Security and Role-Based Access Control

Roles, authentication, API keys, privacy controls and audit logging in LtvAdx.

Roles

Role	Scope
PLATFORM_SUPER_ADMIN	Everything, across all networks
NETWORK_ADMIN	Full control of one network: users, approvals, settings, billing, reporting
NETWORK_ANALYST	Read-only reporting and delivery data for the network
NETWORK_FINANCE	Billing, wallets and payouts for the network
NETWORK_SUPPORT	Read-only access to accounts, campaigns and channels for support
PARTNER_ADMIN	Administers a white-label partner network
PUBLISHER	Own channels, ad breaks, direct campaigns, revenue and payouts
ADVERTISER	Own campaigns, line items, creatives, wallet and reports
AGENCY	Campaigns and reporting for the advertisers it manages
AD_NETWORK	RTB reports and deal inventory
OPERATOR	Addressable inventory, household segments and schedules

Authentication

Signing in returns a JWT valid for 48 hours; there is no refresh token — sign in again when it expires. The token carries your role, network, tenant, active context and all assigned contexts. Every API call is checked against the role and scoped to the network in the token.

{
  "sub":       "USER_ID",
  "role":      "ADVERTISER",
  "networkId": "…",
  "tenantId":  "…",
  "ctx":       "…",          // active context
  "contexts":  [ … ],        // every context assigned to the user
  "exp":       …
}

A user with several contexts (for example publisher and advertiser) lists them with GET /api/v1/context/list and switches with POST /api/v1/context/switch/{assignmentId}, which issues a new token.

API keys

POST https://api.ltvadx.com/api/v1/account/api-keys
Authorization: Bearer {your-jwt}
{ "name": "Reporting pipeline", "expiresInDays": 365 }   # expiresInDays optional

# The raw key (ltv_live_…) is returned once. List and revoke:
GET    /api/v1/account/api-keys
DELETE /api/v1/account/api-keys/{id}

A key authenticates exactly as its owner's login — same role and data scope. It cannot be limited to a role or IP range. Keys are stored as SHA-256 hashes.

Data protection

All public endpoints are served over HTTPS.
Tracking URLs are HMAC-signed; a tampered beacon is recorded but never billed.
Passwords and API keys are stored hashed.
Raw beacon events keep IP, user agent and device id with no automatic expiry yet — a retention limit is planned.

Privacy and consent

Consent signals are not enforced at serve time

The VAST endpoint does not read gdpr, gdpr_consent, us_privacy, gpp, coppa or lmt, and outbound bid requests carry no regs object. What is enforced today:

Retargeting and audience-segment targeting only run on channels whose publisher has allowed retargeting.
A request without a householdId is anonymous: no caps, no segment targeting.

Audit logging

Configuration changes are written to an activity log, kept for 1 year, visible to network admins in the dashboard and through the API:

GET https://api.ltvadx.com/api/v1/activity-logs
    ?entityType=…&entityId=…
    &from=…&to=…
    &limit=200