Membership permissions

Account members can be assigned different rights to an account, allowing access to only the desired actions and information. These rights are referred to as permissions in the Swan API and Web Banking interface.

Swan doesn't offer role-based access control (RBAC). Instead, you choose exactly what each account member can see and do on a member-by-member basis.

The membership permissions reference holds the full list of permissions and the card-management matrix.

Granting permissions

To grant permissions to other account members, the account member must have the permission canManageAccountMembership. They can only grant permissions they already have.

For example, if an account member doesn't have the canManageCards permission, they can't grant it to another account member. If they try to grant the canManageCards permission anyway, the API returns a PermissionCannotBeGrantedRejection error.

No permissions

You can add account members without granting them any membership permissions. For example, if you want to give a user a card associated with the account, but you don't want them to view account information or perform any actions for the account, you'd add an account membership with no permissions.

In this case, all membership permission booleans are false. This type of invitation doesn't require consent from the account holder and skips the status InvitationSent.

Country requirements for account memberships

Required and optional membership fields vary by IBAN country.

Validation rules

Field-format rules, including the first and last name pattern, are in the membership fields reference.

Removing identification

Verifying your account members' identity is a required step in most circumstances. But with a detailed agreement with Swan, you might be allowed to bypass identification for certain membership permissions.

Even if your project is configured to remove identification, memberships with the following permissions can't bypass it:

• canManageAccountMembership
• canInitiatePayments
• canManageBeneficiaries

This configuration is retroactive. Memberships created before identification was removed no longer need to verify their identity. Contact your PIM (Product Integration Manager) to ask about removing identification.