Users & Permissions
Overview
Section titled “Overview”TaprNext uses Frappe users plus application roles. Invoice Manager also respects Legal Entity User Permissions so people only see the companies they work with.
Application roles
Section titled “Application roles”These role names match the product (tapr_next constants):
| Role | Typical responsibilities |
|---|---|
| System Manager | Full site admin: Tapr Settings, users, webhooks, storage, subscription |
| Accounts Manager | Finance oversight, approvals, cross-functional AP/AR visibility |
| Purchase Manager | AP processing: In Docs review, submit for approval |
| Sales Manager | AR processing: Out Docs create/review/send |
| Peppol | Service identity for PEPPOL network operations (platform user) |
| External Poster | Integration identity used for external posting flows |
Assign one or more roles per user depending on their job. Most human users need Purchase Manager and/or Sales Manager plus Accounts Manager for approvers.
Legal Entity access
Section titled “Legal Entity access”- Create the user under User in the desk.
- Assign roles.
- Restrict companies with User Permission on Legal Entity when the user should not see all entities.
- Administrators without LE restrictions see all legal entities.
Invoice Manager loads permitted legal entities for filters and create forms.
Creating users
Section titled “Creating users”- Desk → User → Add User
- Set email, full name, and roles
- Send welcome email if desired
- Add Legal Entity User Permissions when required
- Confirm the user can open
/flowand see the expected In Docs / Out Docs data
API keys
Section titled “API keys”API keys are generated for a User and inherit that user’s permissions and legal entity scope. Prefer a dedicated integration user with least privilege for ERP or PEPPOL API access.
System Managers can generate keys (rate-limited). See REST API Reference.