Manage Permissions
The Permissions module allows you to manage permissions granted in KSeF (National e-Invoicing System) to natural persons and entities, within the context of the currently selected NIP.
What can you do here​
- Browse permissions granted in the current context (your NIP or a delegated context).
- View your own personal permissions received from other entities.
- Grant new permissions to a natural person (PESEL or NIP) or to an entity (NIP).
- Revoke previously granted permissions.
- Switch context between your default certificate NIP and any delegated NIPs you have access to.
Permission types​
For natural persons​
| Permission | Description |
|---|---|
CredentialsManage | Grant and revoke permissions on behalf of the entity |
InvoiceWrite | Issue invoices in the entity's name |
InvoiceRead | Browse and download invoices |
Introspection | View session history and operation logs |
SubunitManage | Manage organizational subunits |
For entities (other companies)​
| Permission | Description |
|---|---|
InvoiceWrite | Issue invoices on behalf of your company |
InvoiceRead | Read your company's invoices |
Context switching​
In the top section of the page you can switch between contexts (NIPs):
- Default context — your own NIP from the active certificate.
- Delegated contexts — NIPs of entities that have granted you
CredentialsManagepermission.
After switching, all permission queries and operations are executed in the chosen context.
Important
Each context uses its own KSeF session. Switching the context refreshes the session for the selected NIP. The list of permissions and operations always reflects the active context.
Granting a new permission​
- Click Grant permission.
- Choose the recipient type: Person (PESEL or NIP) or Entity (NIP).
- Select one or more permission types.
- Confirm — the request is sent to KSeF as an asynchronous operation.
The status of every grant/revoke operation is shown in the Operation status panel at the top of the page.
Common errors​
| Status | Meaning |
|---|---|
400 | Invalid request data (e.g. wrong PESEL/NIP format) |
401 | Session expired — re-authenticate |
403 | You don't have CredentialsManage permission in this context |
429 | Too many requests — wait a moment and retry |
If KSeF returns an error, the page replaces the management UI with a banner explaining what happened.