---
schema_version: "1"
id: bf511c0bc578c1c1e23d81bde19557a9d9b9e299e693b3d7bf862fd1048d69c6
title: User Roles, Permissions, and Profiles
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/api-experience-hub/user-roles-permissions-and-profiles.md
canonical_url: https://docs.mulesoft.com/api-experience-hub/user-roles-permissions-and-profiles
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 75f7d3d72382bd6565b50cbdd589d2e4ca59081caa3ad1af469d1da92493ac83
description: MuleSoft Documentation Site
latest: true
---
---
product: API Experience Hub
---

# User Roles, Permissions, and Profiles

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

This topic provides information about the user roles, permissions, and profiles used in API
Experience Hub for Salesforce Experience Cloud and Anypoint Platform.

- For Anypoint Platform, users with different access levels are managed using Anypoint Access
  Management. You can configure the permissions for administrators and Exchange viewers. For more
  information, see
  [Managing Permissions in Access Management](https://docs.mulesoft.com/access-management/managing-permissions).

- For Experience Cloud, the System Administrator profile or the AEH\_Anypoint permission set is
  required for the user who performs the linking process.

## Administrators

The Organization Administrator role has all of the permissions necessary to create, curate, manage,
and customize a portal. This role can also grant another user in their organization the API
Experience Hub Administrator permission. This permission enables a user to do all of the same tasks
in the portal as the Organization Administrator.

An API Experience Hub Admin team and an API Experience Hub Portal Admin team are created in Access
Management during the connecting and linking process. Once your Salesforce organization is
successfully connected to your Anypoint organization, the AEH Admin team is created. Any user, who
is assigned the AEH Admin, is automatically added to the AEH Admin team.

After your styling changes for the portal are saved, the AEH Portal Admin team is created. Although
the API Experience Hub Portal Administrator team is visible in Access Management, this permission
isn’t supported in this release.

Administrators can only add services for which they have the Exchange Viewer permission. When
services are added to the portal, all administrators are automatically assigned the Exchange Viewer
permission.

API Experience Hub is integrated with Salesforce Experience Cloud. Administrators access the
Salesforce Experience Builder with a shared user account. The identity of the administrator is
shared therefore, API Experience Hub can’t determine the individual administrator’s action in the
shared account.

The System Administrator profile has specific permissions to perform functions on the Salesforce
Platform. The user with this profile performs the initial step of creating a portal by connecting to
the Salesforce Experience Cloud and linking the Salesforce organization to the Anypoint
organization. This process can only be done by the user with the System Administrator profile. The
AEH\_Anypoint permission set can also be created to have only the minimal necessary permissions for
the user who performs the linking process. For more information, see
[Assigning Permissions](https://docs.mulesoft.com/api-experience-hub/assigning-permissions).

<table><colgroup><col> <col> <col></colgroup><tbody><tr><td><p>Role/Permission/Profile</p></td><td><p>Description</p></td><td><p>Actions</p></td></tr><tr><td><p>Salesforce System Administrator</p></td><td><p>This profile must be assigned to the user who performs the Salesforce linking process.</p></td><td><div><div><ul><li><p>Perform the Salesforce linking process</p></li></ul></div></div></td></tr><tr><td><p>Organization administrator in the main organization</p></td><td><p>API Experience Hub is business group agnostic which means that the portal belongs to the main organization only and the admin can create portals across business groups. The organization administrator inherits all API Experience Hub permissions, enabling them to perform any available operation within the platform.</p></td><td><div><div><ul><li><p>Perform the Salesforce linking process</p></li><li><p>Create a portal</p></li><li><p>Add and remove services from the portal</p></li><li><p>Assign the visibility of an instance</p></li><li><p>Manage users</p></li><li><p>Use Experience Builder to customize portal</p></li></ul></div></div></td></tr><tr><td><p>API Experience Hub Administrator</p></td><td><p>The admin inherits all of the Organization Administrator permissions necessary to create your portal.</p></td><td><div><div><ul><li><p>Perform the Salesforce linking process</p></li><li><p>Create a portal</p></li><li><p>Add and remove services from the portal</p></li><li><p>Assign the visibility of an instance</p></li><li><p>Create a new connection to Salesforce and new portals</p></li><li><p>Manage users</p></li><li><p>Use Experience Builder to customize portal</p></li></ul></div></div></td></tr><tr><td><p>API Experience Hub Portal Administrator</p></td><td><p>Currently, can manage only one API portal in the organization</p></td><td><div><div><ul><li><p>Add and remove specific services from the portal</p></li><li><p>Assign the visibility of an instance</p></li></ul></div></div></td></tr></tbody></table>

### Exchange Permissions

All administrators must have the Exchange Viewer permission to import services into the portal.

<table><colgroup><col> <col> <col></colgroup><tbody><tr><td><p>Permission</p></td><td><p>Description</p></td><td><p>Actions</p></td></tr><tr><td><p>Exchange Viewers</p></td><td><p>Assign this permission to the Organization Administrator or the API Experience Hub Administrator who performs the Salesforce linking process. Users with this permission can’t add new assets, edit asset portal content, or share an asset with another user.</p></td><td><div><div><ul><li><p>View Services in Exchange</p></li><li><p>Import services from Exchange to the portal</p></li></ul></div></div></td></tr></tbody></table>

## User Roles for Configuring SSO

Configuring an identity provider for API Experience Hub includes multiple personas that perform
different user actions.

Depending on your organization’s setup, a user can be assigned one or more of these roles:

<table><colgroup><col> <col> <col></colgroup><tbody><tr><td><p>Required Permissions</p></td><td><p>Grants the Ability to</p></td><td><p>Notes</p></td></tr><tr><td><p>API Experience Hub Administrator</p></td><td><p>Enabling and disabling an identity provider in the API Experience Hub UI.</p></td><td></td></tr><tr><td><p>Salesforce System Administrator</p></td><td><p>Configures the identity provider in Salesforce.</p></td><td></td></tr><tr><td><p>Anypoint Organization Administrator</p></td><td><p>Maps the identity provider groups with the API Experience Hub profiles using the group mapping functionality of Access Management teams.</p></td><td></td></tr><tr><td><p>Security team</p></td><td><p>Configures the identity provider with the required user groups and applications.</p></td><td><p>Your organization’s security team and the Salesforce System Administrator, who manage the identity provider system in an organization, configure the proper login option in Salesforce. The security team and the Org Admin in the main organization can configure the same identity provider option in Anypoint Platform, if required.</p><p>The security team and the Org Admin in the main organization configure the mapping between Salesforce and Anypoint Platform. Access Management provides the functionality of adding group mappings for external identity providers using teams. After the group mappings are properly configured, users who log in to the portal are added automatically to the out-of-the-box profile that they belong to. The default identity provider is provided to create identities in Anypoint Platform for Salesforce users.</p></td></tr></tbody></table>

## Granular Permissions and Permission Sets

Use the following permission or permission set to allow users to perform specific tasks only. For
more information about configuring the permission and the permission set, see
[Assigning Permissions](https://docs.mulesoft.com/api-experience-hub/assigning-permissions).

<table><colgroup><col> <col> <col></colgroup><tbody><tr><td><p>Permission/Permission Set</p></td><td><p>Description</p></td><td><p>Actions</p></td></tr><tr><td><p>API Experience Hub Users Approver</p></td><td><p>A granular permission that enables a user to perform specific tasks to manage users.</p></td><td><div><div><ul><li><p>Approve or reject a user’s registration for the portal</p></li><li><p>Enable or disable a user’s access to the portal</p></li></ul></div></div></td></tr><tr><td><p>AEH_Anypoint permission set</p></td><td><p>A permission set that contains the minimum permissions required for a Salesforce user to perform the linking process.</p></td><td><div><div><ul><li><p>A user with this permission set can perform the Salesforce linking process</p></li></ul></div></div></td></tr></tbody></table>

## Consumer Users

API Experience Hub has these consumer user profiles:

- Guest

- Member

These are groups of users with certain permissions that you can manage using the Teams feature in
Access Management. Permissions for Guest and Member users are automatically determined by how they
access an organization’s portal. A user who does not log in to the portal is an anonymous user that
is assigned the guest user profile with the permissions assigned to this group. A guest user can
become a member by completing the registration process for the portal. Once the user’s registration
is approved, this user inherits the member user profile and its associated permissions. For more
information about Teams in Access Management, see
[Manage User Access Using Teams](https://docs.mulesoft.com/access-management/teams).

<table><colgroup><col> <col> <col></colgroup><tbody><tr><td><p>User Profile</p></td><td><p>Description</p></td><td><p>Actions</p></td></tr><tr><td><p>Guest</p></td><td><p>This user’s profile is anonymous and isn’t logged in the portal.</p></td><td><div><div><ul><li><p>View public services that are shared with them</p></li><li><p>Can self-register to become a member</p></li><li><p>Can’t request access to services</p></li></ul></div></div></td></tr><tr><td><p>Member</p></td><td><p>This is a registered user who can log in to a portal.</p></td><td><div><div><ul><li><p>View public services and other services that are shared with them</p></li><li><p>View services assigned to the user group they belong to</p></li><li><p>Registered using self-registration to become a member</p></li><li><p>Request access to services</p></li></ul></div></div></td></tr></tbody></table>

## See Also

- [Getting Started with API Experience Hub](https://docs.mulesoft.com/api-experience-hub/getting-started-with-api-experience-hub)

- [Assigning Permissions](https://docs.mulesoft.com/api-experience-hub/assigning-permissions)

- [Connecting to Salesforce](https://docs.mulesoft.com/api-experience-hub/connecting-to-salesforce)

- [Enabling Single Sign-On for Your Portal](https://docs.mulesoft.com/api-experience-hub/enabling-sso-for-your-portal)