> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nmbr.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Users and Access

> Give each person on your team their own Portal account and choose what they can access.

Everyone on your team signs in to the Portal with their own account. For each person, you choose what they can do, which of your companies they can access, and how long that access lasts. You manage access in the Portal or through the Nmbr API.

![The Users list in the Nmbr Portal, showing each person's sign-in method, role and access](https://mintcdn.com/nmbr/bM8QT0rRrsGorsiI/assets/portal/users-and-access/users-list.png?fit=max\&auto=format\&n=bM8QT0rRrsGorsiI\&q=85\&s=d1dac9c9fafe8ef26f79e672884be5ef)

## Why it matters

* **Support teams.** An agent who looks after a few of your customers can access only those companies.
* **Short engagements.** A contractor or auditor gets access that ends on its own.
* **Review without risk.** A finance lead views payrolls, downloads pay stubs, and runs payroll reports. They can't approve a payroll or change any records.
* **Your own tools.** Your support or identity tools add people and set their access through the API.

## Invite your team

User managers add people from **Account** in the sidebar, under **Users**. Choose **Create User** and enter their name and email.

Each new person gets an email invitation to set their own password. The link works for 7 days. If it expires, open the person and choose **Resend invitation** from the actions menu.

You can also set:

* **Force Multi-factor** to require a sign-in code by text message. Add their mobile number in **SMS Number**.
* **Receive Alerts** to email them when webhook or email delivery has a problem.
* **Preferred Language** for the emails they receive.

![The Create User form](https://mintcdn.com/nmbr/bM8QT0rRrsGorsiI/assets/portal/users-and-access/create-user.png?fit=max\&auto=format\&n=bM8QT0rRrsGorsiI\&q=85\&s=e9f15f1f3719355219dc2e8cd2b14ece)

## Choose what each person can do

Each person has one of two levels:

* **Write** views and changes everything their company access allows.
* **Read** views, runs reports, and downloads pay stubs and forms. They can't create, change, or delete anything. Turn on **Read-only** to give someone this level.

Everyone can update their own name, password, and sign-in settings.

**User managers** add people, set their access, and resend invitations. A user manager can access every company and always has Write access. Your account always keeps at least one user manager.

![Editing a person who is restricted to companies](https://mintcdn.com/nmbr/bM8QT0rRrsGorsiI/assets/portal/users-and-access/edit-user.png?fit=max\&auto=format\&n=bM8QT0rRrsGorsiI\&q=85\&s=7708bc5c3b40d371f11aa85d0e477834)

## Choose which companies each person can access

A person can access every company on your account until you restrict them.

To limit someone to specific companies:

1. Edit the person and turn on **Restrict to Companies**.
2. Open the person and choose **Attach Company** under **Company Access**.
3. Pick the company and how long the access lasts.

A restricted person can access only the companies in their list. With none listed, they can't access any companies. The limit applies to everything they open: company and employee lists, records opened from a link, files, reports, and logs.

Turning **Restrict to Companies** off gives the person every company again and clears their list.

![A restricted person's Company Access list showing when each company's access ends](https://mintcdn.com/nmbr/bM8QT0rRrsGorsiI/assets/portal/users-and-access/user-detail-company-access.png?fit=max\&auto=format\&n=bM8QT0rRrsGorsiI\&q=85\&s=b8ecf337f9a606c471b295872a039680)

## Give access for a limited time

When you attach a company, **Access for** sets how long it lasts: Forever, 1 hour, 24 hours, 7 days, or 30 days. The person's **Company Access** list shows when each company's access ends, and it ends at that time on its own.

To extend access, edit the company in the list and choose a new length, counted from now. To end it now, detach the company.

To set an exact end date, use the API (see [Manage access from your own tools](#manage-access-from-your-own-tools)).

![Attaching a company and choosing how long the access lasts](https://mintcdn.com/nmbr/bM8QT0rRrsGorsiI/assets/portal/users-and-access/attach-company.png?fit=max\&auto=format\&n=bM8QT0rRrsGorsiI\&q=85\&s=788cfd5c83d60ca6f0280aabc443e166)

## Settings shared across your account

Some pages apply to your whole account. Restricted people see them too.

| Page | Who can change it |
| - | - |
| **Users** under **Account** | User managers |
| **Email**, **Features**, **Component**, and **Integrations** under **Configure** | Everyone with Write access |
| **Webhooks** | Everyone with Write access |

## See who has access at a glance

The **Users** list shows each person's sign-in method, role, and access:

* **2FA** shows `SMS` when sign-in codes are on, and `Off` when they're not.
* **Roles** shows `User manager` for people who manage your team.
* **Access** shows two badges. The first is `Read` or `Write`. The second is `Unrestricted`, or `Restricted` with the number of companies the person can access. `Restricted (0)` appears in red because that person can't access any companies.

A read-only person sees the same pages without the options to create, edit, or delete.

![A company as a read-only person sees it](https://mintcdn.com/nmbr/bM8QT0rRrsGorsiI/assets/portal/users-and-access/read-only-company.png?fit=max\&auto=format\&n=bM8QT0rRrsGorsiI\&q=85\&s=b0f7abd7491684c4ee5ad5685ad71ae1)

## Manage access from your own tools

The Nmbr API manages the same people and access as the Portal. Use your [partner secret](https://docs.nmbr.co/api/overview/authentication.md) to connect access to your own support or identity tools.

* [Create a user](https://docs.nmbr.co/api-reference/users/create-a-user.md) to add someone and send their invitation. Set `is_read_only`, `is_restricted`, and `is_user_manager` in the same request.
* [Resend an invitation](https://docs.nmbr.co/api-reference/users/resend-an-invitation.md) when the link has expired.
* [Update a user](https://docs.nmbr.co/api-reference/users/update-a-user.md) to change their level or role, and [delete a user](https://docs.nmbr.co/api-reference/users/delete-a-user.md) when they leave. Deleting a person ends their company access.
* [Grant a company](https://docs.nmbr.co/api-reference/users/grant-a-company.md) to a restricted person. Send `expires_at` in UTC to end the access at a set time, or leave it out for access that doesn't end.
* [Change when access ends](https://docs.nmbr.co/api-reference/users/change-when-access-ends.md) to extend access or make it permanent, and [revoke company access](https://docs.nmbr.co/api-reference/users/revoke-company-access.md) to end it now.
* [List users](https://docs.nmbr.co/api-reference/users/list-users.md) with the `email` filter to find a person, and [list a user's company access](https://docs.nmbr.co/api-reference/users/list-a-users-company-access.md) to see the companies they can access.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.