Permissions catalogue

The complete Permission enum. Values are what appears in a JWT's permissions claim.

Read this at runtime, not from here

GET /permissions on the account API serves the same catalogue, including the dependency graph. Anything that needs the list should read it from there — that is what the management UI does — so it cannot fall out of step.

Global means the permission reaches beyond the organization holding it. The flag bears on who may hand it out, not on how it is checked: granting a global permission needs PermissionsAllGlobal.

Depends on is binding, not advisory. An endpoint asking for a permission asks for its dependencies too, and a group cannot be saved carrying a permission without them.

Permissions

Category	Name	Value	Hex	Global	Depends on
Permissions	PermissionsAllGlobal	1	0x0001	✔
Permissions	PermissionsAll	2	0x0002
Permissions	PermissionsImpersonate	3	0x0003	✔
Audit	AuditGlobalList	257	0x0101	✔
Audit	AuditGlobalRead	258	0x0102	✔	AuditGlobalList
Audit	AuditList	259	0x0103
Audit	AuditRead	260	0x0104		AuditList
Audit	AuditDelete	262	0x0106
Organizations	OrganizationList	514	0x0202	✔
Organizations	OrganizationRead	515	0x0203	✔
Organizations	OrganizationCreate	516	0x0204	✔
Organizations	OrganizationUpdate	517	0x0205	✔
Organizations	OrganizationDelete	518	0x0206	✔
Users	UserList	769	0x0301
Users	UserRead	770	0x0302
Users	UserCreate	771	0x0303
Users	UserUpdate	772	0x0304
Users	UserDelete	773	0x0305
Groups	GroupList	1025	0x0401
Groups	GroupRead	1026	0x0402
Groups	GroupCreate	1027	0x0403
Groups	GroupUpdate	1028	0x0404
Groups	GroupDelete	1029	0x0405
Tag Groups	TagGroupList	1281	0x0501
Tag Groups	TagGroupRead	1282	0x0502
Tag Groups	TagGroupCreate	1283	0x0503
Tag Groups	TagGroupUpdate	1284	0x0504
Tag Groups	TagGroupDelete	1285	0x0505
Tags	TagList	1537	0x0601
Tags	TagRead	1538	0x0602
Tags	TagCreate	1539	0x0603
Tags	TagUpdate	1540	0x0604
Tags	TagDelete	1541	0x0605
Variables	VariableList	1793	0x0701
Variables	VariableRead	1794	0x0702
Variables	VariableReadSecrets	1795	0x0703		VariableRead
Variables	VariableCreate	1796	0x0704
Variables	VariableUpdate	1797	0x0705
Variables	VariableDelete	1798	0x0706
Batch Processing	BatchProcessingImport	2049	0x0801		15 permissions — see below
Profile	ProfileCreateApiKey	2305	0x0901
Profile	ProfileNeverExpiresApiKey	2306	0x0902		ProfileCreateApiKey

Values are grouped by category in the high byte, which is why they are not contiguous. 0x0105 is absent — there is no gap in behaviour, only in numbering.

Descriptions

Permission	Description
PermissionsAllGlobal	All global permissions
PermissionsAll	All organisational permissions
PermissionsImpersonate	User Impersonation
AuditGlobalList	Global audit list
AuditGlobalRead	Global audit read
AuditList	List audit
AuditRead	Read audit
AuditDelete	Delete audit
OrganizationList	List organizations
OrganizationRead	Read organization
OrganizationCreate	Create organization
OrganizationUpdate	Update organization
OrganizationDelete	Delete organization
UserList	List users
UserRead	Read user
UserCreate	Create user
UserUpdate	Update user
UserDelete	Delete user
GroupList	List groups
GroupRead	Read group
GroupCreate	Create group
GroupUpdate	Update group
GroupDelete	Delete group
TagGroupList	List tag groups
TagGroupRead	Read tag group
TagGroupCreate	Create tag group
TagGroupUpdate	Update tag group
TagGroupDelete	Delete tag group
TagList	List tags
TagRead	Read tag
TagCreate	Create tag
TagUpdate	Update tag
TagDelete	Delete tag
VariableList	List variables
VariableRead	Read variable
VariableReadSecrets	Read variable secrets
VariableCreate	Create variable
VariableUpdate	Update variable
VariableDelete	Delete variable
BatchProcessingImport	Import Tag Groups, Tags and Library Sets
ProfileCreateApiKey	Create API key
ProfileNeverExpiresApiKey	Never expiring API key

The catch-alls

PermissionsAllGlobal, PermissionsAll and PermissionsImpersonate say what their holder may hand out, not what they may do. Someone holding PermissionsAll administers every non-global permission in the organization and still only does what they have actually been given.

See granting versus holding.

BatchProcessingImport

Depends on all fifteen of:

TagGroupList, TagGroupRead, TagGroupCreate, TagGroupUpdate, TagGroupDelete, TagList, TagRead, TagCreate, TagUpdate, TagDelete, VariableList, VariableRead, VariableCreate, VariableUpdate, VariableDelete

An import creates tag groups, tags, library sets and variables, and replacing takes all of them away again — so it depends on everything it touches rather than standing for the one thing it writes first.

VariableReadSecrets is deliberately absent: an import writes values, sensitive ones included, without ever being shown one back.

Notes on individual permissions

VariableReadSecrets says nothing on its own. Every endpoint that hands over a secret asks to read the variable first.

ProfileCreateApiKey and ProfileNeverExpiresApiKey cover what someone may do to their own account. A key is minted for whoever asks and never for another account, which is why there is no read or list permission beside them — an account's own keys are its own business.

AuditGlobalList widens the audit list to include entries belonging to no organization; it does not replace AuditList.

The permissions claim

The JWT carries a flat array of the integer values above — exactly what was granted, with no dependency expansion. Expansion happens at check time.

{ "permissions": [769, 1025, 1281, 1537, 1793, 1794] }

That set is UserList, GroupList, TagGroupList, TagList, VariableList, VariableRead.