Permission catalog

This catalog comes from GET /api/v1/permissions/catalog and is used in the role editor, direct policies, and Personal Access Tokens. How evaluation works is explained in Members and roles.

Scopes and actions

Scope	Actions
workspace	read, write, delete, manage, role.manage, policy.manage, member.invite
device (including gateways)	read, write, delete, connect, publish, subscribe, configure, role.manage, policy.manage
device_type	read, write, role.manage, policy.manage
channel	read, write, delete, connect, publish, subscribe, role.manage, policy.manage
group	read, write, delete, set_parent, set_child, manage_members, connect, publish, subscribe, configure, role.manage, policy.manage
rule	read, write, delete, execute, alarm_read, alarm_update, alarm_delete, alarm_assign, alarm_acknowledge, alarm_resolve, role.manage, policy.manage
report	read, write, delete, execute, role.manage, policy.manage
alarm	read, update, delete, assign, acknowledge, resolve
dashboard	read, write, delete, share
bootstrap	read, write, delete, manage, role.manage, policy.manage
firmware	read, write (upload and delete files), rollout (create and control rollouts)

The wildcard * on a scope or action means everything (only for roles, not for tokens or direct policies).

Important actions explained

Action	Meaning
workspace.read	The minimum requirement to open a workspace.
workspace.manage	View the workspace Journals and export workspace backups.
workspace.member.invite	Invite, resend, and revoke invitations.
channel.connect, device.connect	Create and remove connections (required on both sides).
channel.publish, channel.subscribe	Send messages to a channel from the application (Send message, control widgets) and view Live messages.
device.configure	Save and send device settings, commands, rules on device, and output control.
group.set_parent, set_child, manage_members	Move groups in the hierarchy and manage members.
rule.execute	Run a scheduled rule now.
rule.alarm_* / alarm.*	Handle alarms. Either one is enough.
dashboard.share	Set a dashboard’s sharing options, including a public link.
*.role.manage, *.policy.manage	Manage roles and direct policies on an object (the Access section).

Inheritance through groups

A block with the group scope applies to that group, child groups, and the member devices and channels, with the same action names. For that, the group scope also contains connect, publish, subscribe, and configure.

Device types and bootstraps

A scope-level device permission (without an object or tag) also applies to device types through inheritance. Direct policies and the Access tab are available for device types and bootstraps.

Built-in roles

Role	Permissions
Admin	Every action on every scope. Cannot be deleted or reduced.
Member	Read all entities in the workspace.
Operator	Read all, channel.publish, device.publish, alarm actions on rules (alarm_read, alarm_acknowledge, alarm_resolve), and alarm.acknowledge and alarm.resolve. It does not have device.configure or the firmware scope.
Viewer	Only workspace.read and dashboard.read.

Permissions on a Personal Access Token

A token only accepts allow blocks, and refuses access-management actions: manage, role.manage, policy.manage, member.invite, and *. A token’s effective rights are the intersection of its owner’s rights and the token’s scope (Profile and tokens).

Tip

Grant the smallest possible rights. An example “reader integration” role: workspace.read and channel.read. An example “software that sends commands”: add channel.publish and device.configure on specific devices through a tag restriction.