Authorization

ServiceHop uses role-based access control. Each token is assigned a role that determines what operations it can perform.

Roles

Role	Description
MASTER	Full administrative access
USER	Read/write data and run insights
VIEWER	Read-only access

Permissions Matrix

Operation	MASTER	USER	VIEWER
Read Operations
List services	Yes	Yes	Yes
View insights	Yes	Yes	Yes
View calls	Yes	Yes	Yes
View statistics	Yes	Yes	Yes
Write Operations
Ingest data	Yes	Yes	No
Run orchestration	Yes	Yes	No
Delete insights	Yes	Yes	No
Administrative Operations
Manage tokens	Yes	No	No
Delete services	Yes	No	No
Delete call data	Yes	No	No

Role Selection Guidelines

VIEWER

Use for read-only access scenarios:

• Dashboards and monitoring
• Reporting tools
• Auditing

USER

Use for operational access:

• CI/CD pipelines that ingest call data
• Automation scripts that trigger insight generation
• Development and testing

MASTER

Reserve for administrative tasks:

• Token management
• Data cleanup and maintenance
• Service deletion

Best Practices

Principle of Least Privilege

Assign the minimum role required for each use case:

Ingestion pipeline → USER
Monitoring dashboard → VIEWER
Admin scripts → MASTER

Separate Tokens by Purpose

Create dedicated tokens for different systems:

System	Token Name	Role
CI/CD pipeline	ci-ingestion	USER
Grafana dashboard	grafana-read	VIEWER
Admin scripts	admin-automation	MASTER

This allows independent revocation and audit tracking.

Regular Access Review

Periodically review active tokens:

1. Navigate to Administration > API Tokens
2. Review each token's purpose and last used date
3. Revoke or delete unused tokens