Access Control

Transcend allows for granular role-based access control to restrict what your organization members can or cannot do on your organization's Transcend account. Every route that we expose has the ability to be managed from the Users →, Teams → and Scopes → pages. This means the administrator of your account can dictate which views the users in your Transcend account can see, as well as which changes they can make. We call these access controls scopes.

Scope Tip: "This is a configurable scope!"

Throughout our docs, we will indicate when a section is referring to some set of scopes. Look for messages like this to determine how you can configure access control for certain features.

We break down every view we show, and action we allow into scopes. An administrator of your Transcend account can assign these scopes to individual members, or to teams of members within your organization. You can see the set of scopes and which users have access to those scopes on the Scopes → tab under "Administration" settings.

Scopes can also be assigned to API keys. The API keys can be given that same privileges as any member in your organization.

You can manage the assignment of scopes under individual users in the Users → section within Administration. You can manage the assignment of scopes to teams by going to the Teams → section within Administration.

A full list of available user scopes is available below. Note: some scopes grant access to other scopes. For example, the ability to "View Email Templates" is automatically granted when permissions are given to "Manage Email Templates". This scope dependency is described by the "Dependencies" column.

Every employee, partner, or person that should have a log in to your Transcend account is known as a member. By default, each member has no scopes. They cannot see any incoming Requests or private configurations for your organization. The only changes they can make are to their personal account settings.

In order for your members to start doing things like configuring your Privacy Center or Integrations or responding to Data Subject Requests you must assign them scopes.

You can manage and invite new "Users" on the Administration -> Users tab.

If you need to revoke access of a user in your Transcend instance, you can you click the trash icon next to the selected user on the Administration -> Users tab. If you are using Single Sign On, the easiest way to revoke access is to deactivate the user within your single sign on provider. This will prevent the user from having the ability to log in to Transcend.

If you have a need to programmatically remove a user from Transcend, you can leverage the EU Hosting GraphQL API or US Hosting GraphQL API with the following mutation:

mutation {
  removeUser(input: { email: "INSERT_EMAIL@transcend.io" }) {
    clientMutationId
  }
}

As a CURL, this would be the following for EU hosting (default hosting option):

curl 'https://api.transcend.io/graphql' -H 'Authentication: Bearer INSERT_API_KEY' -H 'Content-Type: application/json' -H 'Accept: application/json' --data-binary '{"query":"mutation {\n  removeUser(input: { email: \"INSERT_EMAIL@transcend.io\" }) {\n    clientMutationId\n  }\n}\n"}'

or the following for US hosting option:

curl 'https://api.us.transcend.io/graphql' -H 'Authentication: Bearer INSERT_API_KEY' -H 'Content-Type: application/json' -H 'Accept: application/json' --data-binary '{"query":"mutation {\n  removeUser(input: { email: \"INSERT_EMAIL@transcend.io\" }) {\n    clientMutationId\n  }\n}\n"}'

in the commands above, please replace:

• INSERT_API_KEY: a Transcend API key with the scope Manage Access Controls
• INSERT_EMAIL@transcend.io: the email address of the user to remove

It's common for similar groups of members to be assigned the same set of scopes. For this reason, we allow you to create teams of members, and assign scopes to everyone in that team. If you remove a member from a team, that member will lose the scopes it had from that team unless the member was also individually assigned those scopes. You can create, edit, and modify membership to teams in the "Administration" section under Teams →.

You can manage and invite new "Users" on from your profile icon in the bottom left, then "Administration", then Users → tab, and you can add the user to a specific team when they are invited, or retroactively.

When one of your employees logs into Transcend for the first time using their SSO login, if you expose some certain attributes to Transcend, the employee will be assigned to the Transcend team when their account is created, thus giving them a specific set of scopes by default.

You can enable the following SSO attribute mappings

In addition to mapping SSO attributes to a "Team" on Transcend, you can map SSO groups (AKA Okta Groups) to do the same. For organizations that already have groups set up, this is often the preferred method. For those without groups, attribute mapping is the preferred mapping. You must configure user access to the group within your SSO provider, and then map the group name to the Transcend team as shown in the image below. (Below, we are mapping the SSO group named "Engineering" to a Transcend team named "Developers").

You can make changes to the mapping between your SSO provider and Transcend Teams on the Teams → tab under Administration.

When a user is just in time provisioned and their SSO attributes do not map them to a team, the default behavior is that the user will have no scopes applied to them. If you want to set a default set of scopes for newly provisioned users, you can set a "Default Team" under Administration -> Single Sign On →. This team will be assigned to users that have no other teams provisioned to them. The newly created user will inherit the scopes of that team.

In some situations, it makes sense to have multiple Transcend accounts for different business units within a larger organization. For example, there may be some parent company operating over multiple child companies with independent brands and data sharing practices.

It is possible to configure a single SSO group that does just-in-time provisioning across multiple Transcend instances. This is done by:

1. Follow the instructions in the section above to map an SSO group or department to a team in the parent Transcend instance where your SSO settings were configured.
2. For each Transcend instance that you want to provision access to, switch into that Transcend instance and select the team created in (1) as the "Linked Team from Parent Account"