Admin guide

Last updated on Oct 15, 2026

Every STACKIT user can already work with their own support tickets without any additional setup. As an administrator, your job is to decide who can go beyond that baseline, for example to view or manage tickets they did not create. This guide explains what access users have by default, what ticket participants can do, and which capabilities you must grant explicitly through roles.

How ticket access works

Access to a support ticket is controlled by two independent layers:

Ownership (implicit): A user owns a ticket when they created it or were added as a participant. Owners always have full access to that specific ticket, regardless of which permissions their account holds.
Permissions (explicit): For every ticket a user does not own, access is controlled by support.help-center.* permissions that you grant through roles.

Because ownership overrides permissions, the fastest way to give someone access to a single ticket is to add them as a participant, without any role changes.

Ownership

Every authenticated user always has ownership-based access to tickets they created themselves or were added to as participants by others. This means they can:

List those tickets and open the ticket overview.
Read and post comments for those tickets.
View, upload, and download attachments for those tickets.
See, add, and remove participants for those tickets without any extra permissions.

Creating a ticket in the first place requires the support.help-center.ticket.create permission (see Permissions). It is included by default in the support.ticket-creator role. Legacy roles such as Editor, Owner, and Reader also include it.

Permissions

To let a user act on tickets they do not own, or to create tickets at all, assign a role that includes the relevant permission. The following table lists each ticket permission and when it is needed.

Permission	Grants the ability to	Where/when is it required?
`support.help-center.ticket.create`	create support tickets.	Always, to create tickets.
`support.help-center.ticket.list`	use the All tickets tab to see every ticket in the project/organization.	To see tickets the user does not own.
`support.help-center.ticket.get`	open the Overview and Participants pages of a ticket.	Only for tickets the user does not own.
`support.help-center.ticket.comment.create`	post comments on a ticket.	Only for tickets the user does not own.
`support.help-center.ticket.attachment.list`	open the Attachments page of a ticket.	Only for tickets the user does not own.
`support.help-center.ticket.attachment.create`	upload attachments to a ticket.	Only for tickets the user does not own.
`support.help-center.ticket.attachment.get`	download attachments.	Only for tickets the user does not own.
`support.help-center.participant.add`	add participants to a ticket.	Only for tickets the user does not own.
`support.help-center.participant.remove`	remove participants from a ticket.	Only for tickets the user does not own.
`support.help-center.ticket.validate`	approve or decline proposed resolutions.	Only for tickets the user does not own.

Assigning ticket permissions

Permissions can only be granted through roles, not individually. There are seven preconfigured roles for Support. To see which permissions each role grants, complete the following steps:

Navigate to the STACKIT Portal and authenticate.
In the sidebar, scroll to category IAM and open the Roles page.
In the main view, open the tab Product Roles.
Find the list entry Support and expand it to view the available roles.
Select a role to view its assigned permissions.

You can also bundle permissions into custom roles. To complete the process, assign a suitable role to the user, group, or service account at the appropriate scope: project, folder, or organization.

Role bindings are additive and inherited down the hierarchy, so a role granted at organization level applies to every project beneath it. For the full model, read “Understand roles and permissions”.