Roles and Permissions in API Service

Permissions

The API service uses a fine-grained permission model to control what each request can do. Every operation is gated by one or more built-in permissions, which are grouped by resource area — code, config, preview, live, media, jobs, and more — and combined into roles. The table below lists each built-in permission and the action it authorizes:

Permission	Purpose
`cache:write`	Purge cache
`code:delete`	Delete code
`code:delete-forced`	Delete code (forced)
`code:list`	List code resources
`code:read`	Read code status
`code:write`	Update code
`config:read`	Read all config
`config:read-redacted`	Read redacted config
`config:write`	Update config
`edit:list`	List edit resources
`edit:read`	Read edit status
`index:read`	Read index matching
`index:write`	Reindex
`job:list`	List jobs
`job:read`	Read job information
`job:write`	Start jobs
`live:delete`	Delete live resources
`live:delete-forced`	Delete live resources (forced)
`live:list`	List live resources
`live:read`	Read live status
`live:write`	Update live resources (publish)
`log:read`	Read logs
`log:write`	Write logs (append)
`media:upload`	Upload media
`preview:delete`	Delete source and preview resources
`preview:delete-forced`	Delete source and preview resources (forced)
`preview:list`	List source and preview resources
`preview:read`	Read source and preview information
`preview:write`	Update source and preview
`snapshot:delete`	Delete snapshots
`snapshot:read`	Read snapshots
`snapshot:write`	Update snapshots

Roles

The API service ships with a set of built-in roles that bundle permissions for common jobs like viewing, authoring, developing, publishing, and administrating. A role can be assigned to individuals or groups to grant its full set of permissions at once. The table below lists each role and the permissions it includes:

Role	Permissions
`admin`	`<all permissions>`
`author`	`cache:write` `code:delete` `code:list` `code:read` `code:write` `config:read-redacted` `edit:list` `edit:read` `index:read` `index:write` `job:list` `job:read` `job:write` `live:read` `log:read` `media:upload` `preview:delete` `preview:list` `preview:read` `preview:write` `snapshot:delete` `snapshot:read`
`config`	`config:read-redacted`
`config_admin`	`cache:write` `code:delete` `code:list` `code:read` `code:write` `config:read` `config:read-redacted` `config:write` `edit:list` `edit:read` `index:read` `index:write` `job:list` `job:read` `job:write` `live:delete` `live:list` `live:read` `live:write` `log:read` `media:upload` `preview:delete` `preview:list` `preview:read` `preview:write` `snapshot:delete` `snapshot:read` `snapshot:write`
`develop`	`cache:write` `code:delete` `code:delete-forced` `code:list` `code:read` `code:write` `config:read-redacted` `edit:list` `edit:read` `index:read` `index:write` `job:list` `job:read` `job:write` `live:read` `log:read` `media:upload` `preview:delete` `preview:list` `preview:read` `preview:write` `snapshot:delete` `snapshot:read`
`publish`	`cache:write` `code:delete` `code:list` `code:read` `code:write` `config:read` `config:read-redacted` `config:write` `edit:list` `edit:read` `index:read` `index:write` `job:list` `job:read` `job:write` `live:delete` `live:list` `live:read` `live:write` `log:read` `media:upload` `preview:delete` `preview:list` `preview:read` `preview:write` `snapshot:delete` `snapshot:read` `snapshot:write`
`view`	`code:list` `code:read` `config:read-redacted` `edit:list` `edit:read` `index:read` `job:list` `job:read` `live:read` `log:read` `preview:list` `preview:read` `snapshot:read`