Team roles

More than one person can manage your Merchant or Business account. Invite teammates from your dashboard and give each one a role that fits their job. The account's creator is always the OWNER; that role can't be assigned, changed or removed.

A request made with an API key isn't limited by these roles — the key's own scopes and environment apply. Roles govern what each person can do when signed in.

Merchant account roles

Role	Can do
`OWNER`	Everything
`ADMIN`	Everything: the team, Merchant settings, live and sandbox API keys, OAuth clients, webhooks, sellers
`DEVELOPER`	Sandbox API keys, OAuth clients, webhooks, the catalogue; view trades and analytics. Not live keys
`ACCOUNT_MANAGER`	Sellers; view trades, usage and analytics
`OPERATIONS`	Sellers and the catalogue; view trades and analytics
`ACCOUNTANT`	View usage, billing, trades and analytics
`SUPPORT`	View trades
`VIEWER`	View trades, usage and analytics

Manage the team with POST /v1/merchants/{id}/users/invite, PATCH /v1/merchants/{id}/users/{userId}/role and DELETE /v1/merchants/{id}/users/{userId} (OWNER or ADMIN). A request a role doesn't allow returns 403.

Business account roles (TBBN Space)

Role	Can do	Location limit
`OWNER`	Everything, including deleting the Business	—
`ADMIN`	Everything except deleting the Business: the team, payouts, billing, production Space API keys	No
`ACCOUNT_MANAGER`	Locations, Spaces, pricing, bookings, guest messages, billing, earnings and refunds	No
`OPERATIONS`	Locations, Spaces, pricing, calendars, bookings, check-ins and guest messages	Yes
`ACCOUNTANT`	Billing and plan, statements, earnings and refunds; view bookings	No
`DEVELOPER`	Sandbox Space API keys and webhooks; view bookings and billing	No
`SUPPORT`	View bookings, answer guest messages	Yes
`RECEPTION`	View bookings, check guests and members in, confirm drop-offs and pickups, answer guest messages	Yes
`VIEWER`	View bookings, billing and earnings	Yes

Location limits

OPERATIONS, SUPPORT, RECEPTION and VIEWER can be limited to some of a Business's locations with branchIds. A limited member sees and acts on only those locations, their Spaces, bookings and conversations; a Business-wide action (such as adding a location) is refused with 403. An empty list means every location.

curl -X POST https://api.tbbnetwork.com/v1/businesses/$BUSINESS_ID/business-users \
  -H "Authorization: Bearer $SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"userId": "…", "role": "RECEPTION", "branchIds": ["…"]}'

Change a role or limit with PATCH /v1/businesses/{businessId}/business-users/{userId} ({ "role": "…", "branchIds": […] }); remove someone with DELETE on the same path. These need the OWNER or an ADMIN.

GET /v1/businesses returns the Businesses the signed-in person owns and those they're on the team of, each with myRole and myBranchIds.