# Custom roles in Salto KS
> A guide to creating, managing, and troubleshooting Custom Roles in Salto KS.


## What are Custom Roles in Salto KS? {#what-are-custom-roles-in-salto-ks}

Custom Roles in Salto KS are tailor-made roles with custom capabilities.
User roles are defined by the permissions they include, which enable specific actions and features.
Users with permission to manage Custom Roles can create unique roles by selecting which permissions to assign.
Custom Roles are used to delegate responsibilities across sites and support various workflows.
This feature is only available to customers with the Salto KS Pro subscription plan.

Custom Roles are supported in the Salto KS mobile app from version 9.1 onwards.
Users assigned a Custom Role must update to this version or later.
Older versions of the app do not support Custom Roles, and users may experience issues and be unable to use the app.
Default roles are not affected.

## How do I create a Custom Role in Salto KS? {#how-do-i-create-a-custom-role-in-salto-ks}

To configure a Custom Role in Salto KS, log in to the Salto KS web application and follow these steps:

1. Navigate to the left-hand sidebar and click on the **Roles** tab to view an overview of all the existing roles within that site.
2. On the top right-hand side, click the **Create Role** button to begin the step-by-step process of creating a Custom Role.
3. Enter the **Role name** and a **Description** of the Custom Role, then select an option for the role's starting permissions (see below).
4. Assign the required permissions.
   Permissions are grouped by feature.
   Toggle on permissions individually, or select **Enable all** to enable all required permissions on the right-hand side.
   Once all desired permissions have been enabled, click **Next**.
5. Select the **Role Access** by clicking the drop-down menu and first selecting which roles can access this role (**Can be accessed by**), followed by which roles this role can access (**Can access**, see below).
   Click the role individually or select **All**.
   Once finished, click **Next**.
6. In the final step, review the role details to verify that all information is correct.
   Once completed, click **Save** to create the Custom Role.

<!-- vale off -->
In step 3, select the **Start from scratch** option to build the role's permissions from nothing, or the **Duplicate role** option to copy the permissions of an existing role and edit them as needed.
<!-- vale on -->

## Why can I not see the option to create a Custom Role in Salto KS? {#why-can-i-not-see-the-option-to-create-a-custom-role-in-salto-ks}

The **Create Role** button is displayed only for sites with the Pro subscription.
If the button is not visible on the **Roles** tab, the site's subscription does not include the Custom Roles feature.

## How do I duplicate a Custom Role in Salto KS? {#how-do-i-duplicate-a-custom-role-in-salto-ks}

Duplicating an existing role creates a new role with the same permissions, which can be edited as needed.
A duplicate role must have a unique role name, as every role within a site requires a distinct name.

Duplicating a role can be done in one of two ways:

- On the **Roles** tab, click the **Create Role** button in the top right-hand corner.
On the first screen, add a **Role name** and **Description**, select **Duplicate role**, then select the role to duplicate from the drop-down menu.
  From there, the flow continues as if it were a new role, with the permissions preselected.
- On the **Roles** tab, find the role to duplicate, then click the three-dot icon in the **Actions** menu on the right-hand side.
  Select **Duplicate**, and the same flow appears, as if creating a new role with the permissions preselected.

## How can I edit the permissions of a Custom Role in Salto KS? {#how-can-i-edit-the-permissions-of-a-custom-role-in-salto-ks}

To edit a Custom Role in Salto KS, navigate to the **Roles** tab in the main menu.
Locate the Custom Role to edit and click the three-dot icon under the **Actions** menu on the right-hand side.
Follow the same steps as creating a Custom Role to edit the role name, description, permissions, or role access capabilities.
Once completed, click **Save**, and all users in that role will have their permissions updated.

## How do I assign a Custom Role to users in Salto KS? {#how-do-i-assign-a-custom-role-to-users-in-salto-ks}

To assign a Custom Role to a user in Salto KS, follow the normal Salto KS user creation flow.
When assigning a role to a new user, the Custom Role appears in the drop-down menu.
To assign the role to an existing user, edit the user, and the new Custom Role appears in the drop-down menu.
The Custom Role can be applied to individual users or assigned to multiple users at once.
For more information, see [Assigning a role to multiple users](/ks/general/assign-a-role-to-multiple-users).

## What happens if a Custom Role is disabled in Salto KS? {#what-happens-if-a-custom-role-is-disabled-in-salto-ks}

If a Custom Role is disabled in Salto KS, the user with permission to manage roles can no longer assign the role to additional users.
However, users already assigned the disabled role can continue to use it and retain their permissions.
To disable a role, navigate to the **Roles** tab, click the three-dot icon in the **Actions** menu on the right-hand side, and click **Disable**.

## Can I edit, disable, or remove a default role in Salto KS? {#can-i-edit-disable-or-remove-a-default-role-in-salto-ks}

No.
Salto KS offers a list of default roles, **Site Admin**, **Site Super User**, and **Site User**, with predetermined permissions.
It is not possible to edit, disable, or delete any of the default roles.
It is possible to edit the users who hold these roles, but not the roles themselves.

## Can a Custom Role be re-enabled if it was previously disabled in Salto KS? {#can-a-custom-role-be-re-enabled-if-it-was-previously-disabled-in-salto-ks}

Yes.
A Custom Role can be re-enabled if it was previously disabled.
Once enabled, the role is available to assign to new users with the same permissions.
To enable a role, navigate to the **Roles** tab, click the three-dot icon in the **Actions** menu on the right-hand side, and click **Enable**.

## Can a Custom Role be deleted in Salto KS? {#can-a-custom-role-be-deleted-in-salto-ks}

A Custom Role in Salto KS can only be deleted if it is not assigned to any users.
To delete a Custom Role, log in to the web app and navigate to the **Roles** tab.
Locate the role, click the three-dot icon in the **Actions** menu on the right-hand side, and select **Delete**.
Once deleted, the Custom Role cannot be recovered.

## What is the difference between "Can be accessed by" and "Can access" when creating a Custom Role in Salto KS? {#what-is-the-difference-between-can-be-accessed-by-and-can-access-when-creating-a-custom-role-in-salto-ks}

These settings determine user interaction boundaries.
They define the level of access other users have to this Custom Role, and the level of access this Custom Role has to other users.
This depends on both the other users' permissions and the permissions defined in the Custom Role.

The **Can be accessed by** field determines which roles can access and interact with this Custom Role.
Users with the appropriate permissions can assign, view, create, or edit users with this Custom Role.
This is a mandatory field.
Select a role to ensure that users with the appropriate permissions can assign, view, create, or edit this Custom Role.
If this field is left empty, the Custom Role cannot be assigned to users.

The **Can access** field determines which roles this Custom Role can access and interact with.
Users with the appropriate permissions can assign, view, create, or edit users with the roles defined here.

For example, when creating Custom Role A, a Site Admin selects only the **Site Admin** role in **Can be accessed by**.
In this case, only the Site Admin can view, create, or edit users with Custom Role A.

If the Site Admin also selects Custom Role B in **Can be accessed by**, users assigned to Custom Role B can view, create, or edit users with Custom Role A, provided Custom Role B has the appropriate permissions.

In **Can access**, the Site Admin selects Custom Role C and the Site User role.
Users assigned Custom Role A can then access users with Custom Role C and Site User roles.
If Custom Role A has the appropriate permissions, users with that role can assign, view, create, or edit users with Custom Role C and Site User roles.

## What is the difference between a Custom Role and the default Salto KS roles? {#what-is-the-difference-between-a-custom-role-and-the-default-salto-ks-roles}

Salto KS has three default roles, **Site Admin**, **Site Super User**, and **Site User**.
These roles have set permissions that cannot be changed.
A Custom Role allows a user to hold a role with specific and unique permissions.

- The **Site Admin** role has the most permissions across the site and can create, edit, or delete a Custom Role.
- The **Site Super User** role cannot create a Custom Role, but can continue to create other Site Super Users and Site Users.
- The **Site User** role does not change and holds the same permissions.

## What is the maximum number of Custom Roles I can create in Salto KS? {#what-is-the-maximum-number-of-custom-roles-i-can-create-in-salto-ks}

The Custom Roles feature is only available to sites with Salto KS Pro subscriptions.
The Pro subscription allows a maximum of five Custom Roles to be created.

## What are the permissions available when creating a Custom Role in Salto KS? {#what-are-the-permissions-available-when-creating-a-custom-role-in-salto-ks}

Permissions for Custom Roles in Salto KS define the features a user can access.
Enabling a permission defines what the role is allowed to do, and disabling it restricts the role from doing that action.

When creating a Custom Role, a list of features is displayed, each containing individual permissions.
For example, enabling **View accessible users** alongside **Create** and **Edit** allows a user to view and change other users.

Custom Roles can also include permissions for Entries, Incidents, Locks, Users, Credentials, Access Groups, Hardware, Sites, Floors, Subscriptions, License Plate Recognition, Activity Log, Roles, and Pods.

## Why does the Custom Role I created prevent certain features from working in Salto KS? {#why-does-the-custom-role-i-created-prevent-certain-features-from-working-in-salto-ks}

Certain Salto KS features require multiple permissions to be enabled to function correctly.
If a Custom Role is created without all the required permissions, certain features may not work properly and result in an error message or limited functionality.
If this happens, edit the Custom Role to enable all the missing permissions.