role	Description
Call center	Full access to the Hosted Call Centre Application interface. This role will only appear if your organisation uses the Hosted Call Centre service - an optional service used to capture and process payments in mail order / telephone order sales channels. The Hosted Call Centre Interface is a separate interface from the Merchant Admin Interface. Call Centre operators may not require access to the MAI in order to perform their role. However, if you want them to be able to maintain their own password they will need access to the User Profile page in the MAI (an option under Profile). To do so, you must at least assign the Monitor and Monitor Profile roles, in addition to the Call Centre role (that is, the Monitor Profile role for the production environment not the one labelled test).
Manage	Access to the Merchant Admin Interface including its Help pages, the ability to switch the language in which information is presented and access to the User Profile page (in order to be able to change the password used to login). You must assign this role when you want to assign any of the other 'Manage’ roles. You must assign either the Manage or the Monitor role in order for the user to login to the Merchant Admin Interface.
Manage – command batch	Full access to the Command Batch page that enables you to review the status of: orders sent to the payment service using XML order statements in the batch service model and/or refunds, cancellations or manually initiated payment captures) XML order modifications Command Batch page is an optional service - if your organisation does not use it, this role will not appear. Typically these services are used by customers in automating data exchange between their systems and the payments service and as such it will typically be IT / administration staff who would need access to the command batch page to investigate processing status of data which 'end users' will be viewing through other systems. (The Command Batch page does not include information about orders sent using the Direct or Redirect service models or transactions initiated via the Merchant Admin Interface - such transactions are reported in the Orders and Payments pages of the Merchant Admin Interface.)
Manage – disputes	Full access to the Dispute Management pages through which we report details about payments that have been disputed by shoppers and where you can supply information requested by the card issuer involved in the dispute. These pages are typically used by selected staff involved in the completion of shoppers orders and/ or the processing of payments/ refunds to shoppers. Dispute Management is an optional service. This role will only appear if we are settling funds to you (if you have a WorldDirect account). If funds are settled directly to you by your acquiring bank, disputed payments and associated requests for information from card issuers are dealt with by your acquiring bank and we are not involved. (Funds: that is, the monies we collect from your shoppers and process on your behalf.)
Manage – financial status	Full access to the Financial Status page that provides details of the monies we have processed for you and have/ will be transferred to your bank account. Typically this will be used only by senior staff involved in the management and accounting of the business our payment service is supporting. This role will only appear if we are settling funds to you (if you have a WorldDirect account). If funds are settled directly to you by your acquiring bank, the Financial Status page will not appear. (Funds: that is, the monies we collect from your shoppers and process on your behalf.)
Manage – payments	Read-only access to the Orders and Payments pages, including the ability to view orders and associated payments we are processing for you. Contact your Relationship Manager or corporatesupport@worldpay.com if you want to capture and cancel individual payments manually.
Manage – payout	The ability to manage client payout. This role will only appear if your organisation uses client payout, an optional cash disbursement facility that allows you to pay your customers and/or suppliers from the balance held for you in the system.
Manage – payments (bulk capture)	Full access to the Payments and Bulk Capture pages including the ability to manually capture and cancel transactions, list and view payments and payment and order details and bulk capture transactions.
Manage – profile	Full access to the Account pages used to configure the more technical / system-oriented aspects of the way your organisation uses our payment service - your XML password, whether payments are captured immediately after authorisation or if there is a delay, for example - as well as name and address information for key contacts in your organisation and company details. Typically this role will be assigned to IT / administration staff responsible for the running / maintenance of our payment service within your organisation.
Manage – referral	Full access to the Referrals page including the ability to list and to authorise (that is, accept) payments that have been refused by the card acquirer with a status REFERRED. (Referred payments can be authorised once an authorisation code has been obtained from the card issuer). This role only appears if your organisation is using our optional Referred Payments service. Typically used by the senior staff involved in fulfilling the your shoppers orders / dealing with shopper queries. The Monitor Referrals role would be more widely available to your operational staff.
Manage – refunds	The ability to make refunds, including specifying the amount of the refund, using the Payment Details page. Typically used by the senior staff involved in fulfilling your shoppers orders / dealing with shopper queries. The Monitor Payments role would be more widely available to your operational staff.
Manage – reports	Full access to the Reports page used to view / download a range of standard reports and graphs, in a choice of formats. (Access to the Financial Reports page is controlled by the Manage and/or Monitor Financial Reports roles. )
Manage – risk editor	Full access to the Risk Management pages in order to configure the way the Risk Management Module screens transactions and thereby affecting whether payments are accepted or rejected. In particular the Risk Editor enables a user to edit the risk score to be generated when a payment fails a specified check carried out by Risk Management and to add card / account numbers, email and IP addresses to stop lists. Typically, this role will be assigned to IT / administration staff responsible for the running / maintenance of our payment service within your organisation who will configure the Risk Editor on behalf of the staff involved in the management and accounting of the business. Risk Management is an optional service - if your organisation does not use it, this role will not appear.
Manage – users	Access to the User Management page used to create, list, edit and de-activate users set up by you - but not the ability to list edit or de-activate users created by others. This role also controls access to the User Management Policy page which appears under the User Management option in the Merchant Admin Interface and the ability to view and edit user management policy.
Manage – users (any user at own admin level)	Access to the User Management page used to create, list, edit and de-activate users plus the ability to create, edit and de-activate all users created under the same administration code (regardless of who created those users initially). In most organisations this will mean the ability to modify any user since most organisations have only one Worldpay administration code. This role is recommended for organisations whose merchant codes cover the same or similar areas of the organisation (merchant codes that are not specific/linked to different regional, business or trading areas, for example), and whose users have access to multiple merchant codes and need the ability to manage users from other merchant codes. It should only be allocated if the user needs to modify the permissions of any users from other merchant codes, instead of just the users they have themselves created. For more information, please refer to The Administrator and the User Hierarchy.
Manage – users (any user at own merchant level)	Access to the User Management page used to create, list, edit and de-activate users, plus the ability to change and deactivate users who have access to any of the same merchant codes (accounts) they themselves have access to (regardless of who created that user initially). The user assigned this role can modify another user even if that user also has access to other merchant codes that the user assigned this role does not have. For example, if the user assigned this role has access to a merchant code MYCOGBP (only), they can create, edit and deactivate a user that has access to MYCOGBP, MYCOEUR and MYCOUSD. This role is recommended for larger organisations whose merchant codes represent distinct or separate parts of the organisation (are linked to different regional, business or trading areas, for example) and whose users have access to single merchant codes and do not need the ability to edit users from other merchant codes. It should only be allocated if the user needs to modify the permissions of any users from the same merchant code, instead of just the users they have themselves created. For more information, please refer to The Administrator and the User Hierarchy.
Monitor	Read-only access to the Merchant Admin Interface including its Help pages, the ability to switch language and access to the User Profile page (in order to be able to change the password used to login). You must assign this role when you want to assign any of the other ‘Monitor’ roles. You must assign either the Manage or the Monitor role in order that the user can login to the Merchant Admin Interface. And, if you are creating a user who only needs to be assigned test roles or the Call Centre role, you must also assign the Monitor and Monitor- Profile roles for the production environment (not the one labelled test ) in order that they will be able to login to the MAI successfully and be able to change their own login password using the User profile page.
Monitor – command batch	Read-only access to the Command Batch page that enables you to review the status of either of the following: orders sent to the payment service using XML order statements in the batch service model refunds, cancellations or manually initiated payment captures) XML order modifications
Monitor – disputes	Read-only access to the Dispute Management pages through which we report details about payments that have been disputed by shoppers - but this role excludes the ability to supply information requested by the card issuer involved in the dispute - to do this a user needs the Manage Dispute role. Typically used by staff involved in the completion of shoppers orders and/or the processing of payments / refunds to shoppers. This role will only appear if we are settling funds to you - if funds are settled directly to you by your acquiring bank, disputed payments and associated requests for information from card issuers are dealt with by your acquiring bank and we are not involved. (Funds: that is, the monies we collect from your shoppers and process on your behalf).
Monitor – financial status	Read-only access to the Financial Status page that provides details of the monies we have processed for you and have / will be transferred to your bank account. Typically, this role will be used only by staff involved in the management and accounting of the business our payment service is supporting. This role will only appear if we are settling funds to you (if you have a WorldDirect account) - if funds are settled directly to you by your acquiring bank, the Financial Status page will not appear. (Funds: that is, the monies we collect from your shoppers and process on your behalf.)
Monitor – payments	Read-only access to the Orders and Payments pages to list and sort the orders and associated payments we are processing for you but excluding the ability to capture and cancel individual payments manually. Typically used by the senior staff involved in fulfilling your shoppers orders / dealing with shopper queries.
Monitor – payout	The ability to view client payout. This role will only appear if your organisation uses client payout, an optional cash disbursement facility that allows you to pay your customers and/or suppliers from the balance held for you in the system.
Monitor – profile	Read-only access to the Account pages used to configure the more technical / system-oriented aspects of the way your organisation uses our payment service. Typically this role is assigned to senior operational staff who need to be aware of / need to be able to check contact information and system settings but not change them directly.
Monitor – referral	Read-only access to Referred Payments page to list payments that have been refused by the card acquirer with a status REFERRED - but not to authorise (that is, accept) their acceptance. This role will only appear if your organisation is using our optional Referred Payments service. Typically used by the staff involved in fulfilling your shoppers orders / dealing with shopper queries with the more senior being assigned the Manage Referrals role.
Monitor – reports	The ability to generate the reports listed in the Reports page. (Access to the Financial Reports page is controlled by the Monitor Profile role.)
Monitor – risk editor full access	Read-only access to the Risk Score Editor page to see which risk scores are applied to particular types of risk check and if a card, email address or IP address are included in Stop lists - but not to change any of these. Typically this role will be assigned to staff involved in fulfilling your shoppers orders / dealing with shopper queries. Risk Management is an optional service - if your organisation does not use it, this role will not appear.
Monitor – users	Read-only access to the User Management page in order to list current users - but no access to create, edit or delete users.

Test and production roles

All roles are listed twice in the Create User page - once for the production and once for the test environment so you can assign a user the same role for both environments or just for one or them. To provide your users with access to the test environment you simply assign selected 'test' roles to them in the user profile. The roles for the test environment are labelled 'test' and shaded in yellow while the roles for the production environment are shaded blue.

The two sets are identical in both name and the way they work but the tasks that can be carried out in the test and production environments are not identical. For example, certain settings in the Profile pages can be seen in test environment but can only be changed when using the Profile page in the production environment. User Management does not change this situation even when the Manage Profile role is assigned, although roles are still used to control access to the pages.

Access to the test environment only

To provide a user with access to the test environment only, as well as assigning Test roles to them, you must at least assign them the Monitor role for the production environment. Although this will enable them to login to the production environment as well as the test environment, it will not enable them to access any pages in the production environment other the User Profile page (where they can change their own login password) and Help pages.

Guide feedback?
Email us at: guides@worldpay.com