Privacy and analytics

We use necessary technical cookies and, only with your consent, analytics and marketing pixels to improve the website and measure campaigns.

Privacy policyCookie policy
Docs
English
EspañolEnglishFrançaisDeutschItaliano
API/Brand API
Concept2 min read

Permissions and roles

How the gate decides who can do what in each brand.

On this page
  • Brand roles
  • Minimum role per area
  • Scopes

Updated on January 1, 1970

Previous

Getting started

  • What is Nömad?
  • Getting started with Nömad
  • Create your brand and complete the Genome
  • Invite your team
  • Glossary

Brand OS

  • What is inside Brand OS
  • What is the Genome?
  • Who is Nödo?
  • Talk to Nödo: voice, cards and ordering from the Store
  • Conversations: your team and Nödo
  • What does a Brand Manager do?
  • Brand Kit and Library
  • Posts and calendar
  • Connections
  • Meetings
  • Files we send you with NödoTransfer
  • Your quotes

Work

  • Work and tasks
  • Ordering work
  • Following, reviewing and approving deliveries
  • Approving the posts Nömad prepares
  • Custom quotes
  • Brand history
  • Yes, there are humans behind it

Account and billing

  • Plans and pricing
  • Billing and payments
  • Paying from the apps (iPhone and Android)
  • People and access
  • Organization and brand roles
  • Workspaces and multiple brands
  • Your name and @username
  • Languages, apps and data
  • Leave, close or delete: account, brands and workspaces
  • Delete and restore: what goes and what stays
  • Inbox and notifications: how we let you know
  • Push notifications on your phone and browser
  • Nömad emails and your preferences

Help

  • How to get help

API

  • Brand API
    • Errors
    • Permissions and roles
    • Events and webhooks
    • Brand
    • Genome
    • Brand Kit
    • Library
    • Works
    • Calendar
    • Connections
    • Publishing
    • Inbox
    • Team
    • Account and team
    • Conversation
    • Memory
    • Questions
    • Media
    • Store
    • Plan
    • Orders
    • Activity
    • Workspace
    • Your account
    • Billing
    • Sync
    • Website and domains
    • Statistics
    • Events

MCP

  • MCP server

Connectors

  • Brand connectors

Nödo and agents

  • Nödo in the brand

Genome

  • Genome specification
Português
Русский
한국어
日本語
中文
हिन्दी
Open the app
Errors
NextEvents and webhooks

In this section

  • Errors
  • Events and webhooks
  • Brand
  • Genome
Can't find what you need? Write to usWrite to usGo to the app
© 2026 Nömad · Nömad documentationLinkedInInstagramThreadsFacebookTikTokYouTubeX
Go to nomad.oooBack to top

Every call goes through the same gate, whether it comes from Nödo, an external agent or a key. The gate answers four questions in this order.

  1. Who is it? A person (session, Nödo acting for them, OAuth or personal key).
  2. What are they in this brand? Their effective role: workspace owner, all-brands access, per-brand access or direct member; the highest role wins. Nömad staff enter through their permission and brand assignment.
  3. What were they granted? The scope of the key or OAuth consent. Nödo inside the app has no scope limit: it uses the full role of the person speaking.
  4. Is the brand operational? A closed or archived brand accepts no operation, reads included, exactly as in the app.

Brand roles

RoleWhat it can do
OwnerEverything, including deleting the brand.
AdminEverything except deleting the brand.
MemberView and create content, works and calendar; view the Kit.
ViewerView content, Kit and calendar.
BillingView plan, billing, orders and subscriptions.

Minimum role per area

AreaReadWrite
BrandViewerAdmin
GenomeViewerMember
Brand KitViewerAdmin
LibraryViewerAdmin
WorksViewerMember
CalendarViewerMember
ConnectionsAdminAdmin
PublishingViewerMember
InboxViewerViewer
TeamViewerMember
Account and teamViewerRead-only
ConversationViewerMember
MemoryViewerMember
QuestionsViewerMember
Media—Member
StoreViewerRead-only
PlanBillingRead-only
OrdersBillingBilling
ActivityViewerRead-only
Workspace——
Your accountViewerViewer
BillingBillingBilling
Sync—Read-only
Website and domainsAdminAdmin
StatisticsViewerRead-only
Events—Read-only

Scopes

Scopes are per area and kind: <area>.read and <area>.write. Ask only for what you need; when one is missing, insufficient_scope names it.

brands:read
brand.read
brand.write
genome.read
genome.write
kit.read
kit.write
library.read
library.write
works.read
works.write
calendar.read
calendar.write
connections.read
connections.write
publishing.read
publishing.write
inbox.read
inbox.write
team.read
team.write
account.read
conversation.read
memory.read
memory.write
questions.read
questions.write
media.write
store.read
subscriptions.read
orders.read
activity.read
stats.read
profile.read
profile.write
conversation.write
billing.write
site.read
site.write
workspace.write
workspace.read
billing.read
events.read
sync.read
orders.write

On this page

  • Brand roles
  • Minimum role per area
  • Scopes
Brand Kit
  • Library
  • Works
  • Calendar