About user roles and permissions

This section provides details about the permissions available to each role on the Veracode Platform. To see which roles are often relevant to different users in your organization, see Common roles for user accounts.

To grant access to the Veracode APIs, administrators assign the necessary API roles to users with an API user account. To see the roles assigned to your account, select Your Account from the top navigation menu in the Veracode Platform.

Important

Do not share your account credentials for the Veracode Platform with other users.

Administrator

Can manage users, teams, and SAML settings. Administrator access can be granted by Veracode Technical Support or, if your organization uses SSO with IdP data preferred, through a SAML assertion. A user with both the Administrator and eLearning roles is considered an eLearning administrator and can manage Veracode eLearning tasks. Can navigate the Package Firewall UI and copy access tokens, but cannot create or delete firewalls or modify exceptions or policies.

note

You can't assign both the Administrator and Team Admin roles to a user account.

Analytics Creator

Can access Veracode Analytics, where the user can view scan metrics of applications in the user's team portfolio, and create or edit custom reports.

Creator

Can create, edit, and delete workspaces and application profiles, as well as request and delete scans for applications belonging to the user's teams. Can only create workspaces and application profiles for teams the user belongs to. Can assign workspaces and applications to teams. Can allow next-day consultations for an application. Can schedule consultation calls for scan configurations. Can view the list of workspaces and applications they can access. Can also promote a sandbox scan to a policy scan and delete sandbox scans.

The Creator role can be assigned for specific scan types or for all scan types. In addition, if a user account is restricted to specific scan types, they can only request scans of those types.

Delete Scans

Can delete scans.

eLearning

Can access Veracode eLearning courses, assessments, and/or the Knowledge Base.

note

Assigning a role to an eLearning user (learner) consumes one of your purchased Veracode eLearning seats when the learner launches a course. If a learner does not launch a course, you can assign the role to another user. You can only assign as many roles as you have purchased seats.

Executive

Can view Veracode Analytics and reports for all applications. Users with the Executive role must also have the eLearning role to access the Veracode eLearning summary reports. Can view all the applications. Can schedule consultation calls for policy scan results.

Free Trial Admin

Can edit users and teams in their organization. Can create up to nine additional users and four additional teams in the free trial organization. Can submit a support request. Can access DAST in the Veracode Platform. There can only be one free trial administrator in each free trial organization.

Free Trial User

Can edit their user account. Cannot add, edit, or delete users or teams in their organization. Can submit a support request. Can access DAST in the Veracode Platform.

Greenlight IDE User

Can access the Veracode Greenlight plugin in your IDE, perform Greenlight scans, and review Greenlight scan results. This role is only available to organizations that have active Veracode Greenlight subscriptions.

Mitigation Approver

Can approve mitigations for flaws. Can view the list of accessible applications. Can modify exceptions for a Package Firewall.

Policy Administrator

Can access the Policies page to create and edit policies, set default policies and notification rules, and assign policies to applications. When assigned with the Creator or Security Lead role, can change policy assignments for individual applications using the application profile. Can create a Package Firewall and modify its policies.

Reviewer

Can access reports and flaw details for applications that belong to user teams and propose mitigations, but cannot access the review modules page. Can review scan results and scan reports for sandboxes. Can view the list of accessible applications. Can schedule consultation calls for policy scan results. Can navigate the Package Firewall UI and copy access tokens, but cannot create or delete firewalls or modify exceptions or policies. Can access EASM and view results, but cannot start a scan.

Sandbox Administrator

Can create development sandboxes for scanning code in development for applications associated with the user account. For applications which the Sandbox Administrator can access, can edit or delete development sandboxes and propose mitigation comments.

note

You use the Sandbox Administrator role in addition to another role (Creator, Submitter, Reviewer, or Security Lead).

Sandbox User

Can create and edit development sandboxes that enable scanning code in development for applications that belong to the user teams. Can scan code within a development sandbox, delete their scan, review results of a sandbox scan, add comments, and propose mitigations. Can schedule consultation calls for sandbox scan results. You can promote the sandbox scan to a policy scan, which counts toward your policy compliance score, if you:

• Have the Sandbox User role with the Creator or Submitter role
• Have All Scan Types or Static Scan selected

Security Insights

Can access Veracode Analytics and Reporting API, where the user can view scan metrics of applications in the user's team portfolio and custom reports. To create or edit dashboards, you must have the Analytics Creator role. This role may be team-restricted, allowing users to access Analytics data only pertaining to the teams they are a part of.

Security Lead

Can create, edit, and delete application profiles. Can view Veracode Analytics, reports, and flaw details for all applications. Can submit applications and approve scan requests made by Creators and Submitters. Can assign applications to teams. Can review all applications and scans and receive all related notifications without restrictions or team assignment limitations. Can approve next-day consultations for an application. Can schedule consultation calls. Can promote a sandbox scan to a policy scan. Can create or delete a Package Firewall and modify its exceptions and policies. Can start an EASM scan.

note

You can assign the Security Lead role for all scan types or only for specific scan types. A scan type restricted assignment limits the type of scans you can create.

Submitter

Can request scans for applications that belong to the user’s teams, access the review modules page, and upload binaries. Can view the list of accessible applications. Cannot create, edit, or delete applications or delete scans. Vendors receiving a third-party scan request must accept it before submitting a scan. Can promote a sandbox scan to a policy scan. Can create, rename, and delete agents and regenerate agent tokens in Veracode Software Composition Analysis (SCA). Can schedule consultation calls for scan configurations. Can navigate the Package Firewall UI and copy access tokens, but can't create or delete firewalls or modify exceptions or policies.

note

You can assign the Submitter role for all scan types, or only for specific scan types. A scan type restricted assignment limits the type of scans you can submit.

Team Admin

Can manage users, including creating new users, resetting passwords, and updating roles. Can only view or manage users who are in the teams that the team admin manages and do not belong to any team that the team admin does not manage. Can add or remove team memberships from a user who is in one of the teams managed by the team admin. Cannot add users to teams that the team admin does not manage. Team admins cannot edit the roles for users who have the Administrator, Executive, Policy Administrator, Security Lead, Team Admin, or Workspace Administrator roles. Cannot create teams or business units, both of which require the Administrator role. When the administrator creates a user with the Team Admin role, the administrator assigns team membership to that user. Team admin for Security Lab users can add or remove learners from their teams.

note

You can't assign both the Administrator and Team Admin roles to a user account.

Vendor Manager

Can view the list of all third-party vendors for the organization. This role may not be available for your account.

VRM Admin

Can create, read, update, and delete dashboards and connectors in Veracode Risk Manager (VRM). Can create tickets in VRM. Does not require team membership to view VRM data.

VRM Guest

Has read-only access to VRM dashboards and connectors. Can view data only for applications assigned to their teams.

VRM Supervisor

Has read-only access to VRM dashboards and connectors. Can create tickets from the Issues and Solutions pages. Does not require team membership to view VRM data.

VRM Team Admin

Can create, read, update, and delete dashboards and connectors in VRM. Can create tickets in VRM. Can view data only for applications assigned to their teams.

Workspace Administrator

Can edit and delete workspaces in Veracode Software Composition Analysis. Can create, edit, and delete agents in a workspace. Can add teams to a workspace and remove them. Can manage rules in a workspace and view workspace reports. Can create and comment on issues. Can manage project settings.

Workspace Editor

Can create, edit, and delete agents in a workspace in Veracode Software Composition Analysis. Can manage rules in a workspace and view workspace reports. Can create and comment on issues. Can manage project settings.

Security Labs roles

These roles are available only if you have an account for Security Labs.

Security Labs Administrator

Can manage all learning activities for Security Labs users in Security Labs. Cannot add or remove users or teams.

Security Labs Manager

Can manage learning activities for users on their teams. Cannot add or remove users or teams.

Security Labs User

Can access Veracode Security Labs interactive training labs.

note

Assigning this role to a Veracode Security Labs user consumes one of your purchased Security Labs seats. To see the number of remaining seats, select the Security Labs User help icon when assigning roles on the Admin page.

Actions by role

The following tables show which actions each role can perform.

Action	Administrator	Creator	Delete Scans	Security Lead	Submitter
Create Application Profile	No	Yes	No	Yes	No
Bulk Add Applications	No	No	No	Yes	No
Assign Application to Team	Yes	Yes	No	Yes	No
Request Manual, Static, or Pipeline Scan	No	Yes	No	Yes	Yes
Delete Scans	No	Yes	Yes	Yes	No

Action	Administrator	Creator	Executive	Reviewer	Security Lead
Comment on Static Results	No	No	No	No	Yes
View or Delete File Exchange Files	Yes	No	No	No	Yes
Download XML Results	No	No	Yes	Yes	Yes

Action	Policy Administrator	Mitigation Approver	Reviewer	Security Lead	Vendor Manager
Create Policies	Yes	No	No	No	No
Propose Mitigations	No	No	Yes	Yes	No
Approve Mitigations	No	Yes	No	No	No
View Vendors Page	No	No	No	No	Yes
Publish Results	No	No	No	Yes	No

Action	Executive	Reviewer	Security Lead	Security Insights	Analytics Creator
View Analytics	Yes	No	Yes	Yes	Yes
Edit Analytics	No	No	No	No	Yes
Access Reporting API	Yes	No	Yes	Yes	No
View Reports	Yes	Yes	Yes	No	No
Access eLearning	Yes	No	No	No	No

Important

To be able to access eLearning summary reports, users with the Executive role must also have the eLearning role. Users who are members of the team associated with the application can accept third-party terms or scan requests. Users with both the Reviewer and Security Insights role can view analytics only for the teams for which they have access.

Package Firewall roles

The following table summarizes the Package Firewall permissions available to specific roles on the Veracode Platform.

Action	Administrator	Reviewer	Submitter	Mitigation Approver	Policy Administrator	Security Lead
Create firewall	No	No	No	No	Yes	Yes
Delete firewall	No	No	No	No	No	Yes
Modify policy	No	No	No	No	Yes	Yes
Modify exceptions	No	No	No	Yes	No	Yes
View results	Yes	Yes	Yes	Yes	Yes	Yes

Dynamic Analysis roles

The following tables summarize the Dynamic Analysis permissions available to certain roles on the Veracode Platform.

Action	Administrator	Creator	Submitter	Reviewer	Security Lead
Request/Create/ Submit Analysis	Yes	Yes	Yes	No	Yes
Upload or Enter URLs	Yes	Yes	Yes	No	Yes
Import URLs From Applications	Yes	Yes	Yes	No	Yes
Turn on Application Auto-Linking	Yes	No	No	No	Yes
Manually Link Results to Application	Yes	Yes	Yes	No	Yes
Assign Teams	Yes	Yes	Yes	No	Yes

Action	Creator	Submitter	Reviewer	Security Lead
Edit Analysis and Schedule	Yes	Yes	No	Yes
Edit Scan Configuration	Yes	Yes	No	Yes
Add or Delete Scan from Existing Analysis	Yes	Yes	No	Yes
View Results	No	No	Yes	Yes
View Status	Yes	Yes	Yes	Yes
View Analysis Configuration	Yes	Yes	No	Yes
Delete Analysis	Yes	Yes	No	Yes
View Vulnerability Summary	Yes	Yes	Yes	Yes

Sandbox capabilities

The following table summarizes the Sandbox permissions available to each role on the Veracode Platform.

Developers can create sandboxes within existing application profiles, and use them to submit the application code for analysis while still in development. Sandbox scans do not affect the developer's ability to run a formal policy scan of the application, and the results of the sandbox scans do not degrade the policy status or flaw metrics of the production version of the application.

Action	Creator	Submitter	Reviewer	Sandbox Administrator	Sandbox User	Security Lead
Create Sandbox Profile	Yes	No	No	Yes	Yes	Yes
Delete Sandbox	Yes	No	No	Yes	No	Yes
Create Policy Scan	Yes	Yes	No	No	No	Yes
Submit Policy Scan	Yes	Yes	No	No	No	Yes
Create Sandbox Scan	Yes	Yes	No	No	Yes	Yes
Submit Sandbox Scan	Yes	Yes	No	No	Yes	Yes
Review Scan Results	No	No	Yes	No	Yes	Yes
Review Scan Reports	No	No	Yes	No	Yes	Yes

Veracode Software Composition Analysis roles

Action	Mitigation Approver	Security Lead	Executive	Creator	Reviewer	Submitter	Workspace Administrator	Workspace Editor
View the SCA Portfolio Page	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Create and Delete Applications	No	Yes	No	Yes	No	No	No	No
Edit Applications	No	Yes	No	Yes	No	No	No	No
Add Teams to Applications	No	Yes	No	Yes	No	No	No	No
View All Applications	No	Yes	Yes	No	No	No	No	No
View Specific Applications	No	Yes	Yes	Yes	Yes	No	No	No
Request SCA (Static) Scans	No	Yes	No	Yes	No	No	No	No
Propose Mitigations	No	Yes	No	No	Yes	No	No	No
Approve Mitigations	Yes	No	No	No	No	No	No	No
View the Workspace Portfolio Page	No	Yes	Yes	Yes	Yes	No	Yes	Yes
Create Workspaces	No	Yes	No	Yes	No	No	No	No
Delete Workspaces	No	Yes	No	Yes	No	No	Yes	No
Edit Workspaces	No	Yes	No	Yes	No	No	Yes	No
Add Teams to Workspaces	No	Yes	No	Yes	No	No	Yes	No
View All Workspaces	No	Yes	Yes	No	No	No	No	No
View Specific Workspaces	No	Yes	Yes	No	Yes	No	Yes	Yes
Manage Projects	No	Yes	No	No	No	No	Yes	Yes
Link Projects to Applications	No	Yes	No	No	No	No	Yes	Yes
Manage Agent-Based Scan Rules	No	Yes	No	No	No	No	Yes	Yes
Manage Integrations	No	Yes	No	No	No	No	No	No
Manage Agents	No	Yes	No	No	No	Yes	Yes	Yes
Ignore and Unignore Issues	Yes	No	No	No	No	No	No	No

Container and IaC Analysis

The following table summarizes the Container and IaC analysis permissions available to each role on the Veracode Platform.

Action	Submitter	Reviewer	Delete Scans	Creator	Security Lead
Submit Container Scan and view Results	No	No	No	No	Yes
Submit IaC scan and view results	No	No	No	No	Yes
Review Container scan results	No	Yes	No	No	Yes
Review IaC scan results	No	Yes	No	No	Yes
Delete Container scans	No	No	No	No	No
Delete IaC scans	No	No	No	No	No

Security Labs roles

Action	Administrator	Team Admin	Security Labs Administrator	Security Labs Manager	Security Labs User
View users and teams	Yes	Yes	Yes	Yes	No
Create and manage users, roles, and teams	Yes	Yes	No	No	No
Create and manage campaigns	Yes	Yes	Yes	Yes	No
Manage reporting	Yes	Yes	Yes	Yes	No
Manage settings specific to the organization	Yes	No	Yes	No	No
View labs and leaderboard	Yes	Yes	Yes	Yes	Yes
View certificates, if enabled	Yes	Yes	Yes	Yes	Yes
View, rotate, or disable API credentials	Yes	No	Yes	No	No
Customize conclusions for lessons	Yes	No	Yes	No	No

Custom roles

You can create custom roles that are specific to your organization. Custom roles define specific permissions assigned to users. For example, you can assign a custom role with specific permissions, such as managing application profiles, submitting scans, and managing teams, and apply it to selected user accounts.

If you have the Administrator role, you create custom roles with the Identity REST API. After you create a custom role, you assign it to users in the same way you assign standard Veracode roles.

Use APIs with a user account

The Upload Using the Veracode Plugins permission is available to the Submitter role on the Veracode Platform.

The Create Application Using the Veracode Plugins permission is available to the Creator role on the Veracode Platform.

Permissions

Roles are comprised of different permissions that allow users to perform specific Veracode tasks. To view the permissions associated with specific roles, use the Identity REST API.

The following table lists the Veracode permissions, their types, if applicable, and whether they apply to UI user accounts or API user accounts. Some roles have permission types. In some cases there are seemingly similar permissions types: retrieve, retrieveTeamOnly, and retrieveOrg, for example. Individuals would have retrieve, a Team Admin would have retrieveTeamOnly, and an Administrator would have retrieveOrg.

Permission	Permission name	Permission type 1	UI user	API user
Access Admin API	adminApi		No	Yes
Application portfolio	appPortfolio		Yes	Yes
Approve Dynamic scans	approveDynamicScans		Yes	No
Approve Dynamic scans for ISM	approveDynamicScansforVsa		Yes	No
Approve or reject proposed mitigations	approveMitigations		Yes	Yes
Run Archer reports	archerReports		Yes	Yes
Assign application to any team	assignAppToAnyTeam		Yes	Yes
Assign application to team	assignAppToTeam		Yes	Yes
Change application assurance level	changeAppAssuranceLevel		Yes	Yes
Change the Archer name of an application	changeArcherName		Yes	Yes
Create a new application	createApplicationProfile		Yes	Yes
Create a collection	createCollection		Yes	Yes
Create an eLearning curriculum	createCurriculum		Yes	Yes
Create a login account	createLoginAccount		Yes	Yes
Create a policy scan for an application	createPolicyScan		Yes	Yes
Create a sandbox in an application	createSandbox		Yes	Yes
Create a sandbox scan for an application	createSandboxScan		Yes	Yes
Create a team	createTeam		Yes	Yes
Create user for team	createUserForTeam		Yes	No
Custom report	customReport		Yes	No
Dashboard	dashboard		Yes	No
Delete an application	deleteApplicationProfile		Yes	Yes
Delete collection	deleteCollection		Yes	Yes
Delete a Dynamic Analysis	deleteDynamicAnalysis		Yes	No
Delete login account	deleteLoginAccount		Yes	Yes
Delete module scan results	deleteModuleScan		Yes	No
Delete a policy scan	deletePolicyScan		Yes	Yes
Delete a sandbox in an application	deleteSandbox		Yes	Yes
Delete a sandbox scan	deleteSandboxScan		Yes	Yes
Delete a team	deleteTeam		Yes	Yes
Delete a user for team	deleteUserForTeam		Yes	No
Download scan reports	downloadScanReport		Yes	No
Download scan report as XML	downloadScanReportXML		Yes	No
Download crawl and login script	downloadScript		Yes	No
Download the site list for the scan	downloadSiteList		Yes	No
Dynamic Analysis result import	dynamicAnalysisResultImport		Yes	Yes
Change application-related options for Dynamic Analysis auto-linking	editDynamicAnalysisAutoLinkAppOptions		Yes	No
Edit login account	editLoginAccount		Yes	Yes
Edit ISM gateway	editMVSAGateway		Yes	No
Edit account SAML settings	editsamlsettings		Yes	No
Edit team	editTeam		Yes	Yes
Access eLearning mentor content	eLearningMentor		Yes	No
Access eLearning professor content	eLearningProfessor		Yes	No
Enable applications for next-day consultations for creation and update	enableNextDayConsultation		Yes	Yes
Allow user to schedule remediation consultations	enableRemediationConsultation		Yes	No
Allow user to schedule upload consultations	enableUploadConsultation		Yes	No
Expire another user's API credentials	expireApiCredentials		Yes	No
Expire another user's API credentials if on a managed team	expireApiCredentialsForTeam		Yes	No
Export custom data	exportCustomData		Yes	Yes
Access file exchange	fileExchange		Yes	No
Generate WAF rules	generateWafRules		Yes	No
Import application profiles	importApplicationProfiles		Yes	No
Link to application	linkApp		Yes	No
Analytics creator	lookerAnalyticsCreator		Yes	No
Analytics viewer	lookerAnalyticsViewer		Yes	No
Maintain Dynamic application	maintainDynamicApplication		Yes	No
Manage API credentials	ManageApiCredentials	generate, retrieve, retrieveOrg, retrieveTeamOnly, revoke, revokeOrg, revokeTeamOnly	Yes	Yes
Manage business units	ManageBusinessUnit	create, retrieve, update, delete	Yes	Yes
Change mitigation behavior for flaws mitigated by custom cleanser	manageCustomCleanserManagement		Yes	No
Manage account-level eLearning	manageElearning		Yes	Yes
Manage organizations	ManageOrganization	retrieve, update	Yes	Yes
Manage SCA component blacklist for policy	manageScaBlacklist		Yes	No
Manage teams	ManageTeam	create, retrieve, retrieveTeamOnly, update, updateTeamOnly, delete	Yes	Yes
Manage users	ManageUser	create, createTeamOnly, retrieve, retrieveOrg, retrieveTeamOnly, update, updateOrg, updateTeamOnly, delete, deleteTeamOnly	Yes	Yes
Manage vendor contact requests	manageVendorContact		Yes	No
Navigation for external Administrator	navExternalAdmin		Yes	No
Navigation for external eLearning	navExternalELearn		Yes	No
Navigation for external Executive	navExternalExecutive		Yes	No
Navigation for Security Insight only	navSecurityInsightOnly		Yes	No
Share your results in vendor directory	optIntoVendorDirectory		Yes	No
Manage policies	policyManagement		Yes	Yes
Retrieve cross-profile flaw identifiers in XML reports	portableScopeResultsAggregation		Yes	Yes
Promote scan to policy sandbox	promoteScans		Yes	Yes
Publish applications with mitigations	publishMitigatedRatings		Yes	No
Publish results to enterprise	publishResultsEnterprise		Yes	No
Read collections	readCollection		Yes	Yes
Enable the Reporting API	reportingApi		Yes	Yes
Request a Dynamic Analysis	requestDynamicAnalysis		Yes	Yes
Access Results API	resultsApi		No	Yes
View another user's API ID and status if on a managed team	retrieveApiCredentialsForTeam		Yes	No
Retrieve a team as Team Admin	retrieveTeamAsTeamAdmin		Yes	No
Retrieve a user for team	retrieveUserForTeam		Yes	No
Scan with Greenlight	scanWithGreenlight		Yes	Yes
Access Security Labs	securityLabs		Yes	No
Set allow dependencies as top-level modules	setAllowDepAsTopLevelModules		Yes	No
Navigate to all workspaces in SCA Agent-based Scan	srcclrAccessAllWorkspaces		Yes	No
Create workspace in SCA Agent-based Scan	srcclrCreateWorkspace		Yes	No
View portfolio list page in SCA Agent-based Scan	srcclrListPortfolioPage		Yes	No
Manage agents in SCA Agent-based Scan workspace	srcclrManageAgents		Yes	No
Manage integration, agents, usage, and library catalog in SCA Agent-based Scan	srcclrManageOrg		Yes	No
Manage SCA Agent-based Scan workspaces	srcclrManageWorkspaces		Yes	No
Comment on issues in SCA Agent-based Scan workspace	srcclrWorkspaceCommentIssues		Yes	No
Create third-party issues in SCA Agent-based Scan workspace	srcclrWorkspaceCreateThirdPartyIssue		Yes	No
Ignore and unignore issues in SCA Agent-based Scan workspace	srcclrWorkspaceIssuesVisibility		Yes	No
Manage project settings in SCA Agent-based Scan workspace	srcclrWorkspaceManageProjectSettings		Yes	No
Manage rules in SCA Agent-based Scan workspace	srcclrWorkspaceManageRules		Yes	No
Manage workspace settings in SCA Agent-based Scan	srcclrWorkspaceManageWebhooks		Yes	No
View projects in SCA Agent-based Scan workspace	srcclrWorkspaceViewProjects		Yes	No
View issues, vulnerabilities, libraries, and licenses in an SCA Agent-based Scan workspace	srcclrWorkspaceViewReports		Yes	No
View teams in SCA Agent-based Scan workspace	srcclrWorkspaceViewTeams		Yes	No
Submit a manual policy scan	submitPolicyManualScan		Yes	Yes
Submit a static policy scan	submitPolicyStaticScan		Yes	Yes
Submit a manual sandbox scan	submitSandboxManualScan		Yes	Yes
Submit a static sandbox scan	submitSandboxStaticScan		Yes	Yes
Update results	updateResults		Yes	Yes
Update team as Team Admin	updateTeamAsTeamAdmin		Yes	No
Update user for team	updateUserForTeam		Yes	No
View details for an account	viewAccountDetails		Yes	No
View asset inventory results	viewAssetInventoryResults		Yes	No
View policy custom severity setting	viewCustomSeverity		Yes	No
View application-related options for Dynamic Analysis auto-linking	viewDynamicAnalysisAutoLinkAppOptions		Yes	No
View Dynamic Analysis results	viewDynamicAnalysisResult		Yes	No
View Dynamic Analysis status	viewDynamicAnalysisStatus		Yes	No
View Dynamic Analysis URL configuration	viewDynamicAnalysisURLConfiguration		Yes	No
View ISM gateway	viewMVSAGateway		Yes	No
View open source	viewOpenSource		Yes	No
View reports	viewReports		Yes	Yes
View results	viewResults		Yes	Yes
View the list of sandboxes in an application	viewSandbox		Yes	Yes
View portfolio for third-party components	viewScaPortfolio		Yes	No
Enable SCA Agent-based Scan	viewSourceClearSca		Yes	No
View details for Third-Party tab	viewThirdPartyDetails		Yes	No
View vendor list	viewVendorList		Yes	No
Submit container scan and view results	submitContainerScan		Yes	No
Submit IaC scan and view results	submitIaCScan		Yes	No
Review container scan results	viewContainerResults		Yes	No
Review IaC scan results	viewIaCResults		Yes	No
Create and manage Security Labs learning for all Security Labs users	securityLabsAdmin		Yes	Yes
Create and manage Security Labs learning for users on their team	securityLabsManager		Yes	Yes
Generate custom PDF reports	viewReports or viewResults		Yes	Yes

Footnotes

1. Permission types allow you to perform specific tasks as part of certain permissions. For custom roles, you must specify the types when assigning those permissions to a role. ↩