Raiser's Edge NXT Permissions
What Raiser's Edge NXT permissions do I need?
This article covers what your Blackbaud Raiser's Edge NXT (RENXT) environment and user account need before the iDonate integration can be connected, and what to do when access changes.
What Your Organization Needs
- A RENXT subscription with SKY API enabled.
- A RENXT user who authorizes the connection and who holds the permissions listed below.
The Authorizing User
The integration acts in RENXT as the user who authorizes the connection, so that user's permissions become the integration's permissions. Choose an account that will remain active long-term. A shared or service-style account managed by your RENXT administrator is a good fit; a personal account belonging to someone who may change roles is not.
Required Role
The authorizing user must hold the Extensibility / NXT Data Integration role. This is the role that permits creating funds, campaigns, appeals, and gift batches through SKY API, which the integration relies on.
If the integration connects successfully but records are not appearing in RENXT, this role is the first thing to check. It is the permission the integration is most often missing.
Record Access
Beyond the role above, the authorizing user needs to be able to view and add the record types the integration works with. The table below describes what the integration reads and writes, so your RENXT administrator can confirm the account has the corresponding access.
| Area | Access Needed | Why |
| Constituents | View, Add, Edit | Match donors to existing constituents and create new ones. |
| Addresses, Email Addresses, Phones | View, Add, Edit | Keep donor contact information current on the constituent record. |
| Constituent Actions | View, Add | Flag possible duplicate constituents for your team to review and merge. |
| Gifts | View, Add, Edit | Create one-time gifts, recurring gifts, and recurring gift payments. |
| Gift Batches | View, Add, Edit | Create the batches gifts are staged into when Posting Mode is set to Batch. |
| Funds, Campaigns, Appeals | View, Add | Match iDonate designations and campaigns, and create them when auto-create is enabled. |
| Gift Custom Fields | View, Add | Write mapped iDonate values, such as the transaction ID, onto the gift. |
Confirming SKY API Is Enabled
SKY API availability is an entitlement on your RENXT subscription, not a setting you toggle. If you are unsure whether your environment has it, your Blackbaud account representative or Blackbaud Support can confirm it.
Azure and Blackbaud-Hosted Databases
Blackbaud has been migrating RENXT databases to Microsoft Azure. This does not change anything about the iDonate integration and requires no configuration changes on your side. The integration works through SKY API, which sits above the database layer.
The one practical consequence is timing: if your environment is migrated after the integration is connected, the connection will need to be re-authorized afterward. For details on the migration itself, see Blackbaud's article on database migrations to Azure.
Other Blackbaud integrations your organization uses may need their own adjustments after a migration. Those are outside the iDonate integration and are handled with the vendor that provides them.
When the Connection Must Be Re-Authorized
Re-authorize the integration in iDonate under Settings > Integrations when any of the following happens:
- The authorizing user is deactivated, or their RENXT access is removed.
- The authorizing user's role assignments change and they lose the Extensibility / NXT Data Integration role.
- Your RENXT environment is migrated or re-provisioned by Blackbaud.
- Blackbaud resets the authorization for your environment.
Re-authorizing does not remove your configuration or mapped custom fields, and it does not change any records already written to RENXT.
To connect the integration and walk through each configuration option, see Setting Up Raiser's Edge NXT. For how iDonate data lands in Raiser's Edge NXT, see Raiser's Edge NXT Field Mapping.