Fundraising permissions come from two places. Rhythm creates most of them automatically from Fundraising services and query types, and Fundraising also includes a small set of manually defined permissions for access that does not match one record type. This reference explains what each explicit key is intended to control and identifies the keys that do not do anything today.
How Fundraising's Permissions Are Built
Rhythm automatically creates a set of permissions for every Fundraising service, with separate keys to view, create, edit, delete, and administer that service’s records. When a new Fundraising service is added, its permissions are created without anyone defining them by hand. Rhythm also creates run, download, and schedule permissions for every Fundraising query type, so you can grant access separately for running a report, downloading its results, and scheduling email delivery.
A Read-Only Access Level Can Still Schedule Report Delivery by Email
All three managed Fundraising access levels, including Fundraising Read Only Access, grant every query action for every Fundraising query type: run, download, and schedule. This means a staff member with read-only access can still schedule a Fundraising report, including one with donor contact details, to be emailed on a recurring basis. If you need tighter control over report delivery, Fundraising’s ready-made access levels alone cannot provide it.
Explicit Permission Keys
Fundraising also defines a small number of permissions by hand for access decisions that are not tied to one service’s records.
| Key | What it is meant to control | What actually checks it |
|---|---|---|
fundraising:admin:console:access | Open Fundraising Setup | The Setup route |
fundraising:admin:settings:configure | Open Settings and Maintenance | The Settings and Maintenance routes |
fundraising:admin:donors[platform-custom-fields]:{admin} | Administer donor custom fields (Setup › Donor Fields) | The Donor Fields Setup route |
fundraising:queries:console:access | Intended to open the Fundraising Query Center | Nothing observed — the Query Center actually checks a Membership permission instead |
fundraising:reports:console:access | Not tied to a specific page in the evidence | Nothing observed |
fundraising:user:console:access | Not tied to a specific page in the evidence | Nothing observed |
fundraising:user:kpi:opportunities_count_by_pipelines | Copied from a CRM sales figure | Nothing — Fundraising has no such figure, so granting this key changes nothing |
Granting fundraising:queries:console:access Does Not Open the Query Center
This key appears in Fundraising’s permission catalog, but no page checks it. To open the Fundraising Query Center, including the drill-down from a figure tile on the Fundraising overview, you need a Membership query permission instead. See I Cannot Open the Query Center or a Setup Page for what to grant.
Today, Fundraising pages check only fundraising:admin:console:access, fundraising:admin:settings:configure, and the donor custom fields key. To see which ready-made Fundraising access levels grant these permissions, see Staff Access to Fundraising.
Applicability
This reference covers the permission keys that Fundraising defines. It does not cover the Membership query permission that the Fundraising Query Center actually uses, or the platform-wide rules for assigning and combining permissions.