Read-only and read-write

Every connected Recurly site is either read-only or read-and-write. Read-only can be asked anything; refunds, cancels and bulk fixes need read-and-write, and still follow your rules.

Each Recurly site you connect has an access setting: read-only or read and write. It is the outermost limit on what Retrixus may do to that site, checked before anything else.

Read-only

Retrixus can look, but never change. Your team can:

• look up customers, subscriptions, invoices, payments and credits;
• ask questions across your data, including counts, trends and attribution;
• set up watches that alert you when something looks unusual.

Reading cannot damage anything. Recurly's own permissions still apply on top: if the API key you gave Retrixus cannot see something, neither can Retrixus.

New sites start read-only. Connect a sandbox or a production site this way first, ask your first questions, and switch on writing only when you are ready.

Read and write

On a read-and-write site, people whose role and plan allow it can also:

• refund a charge and cancel a subscription, one at a time;
• run bulk fixes: cancel, refund, stop retrying failed payments, set fields and add notes for a whole group of accounts at once.

Switching a site to read and write does not hand anyone a blank cheque. Every change still goes through the same safeguards:

• Your rules. Who may refund, how much per refund and per day, how old a charge may be, and which reasons are allowed. See Roles and refund rules.
• A preview and a clear yes. Nothing changes until the person sees exactly what will happen, to whom and for how much, and confirms it.
• Approval over the limits. A refund over someone's limit goes to a Manager. A bulk fix over the Manager limits needs an Admin or Owner, never the person who asked for it.
• A record of every one. Each change is written to your audit log before and after it happens, and the audit log cannot be edited or deleted.

Changing the setting

An Admin or Owner changes it on the site's page in the portal: Admin → Connections, choose the site, then Access. Switching to read and write asks you to type the site's short name to confirm. That is deliberate friction on a setting that is easy to flip and hard to notice.

Treat moving a production site to read and write as a decision with a date on it, not a checkbox. Many teams leave their sandbox read-and-write for practice and switch production on once their refund rules are set.