Skip to content

Permissions

Permissions for SearchKit and FormBuilder combine settings in:

  • SearchKit
  • FormBuilder
  • CMS user roles (CiviCRM functionalities)
  • ACL roles (fine-grained permissions)

SearchKit

Every display you create in a search, such as a table or grid, has an “Enforce Permissions/ Bypass permissions” button at the top. It is a toggle, and its displayed text indicates the current state:

  • Enforce permissions respects existing permissions defined in CiviCRM. Access control can be set at various levels, including roles in your content management system (CMS) and specific actions controlled by CiviCRM’s more detailed ACL controls. For more information, see Permissions and Access Control.
  • Bypass permissions lets anyone who can view the display see all results, regardless of their permission level. This can be useful, but be careful what you expose.

Enforce permissions

Bypass permissions

FormBuilder

For both Search forms and Submission forms:

  • The form settings tab has a permission setting that determines who can view the form.
  • Multiple permissions can be joined using “and” to require all of them, or “or” to require only one of them.
  • Available permissions include CMS role permissions (e.g. WordPress : delete_pages) and CiviCRM permissions (e.g. CiviContribute: Access CiviContribute). Either or both can be used in this field.
  • For more examples, see who can use a form and the additional permissions that control whether a form autofills with data from the database.