In the Administration → User roles section roles that can be assigned to system users and specific permissions for each role are maintained.
By default, Zabbix is configured with four user roles, which have a pre-defined set of permissions:
Default Super admin role cannot be modified or deleted, because at least one Super admin user with unlimited privileges must exist in Zabbix.
Zabbix users with type Super admins and proper permissions can modify or delete existing roles or create new custom roles.
To create a new role, click on the Create user role button at the top right corner. To update an existing role, press on the role name to open the configuration form.
Available permission options along with default permission sets for pre-existing user roles in Zabbix are described below.
|Parameter||Description||Default user roles|
|Super admin role||Admin role||User role||Guest role|
|Name||Role visible name.||Super admin role||Admin role||User role||Guest role|
|User type||Selected user type determines the list of available permissions.
Upon selecting a user type, all available permissions for this user type are granted by default.
Uncheck the checkbox(es) to revoke certain permissions for the user role.
Checkboxes for permissions not available for this user type are grayed out.
|Access to UI elements|
|Dashboard||Enable/disable access to a specific Monitoring menu section and underlying pages.||Yes||Yes||Yes||Yes|
|Overview||Enable/disable access to a specific Inventory menu section and underlying pages.||Yes||Yes||Yes||Yes|
|System information||Enable/disable access to a specific Reports menu section and underlying pages.||Yes||No||No||No|
|Triggers top 100|
|Host groups||Enable/disable access to a specific Configuration menu section and underlying pages.||Yes||Yes||No||No|
|General||Enable/disable access to a specific Administration menu section and underlying pages.||Yes||No||No||No|
|Default access to new UI elements||Enable/disable access to the custom UI elements. Modules, if present, will be listed below.||Yes||Yes||Yes||Yes|
|Access to modules|
|<Module name>||Allow/deny access to a specific module. Only enabled modules are shown in this section. It is not possible to grant or restrict access to a module that is currently disabled.||Yes||Yes||Yes||Yes|
|Default access to new modules||Enable/disable access to modules that may be added in the future.|
|Access to API|
|Enabled||Enable/disable access to API.||Yes||Yes||Yes||No|
|API methods||Select Allow list to allow only specified API methods or Deny list to restrict only specified API methods.
In the search field, start typing the method name, then select the method from the auto-complete list.
You can also press the Select button and select methods from the full list available for this user type. Note, that if certain action from the Access to actions block is unchecked, users will not be able to use API methods related to this action.
Wildcards are supported. Examples:
If no methods have been specified the Allow/Deny list rule will be ignored.
|Access to actions|
|Create and edit dashboards||Clearing this checkbox will also revoke the rights to use
|Create and edit maps|
|Create and edit maintenance||No|
|Add problem comments||Clearing this checkbox will also revoke the rights to perform corresponding action via
|Execute scripts||Clearing this checkbox will also revoke the rights to use the
|Manage API tokens||Clearing this checkbox will also revoke the rights to use all
|Manage scheduled reports||Clearing this checkbox will also revoke the rights to use all
|Default access to new actions||Enable/disable access to new actions.||Yes|