Merchant View roles

What each role can do on the Merchant View Operations screens, button by button.

Everyone sees everything; the role decides the actions

Admin, Support and Support (read-only) all see the same screens and the same data. The role only decides which of the buttons below a user can use.

Roles are the security, options are the layout

The role decides what a user can do. For an embedded session it is the session.teams value on the deep link, and a deep link can never give more than the session that created it holds. Shuttle checks the role on the server for every action, so a button a role cannot use is refused however the request is sent, including by someone replaying the screen's own calls.

Merchant View options (features, such as refund) only decide which buttons are shown. They never grant or remove a permission. To stop a user refunding, give them a role that cannot refund; hiding the button is not enough.

The full list by operation is in Roles and permissions.

Who can use each button