Permissions catalogue

The complete Permission enum. Values are what appears in a JWT's permissions claim.

Read this at runtime, not from here

GET /permissions on the account API serves the same catalogue, including the dependency graph. Anything that needs the list should read it from there — that is what the management UI does — so it cannot fall out of step.

Global means the permission reaches beyond the organization holding it. The flag bears on who may hand it out, not on how it is checked: granting a global permission needs PermissionsAllGlobal.

Depends on is binding, not advisory. An endpoint asking for a permission asks for its dependencies too, and a group cannot be saved carrying a permission without them.

Library-set scoped means a group's grant may be restricted to specific library sets instead of applying to every one in the organisation — see Library-set scoping.

Permissions

Category	Name	Value	Hex	Global	Library-set scoped	Depends on
Permissions	PermissionsAllGlobal	1	0x0001	✔
Permissions	PermissionsAll	2	0x0002
Permissions	PermissionsImpersonateUser	3	0x0003	✔
Audit	AuditGlobalList	257	0x0101	✔
Audit	AuditGlobalRead	258	0x0102	✔		AuditGlobalList
Audit	AuditList	259	0x0103
Audit	AuditRead	260	0x0104			AuditList
Audit	AuditDelete	262	0x0106
Organizations	GlobalOrganizationList	514	0x0202	✔
Organizations	GlobalOrganizationRead	515	0x0203	✔
Organizations	GlobalOrganizationCreate	516	0x0204	✔
Organizations	GlobalOrganizationUpdate	517	0x0205	✔
Organizations	GlobalOrganizationDelete	518	0x0206	✔
Organizations	GlobalOrganizationCertificateManage	519	0x0207	✔		GlobalOrganizationUpdate
Users	UserList	769	0x0301
Users	UserRead	770	0x0302
Users	UserCreate	771	0x0303
Users	UserUpdate	772	0x0304
Users	UserDelete	773	0x0305
Users	UserCreateServiceAccountApiKey	774	0x0306			UserRead
Tag Groups	TagGroupList	1281	0x0501
Tag Groups	TagGroupRead	1282	0x0502
Tag Groups	TagGroupCreate	1283	0x0503
Tag Groups	TagGroupUpdate	1284	0x0504
Tag Groups	TagGroupDelete	1285	0x0505
Tags	TagList	1537	0x0601
Tags	TagRead	1538	0x0602
Tags	TagCreate	1539	0x0603
Tags	TagUpdate	1540	0x0604
Tags	TagDelete	1541	0x0605
Variables	VariableList	1793	0x0701		✔
Variables	VariableRead	1794	0x0702		✔
Variables	VariableReadSecrets	1795	0x0703		✔	VariableRead
Variables	VariableCreate	1796	0x0704		✔
Variables	VariableUpdate	1797	0x0705		✔
Variables	VariableDelete	1798	0x0706		✔
Batch Processing	BatchProcessingImport	2049	0x0801			16 permissions — see below
Batch Processing	BatchProcessingView	2050	0x0802
Batch Processing	BatchProcessingExport	2051	0x0803			7 permissions — see below
Profile	ProfileCreateApiKey	2305	0x0901
Profile	ProfileNeverExpiresApiKey	2306	0x0902			ProfileCreateApiKey

Values are grouped by category in the high byte, which is why they are not contiguous. 0x0105 is absent — there is no gap in behaviour, only in numbering. 0x0401-0x0405 are absent for the same reason as a retired category: a Groups permission family (GroupList...GroupDelete) used to live there, gating the group endpoints separately from the user endpoints. It was removed — managing a group now uses the equivalent User* permission, since the two are really one administrative area — and the values are not reused.

Descriptions

Permission	Description
PermissionsAllGlobal	All global permissions
PermissionsAll	All organisational permissions
PermissionsImpersonateUser	User Impersonation
AuditGlobalList	Global audit list
AuditGlobalRead	Global audit read
AuditList	List audit
AuditRead	Read audit
AuditDelete	Delete audit
GlobalOrganizationList	List organizations
GlobalOrganizationRead	Read organization
GlobalOrganizationCreate	Create organization
GlobalOrganizationUpdate	Update organization
GlobalOrganizationDelete	Delete organization
GlobalOrganizationCertificateManage	Manage organization certificates
UserList	List users and groups
UserRead	Read users and groups
UserCreate	Create users and groups
UserUpdate	Update users and groups
UserDelete	Delete users and groups
UserCreateServiceAccountApiKey	Create API keys for service accounts
TagGroupList	List tag groups
TagGroupRead	Read tag group
TagGroupCreate	Create tag group
TagGroupUpdate	Update tag group
TagGroupDelete	Delete tag group
TagList	List tags
TagRead	Read tag
TagCreate	Create tag
TagUpdate	Update tag
TagDelete	Delete tag
VariableList	List variables
VariableRead	Read variable
VariableReadSecrets	Read variable secrets
VariableCreate	Create variable
VariableUpdate	Update variable
VariableDelete	Delete variable
BatchProcessingImport	Import Tag Groups, Tags and Library Sets
BatchProcessingView	View Batch Processing
BatchProcessingExport	Export Tag Groups and Library Sets
ProfileCreateApiKey	Create API key
ProfileNeverExpiresApiKey	Never expiring API key

The catch-alls

PermissionsAllGlobal, PermissionsAll and PermissionsImpersonateUser say what their holder may hand out, not what they may do. Someone holding PermissionsAll administers every non-global permission in the organization and still only does what they have actually been given.

See granting versus holding.

BatchProcessingImport

Depends on all sixteen of:

BatchProcessingView, TagGroupList, TagGroupRead, TagGroupCreate, TagGroupUpdate, TagGroupDelete, TagList, TagRead, TagCreate, TagUpdate, TagDelete, VariableList, VariableRead, VariableCreate, VariableUpdate, VariableDelete

An import creates tag groups, tags, library sets and variables, and replacing takes all of them away again — so it depends on everything it touches rather than standing for the one thing it writes first.

VariableReadSecrets is deliberately absent: an import writes values, sensitive ones included, without ever being shown one back.

An import can create or replace content in any library set named in the file, so every Variable* permission above must be held unrestricted — a grant scoped to specific library sets is refused outright, with 403, rather than applied to part of the file. See Library-set scoping.

BatchProcessingExport

Depends on all seven of:

BatchProcessingView, TagGroupList, TagGroupRead, TagList, TagRead, VariableList, VariableRead

Unlike import, an export only ever lists and reads what it writes to a file, so it depends on the list and read permission of each of the three kinds it touches rather than all five.

VariableReadSecrets is absent from the dependency list for the same reason it is not required outright elsewhere: whether it is needed depends on the request's secretExportOption, checked in the handler rather than declared as a blanket dependency. Asking to export a secret's actual value (secretExportOption=Value) without holding it is refused with 403.

The same as import: an export can read from any library set named in the request, so every permission above - VariableReadSecrets included, when secretExportOption=Value is asked for - must be held unrestricted. A grant scoped to specific library sets is refused outright rather than applied to part of the request.

Notes on individual permissions

VariableReadSecrets says nothing on its own. Every endpoint that hands over a secret asks to read the variable first.

GlobalOrganizationCertificateManage is kept separate from GlobalOrganizationUpdate on purpose: it depends on GlobalOrganizationUpdate but is not implied by it, so an organisation's record can be edited without also being trusted to reissue the certificate its secrets are encrypted against.

BatchProcessingView shows the management UI's Batch section at all; BatchProcessingImport and BatchProcessingExport each depend on it and separately control the Import and Export subsections within that page.

ProfileCreateApiKey and ProfileNeverExpiresApiKey cover what someone may do to their own account. A key is minted for whoever asks and never for another account, which is why there is no read or list permission beside them — an account's own keys are its own business.

UserCreateServiceAccountApiKey is the counterpart for somebody else's account, and only a service account's: a service account has no login, so it has no session in which to ask for its own key. It is kept apart from UserCreate (which only makes the account) and UserUpdate (which only edits it), because a key is a standing credential that acts as the account with whatever its groups grant. It depends on UserRead, since the key is made from the account's own page. It is not included in organization impersonation, for the same reason as ProfileCreateApiKey. A key that never expires still needs ProfileNeverExpiresApiKey, held by the person making the key rather than by the service account.

AuditGlobalList widens the audit list to include entries belonging to no organization; it does not replace AuditList.

The permissions claim

The JWT carries a flat array of the integer values above — exactly what was granted, with no dependency expansion. Expansion happens at check time.

{ "permissions": [769, 1281, 1537, 1793, 1794] }

That set is UserList, TagGroupList, TagList, VariableList, VariableRead.

The librarySetScopes claim

Present only when at least one library-set-scopable permission above is restricted to specific library sets; absent entirely for an account with nothing scoped, so an ordinary token is unchanged from before this claim existed. See the JWT reference for the full shape.

{ "librarySetScopes": [{ "permission": 1794, "variableSetIds": [12, 47] }] }

That entry says VariableRead (1794) reaches only library sets 12 and 47 — every other permission in the permissions array above applies to every library set, unaffected.