RBAC Resources and Actions Mapped to API Endpoints

For the complete documentation index, see llms.txt. For a full content snapshot, see llms-full.txt. Append .md to any kestra.io/docs/* URL for plain Markdown.

Available on:Enterprise EditionCloud

This reference maps each RBAC resource and action to the API endpoints that enforce it. Use it to design least-privilege roles and troubleshoot authorization errors.

How to read this page

  • Endpoints are grouped by resource and action.
  • Each resource section gates all its endpoints: a user must have at least one valid action on the resource to reach any endpoint within it. Endpoints that do not check a specific action beyond this gate are marked “any action”.
  • Some endpoints require permissions on more than one resource; notes call these out.
  • Namespace-scoped resources respect namespace bindings: access is evaluated against the namespace of the target item, and child namespaces inherit access.
FLOW

Scope: Namespace

Actions and their meaning

  • VIEW: read a single flow, its graph, revisions, tasks, dependencies, and expressions context.
  • LIST: search or browse flows.
  • CREATE: create a flow. Creating a flow in a namespace that does not yet exist also requires NAMESPACE: CREATE.
  • UPDATE: modify a flow’s source, tasks, or graph.
  • DELETE: delete a flow or its revisions.
  • EXECUTE: trigger an execution of a flow.
  • DISABLE: disable a flow.
  • ENABLE: enable a disabled flow.
  • VALIDATE: validate flow YAML. (Accessible with any FLOW action — no dedicated check.)
  • EXPORT: export flows as a ZIP archive.
  • IMPORT: import flows from an archive.

Endpoints

VIEW

  • GET /api/v1/{tenant}/flows/{namespace}/{id}
  • GET /api/v1/{tenant}/flows/{namespace}/{id}/graph
  • GET /api/v1/{tenant}/flows/{namespace}/{id}/revisions
  • GET /api/v1/{tenant}/flows/{namespace}/{id}/tasks/{taskId}
  • GET /api/v1/{tenant}/flows/{namespace}/{id}/dependencies
  • GET /api/v1/{tenant}/namespaces/{namespace}/dependencies
  • POST /api/v1/{tenant}/flows/expressions

LIST

  • GET /api/v1/{tenant}/flows/search
  • GET /api/v1/{tenant}/flows/{namespace}
  • GET /api/v1/{tenant}/flows/source
  • GET /api/v1/{tenant}/flows/distinct-namespaces (any FLOW action)
  • GET /api/v1/{tenant}/flows/deprecated

CREATE

  • POST /api/v1/{tenant}/flows (single flow)
  • POST /api/v1/{tenant}/flows/{namespace} (bulk upsert; also requires UPDATE and DELETE)

UPDATE

  • PUT /api/v1/{tenant}/flows/{namespace}/{id}
  • POST /api/v1/{tenant}/flows/bulk (also requires CREATE and DELETE)
  • POST /api/v1/{tenant}/executions/{executionId}/actions/eval
  • POST /api/v1/{tenant}/executions/{executionId}/actions/eval/{taskRunId}

DELETE

  • DELETE /api/v1/{tenant}/flows/{namespace}/{id}
  • DELETE /api/v1/{tenant}/flows/{namespace}/{id}/revisions (specific revisions)
  • DELETE /api/v1/{tenant}/flows/delete/by-query
  • DELETE /api/v1/{tenant}/flows/delete/by-ids

EXECUTE

  • POST /api/v1/{tenant}/executions/{namespace}/{id} (create execution)
  • POST /api/v1/{tenant}/executions/{namespace}/{id}/validate
  • GET /api/v1/{tenant}/executions/namespaces/{namespace}/flows

DISABLE

  • POST /api/v1/{tenant}/flows/disable/by-query
  • POST /api/v1/{tenant}/flows/disable/by-ids

ENABLE

  • POST /api/v1/{tenant}/flows/enable/by-query
  • POST /api/v1/{tenant}/flows/enable/by-ids

EXPORT

  • GET /api/v1/{tenant}/flows/export/by-query
  • POST /api/v1/{tenant}/flows/export/by-ids
  • GET /api/v1/{tenant}/flows/export/by-query/csv (streaming)

IMPORT

  • POST /api/v1/{tenant}/flows/import

VALIDATE (any FLOW action — no dedicated check)

  • POST /api/v1/{tenant}/flows/validate
  • POST /api/v1/{tenant}/flows/validate/task
  • POST /api/v1/{tenant}/flows/validate/trigger

Notes

  • Webhook execution endpoints (/executions/webhook/{namespace}/{id}/{key}) are authorized by webhook key, not RBAC.
  • POST /api/v1/{tenant}/flows/graph has no action check.
EXECUTION

Scope: Namespace

Actions and their meaning

  • VIEW: read a single execution’s details, graph, or associated flow.
  • LIST: search or browse executions.
  • DELETE: delete executions.
  • RESTART: restart one or more executions from the beginning or a specific task.
  • KILL: kill a running execution.
  • REPLAY: replay an execution (creates a new execution from a previous one).
  • PAUSE: pause a running execution.
  • RESUME: resume a paused execution.
  • CHANGE_LABELS: update labels on a terminated execution.
  • ACCESS_LOGS: read or stream execution logs.
  • ACCESS_OUTPUTS: read task run outputs.
  • ACCESS_FILES: download or preview execution output files.
  • FOLLOW: stream live execution status events via SSE.
  • EXPORT: export execution data as CSV.
  • UNQUEUE: move a queued execution out of the queue.
  • FORCE_RUN: force a paused or queued execution to run immediately.
  • UPDATE: change the state of a task run within an execution.

Endpoints

VIEW

  • GET /api/v1/{tenant}/executions/{executionId}
  • GET /api/v1/{tenant}/executions/{executionId}/graph
  • GET /api/v1/{tenant}/executions/{executionId}/flow
  • GET /api/v1/{tenant}/executions/flows/{namespace}/{flowId}

LIST

  • GET /api/v1/{tenant}/executions/search
  • GET /api/v1/{tenant}/executions
  • GET /api/v1/{tenant}/executions/flows/{namespace}/{flowId} (search by flow)
  • GET /api/v1/{tenant}/executions/namespaces (distinct namespaces with executions)
  • POST /api/v1/{tenant}/executions/latest (any EXECUTION action)

DELETE

  • DELETE /api/v1/{tenant}/executions/{executionId}
  • DELETE /api/v1/{tenant}/executions/by-ids
  • DELETE /api/v1/{tenant}/executions/by-query
  • DELETE /api/v1/{tenant}/logs/{executionId} (delete logs for an execution)
  • DELETE /api/v1/{tenant}/logs/{namespace}/{flowId} (delete logs for a flow)

RESTART

  • POST /api/v1/{tenant}/executions/{executionId}/actions/restart
  • POST /api/v1/{tenant}/executions/restart/by-ids
  • POST /api/v1/{tenant}/executions/restart/by-query

KILL

  • DELETE /api/v1/{tenant}/executions/{executionId}/actions/kill
  • DELETE /api/v1/{tenant}/executions/kill/by-ids
  • DELETE /api/v1/{tenant}/executions/kill/by-query

REPLAY

  • POST /api/v1/{tenant}/executions/{executionId}/actions/replay
  • POST /api/v1/{tenant}/executions/{executionId}/actions/replay-with-inputs
  • POST /api/v1/{tenant}/executions/replay/by-ids
  • POST /api/v1/{tenant}/executions/replay/by-query

PAUSE

  • POST /api/v1/{tenant}/executions/{executionId}/actions/pause
  • POST /api/v1/{tenant}/executions/pause/by-ids
  • POST /api/v1/{tenant}/executions/pause/by-query

RESUME

  • POST /api/v1/{tenant}/executions/{executionId}/actions/resume
  • POST /api/v1/{tenant}/executions/{executionId}/actions/resume-from-breakpoint
  • POST /api/v1/{tenant}/executions/resume/by-ids
  • POST /api/v1/{tenant}/executions/resume/by-query

CHANGE_LABELS

  • POST /api/v1/{tenant}/executions/{executionId}/actions/labels
  • POST /api/v1/{tenant}/executions/labels/by-ids
  • POST /api/v1/{tenant}/executions/labels/by-query

ACCESS_LOGS

  • GET /api/v1/{tenant}/logs/search
  • GET /api/v1/{tenant}/logs/{executionId}
  • GET /api/v1/{tenant}/logs/{executionId}/download
  • GET /api/v1/{tenant}/logs/{executionId}/follow (SSE log stream)

ACCESS_OUTPUTS

  • GET /api/v1/{tenant}/outputs/tasks/{executionId}/{taskRunId}
  • GET /api/v1/{tenant}/outputs/tasks/{executionId}
  • GET /api/v1/{tenant}/outputs/executions/{executionId}

ACCESS_FILES

  • GET /api/v1/{tenant}/executions/{executionId}/file
  • GET /api/v1/{tenant}/executions/{executionId}/file/metas
  • GET /api/v1/{tenant}/executions/{executionId}/file/preview

FOLLOW

  • GET /api/v1/{tenant}/executions/{executionId}/follow (SSE execution state stream)
  • GET /api/v1/{tenant}/executions/{executionId}/follow-dependencies

EXPORT

  • GET /api/v1/{tenant}/executions/export/by-query/csv (streaming)

UNQUEUE

  • POST /api/v1/{tenant}/executions/{executionId}/actions/unqueue
  • POST /api/v1/{tenant}/executions/unqueue/by-ids
  • POST /api/v1/{tenant}/executions/unqueue/by-query

FORCE_RUN

  • POST /api/v1/{tenant}/executions/{executionId}/actions/force-run
  • POST /api/v1/{tenant}/executions/force-run/by-ids
  • POST /api/v1/{tenant}/executions/force-run/by-query

UPDATE

  • POST /api/v1/{tenant}/executions/{executionId}/actions/change-status
  • POST /api/v1/{tenant}/executions/change-status/by-ids
  • POST /api/v1/{tenant}/executions/change-status/by-query
  • POST /api/v1/{tenant}/executions/{executionId}/actions/state

Notes

  • Webhook execution endpoints are authorized by webhook key only; RBAC is not checked.
  • Execution creation (POST /executions/{namespace}/{id}) checks FLOW: EXECUTE, not an EXECUTION action.
TRIGGER

Scope: Namespace

Actions and their meaning

  • LIST: search or browse triggers.
  • UNLOCK: unlock a locked trigger.
  • RESTART: restart a trigger.
  • DISABLE / ENABLE: disable or enable triggers (both operations check the DISABLE action).
  • DELETE: delete triggers.
  • EXPORT: export trigger configuration.
  • BACKFILL: create, pause, unpause, or delete a backfill on a schedule trigger.

Endpoints

LIST

  • GET /api/v1/{tenant}/triggers/search
  • GET /api/v1/{tenant}/triggers/{namespace}/{flowId}

UNLOCK

  • POST /api/v1/{tenant}/triggers/{namespace}/{flowId}/{triggerId}/unlock
  • POST /api/v1/{tenant}/triggers/unlock/by-triggers
  • POST /api/v1/{tenant}/triggers/unlock/by-query

RESTART

  • POST /api/v1/{tenant}/triggers/{namespace}/{flowId}/{triggerId}/restart

DISABLE / ENABLE

  • PUT /api/v1/{tenant}/triggers/set-disabled (also used for re-enabling)
  • POST /api/v1/{tenant}/triggers/set-disabled/by-triggers
  • POST /api/v1/{tenant}/triggers/set-disabled/by-query

DELETE

  • DELETE /api/v1/{tenant}/triggers/{namespace}/{flowId}/{triggerId}
  • DELETE /api/v1/{tenant}/triggers/delete/by-triggers
  • DELETE /api/v1/{tenant}/triggers/delete/by-query

EXPORT

  • GET /api/v1/{tenant}/triggers/export/by-query/csv (streaming)

BACKFILL

  • PUT /api/v1/{tenant}/triggers/backfill/create
  • PUT /api/v1/{tenant}/triggers/backfill/pause
  • POST /api/v1/{tenant}/triggers/backfill/pause/by-triggers
  • POST /api/v1/{tenant}/triggers/backfill/pause/by-query
  • PUT /api/v1/{tenant}/triggers/backfill/unpause
  • POST /api/v1/{tenant}/triggers/backfill/unpause/by-triggers
  • POST /api/v1/{tenant}/triggers/backfill/unpause/by-query
  • POST /api/v1/{tenant}/triggers/backfill/delete
  • POST /api/v1/{tenant}/triggers/backfill/delete/by-triggers
  • POST /api/v1/{tenant}/triggers/backfill/delete/by-query
NAMESPACE

Scope: Namespace

Actions and their meaning

  • VIEW: read a namespace’s details and inherited variables.
  • LIST: search or browse namespaces.
  • CREATE: create a namespace.
  • UPDATE: update namespace configuration.
  • DELETE: delete a namespace.
  • MANAGE_FILES: all namespace file operations (search, read, create, move, delete, export).

Endpoints

VIEW

  • GET /api/v1/{tenant}/namespaces/{id}
  • GET /api/v1/{tenant}/namespaces/{id}/inherited-variables

LIST

  • GET /api/v1/{tenant}/namespaces/search
  • POST /api/v1/{tenant}/namespaces/autocomplete

CREATE

  • POST /api/v1/{tenant}/namespaces

UPDATE

  • PUT /api/v1/{tenant}/namespaces/{id}

DELETE

  • DELETE /api/v1/{tenant}/namespaces/{id}

MANAGE_FILES (all namespace file operations)

  • GET /api/v1/{tenant}/namespaces/{namespace}/files/search
  • GET /api/v1/{tenant}/namespaces/{namespace}/files
  • GET /api/v1/{tenant}/namespaces/{namespace}/files/stats
  • GET /api/v1/{tenant}/namespaces/{namespace}/files/revisions
  • GET /api/v1/{tenant}/namespaces/{namespace}/files/directory
  • GET /api/v1/{tenant}/namespaces/{namespace}/files/export
  • POST /api/v1/{tenant}/namespaces/{namespace}/files/directory (create directory)
  • POST /api/v1/{tenant}/namespaces/{namespace}/files (create file)
  • PUT /api/v1/{tenant}/namespaces/{namespace}/files (move file or directory)
  • DELETE /api/v1/{tenant}/namespaces/{namespace}/files (delete file or directory)
KVSTORE

Scope: Namespace

Actions and their meaning

  • VIEW: read a KV entry.
  • LIST: list or browse KV entries, including inherited entries.
  • CREATE / UPDATE: set a KV value (the same endpoint creates or updates depending on whether the key exists).
  • DELETE: delete KV entries.

Endpoints

VIEW

  • GET /api/v1/{tenant}/namespaces/{namespace}/kv/{key}
  • GET /api/v1/{tenant}/namespaces/{namespace}/kv/{key}/detail

LIST

  • GET /api/v1/{tenant}/kv
  • GET /api/v1/{tenant}/namespaces/{namespace}/kv/inheritance

CREATE / UPDATE

  • PUT /api/v1/{tenant}/namespaces/{namespace}/kv/{key} (creates if key does not exist, updates if it does)

DELETE

  • DELETE /api/v1/{tenant}/namespaces/{namespace}/kv/{key}
  • DELETE /api/v1/{tenant}/namespaces/{namespace}/kv (bulk delete)
DASHBOARD

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: read dashboards and their charts.
  • CREATE: create dashboards.
  • UPDATE: update dashboard configuration.
  • DELETE: delete dashboards.

Endpoints

VIEW / LIST (any DASHBOARD action — no dedicated per-action check at controller level)

  • GET /api/v1/{tenant}/dashboards
  • GET /api/v1/{tenant}/dashboards/{id}
  • POST /api/v1/{tenant}/dashboards/{id}/charts/{chartId}
  • POST /api/v1/{tenant}/dashboards/charts/preview
  • POST /api/v1/{tenant}/dashboards/validate
  • POST /api/v1/{tenant}/dashboards/validate/chart
  • POST /api/v1/{tenant}/dashboards/{id}/charts/{chartId}/export
  • POST /api/v1/{tenant}/dashboards/charts/export

CREATE

  • POST /api/v1/{tenant}/dashboards

UPDATE

  • PUT /api/v1/{tenant}/dashboards/{id}

DELETE

  • DELETE /api/v1/{tenant}/dashboards/{id}
SECRET

Scope: Namespace

Actions and their meaning

  • VIEW / LIST: list secrets and view their metadata. Secret values are never returned by the API.
  • UPDATE: create or update a secret (creation is enforced via this action).
  • DELETE: delete a secret.

Endpoints

VIEW / LIST (any SECRET action)

  • GET /api/v1/{tenant}/secrets
  • GET /api/v1/{tenant}/namespaces/{namespace}/inherited-secrets

UPDATE

  • PUT /api/v1/{tenant}/namespaces/{namespace}/secrets
  • PATCH /api/v1/{tenant}/namespaces/{namespace}/secrets/{key}

DELETE

  • DELETE /api/v1/{tenant}/namespaces/{namespace}/secrets/{key}

Notes

  • SECRET has no CREATE action; creation uses UPDATE.
CREDENTIAL

Scope: Namespace or tenant (depending on whether the credential is namespace-level or tenant-level)

Actions and their meaning

  • VIEW / LIST: list and view credentials.
  • CREATE: create credentials.
  • UPDATE: update credentials or test a connection.
  • DELETE: delete credentials.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/credentials
  • GET /api/v1/{tenant}/credentials/{id}
  • GET /api/v1/{tenant}/namespaces/{namespace}/credentials
  • GET /api/v1/{tenant}/namespaces/{namespace}/credentials/{name}
  • GET /api/v1/{tenant}/namespaces/{namespace}/credentials/inherited

CREATE

  • POST /api/v1/{tenant}/credentials
  • POST /api/v1/{tenant}/namespaces/{namespace}/credentials

UPDATE

  • PUT /api/v1/{tenant}/credentials/{id}
  • POST /api/v1/{tenant}/credentials/{id}/test
  • PUT /api/v1/{tenant}/namespaces/{namespace}/credentials/{name}
  • POST /api/v1/{tenant}/namespaces/{namespace}/credentials/{name}/test

DELETE

  • DELETE /api/v1/{tenant}/credentials/{id}
  • DELETE /api/v1/{tenant}/namespaces/{namespace}/credentials/{name}
REUSABLE_INPUTS

Scope: Namespace

Actions and their meaning

  • VIEW: read a reusable input set and its revision history.
  • LIST: search or browse reusable input sets, including sets inherited from parent namespaces.
  • CREATE: create a new reusable input set.
  • UPDATE: update an existing reusable input set.
  • DELETE: delete a reusable input set.

Endpoints

LIST

  • GET /api/v1/{tenant}/namespaces/{namespace}/reusable-inputs
  • GET /api/v1/{tenant}/reusable-inputs/namespaces (distinct namespaces that own at least one set; any REUSABLE_INPUTS: LIST action)

VIEW

  • GET /api/v1/{tenant}/namespaces/{namespace}/reusable-inputs/{id}
  • GET /api/v1/{tenant}/namespaces/{namespace}/reusable-inputs/{id}/revisions

CREATE

  • PUT /api/v1/{tenant}/namespaces/{namespace}/reusable-inputs/{id} (when the set does not yet exist in the namespace)

UPDATE

  • PUT /api/v1/{tenant}/namespaces/{namespace}/reusable-inputs/{id} (when the set already exists in the namespace)

DELETE

  • DELETE /api/v1/{tenant}/namespaces/{namespace}/reusable-inputs/{id}

Notes

  • The same PUT endpoint checks CREATE or UPDATE depending on whether the set already exists.
  • Listing and resolving a set from a child namespace also returns sets inherited from parent namespaces; the action check uses the calling user’s access to the child namespace.
BLUEPRINT

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: view or browse custom blueprints.
  • CREATE: create a blueprint.
  • UPDATE: update a blueprint.
  • DELETE: delete a blueprint.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/blueprints/custom
  • GET /api/v1/{tenant}/blueprints/custom/{id}
  • GET /api/v1/{tenant}/blueprints/custom/{id}/source
  • GET /api/v1/{tenant}/blueprints/custom/tags
  • GET /api/v1/{tenant}/blueprints/flows/{id}
  • POST /api/v1/{tenant}/blueprints/flows/{id}/use-template

CREATE

  • POST /api/v1/{tenant}/blueprints/flows

UPDATE

  • PUT /api/v1/{tenant}/blueprints/flows/{id}

DELETE

  • DELETE /api/v1/{tenant}/blueprints/flows/{id}

Notes

  • Community blueprint endpoints (/blueprints/community/...) do not require BLUEPRINT permission.
APP

Scope: Tenant (with namespace checks when the app definition references a namespace)

Actions and their meaning

  • VIEW / LIST: view app source, search, and catalog.
  • CREATE: create or import apps.
  • UPDATE: update apps, enable, or disable them.
  • DELETE: delete apps.
  • EXECUTE: dispatch actions through an app (run the app).
  • ACCESS_FILES: download or preview files generated by an app execution.
  • ACCESS_LOGS: view app execution logs.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/apps/search
  • GET /api/v1/{tenant}/apps/catalog
  • GET /api/v1/{tenant}/apps/tags
  • GET /api/v1/{tenant}/apps/{uid}
  • GET /api/v1/{tenant}/apps/view/{uid} (PRIVATE apps require APP: EXECUTE or equivalent access level)

CREATE

  • POST /api/v1/{tenant}/apps
  • POST /api/v1/{tenant}/apps/import
  • POST /api/v1/{tenant}/apps/preview
  • POST /api/v1/{tenant}/apps/export

UPDATE

  • PUT /api/v1/{tenant}/apps/{uid}
  • POST /api/v1/{tenant}/apps/{uid}/enable
  • POST /api/v1/{tenant}/apps/{uid}/disable
  • POST /api/v1/{tenant}/apps/enable
  • POST /api/v1/{tenant}/apps/disable

DELETE

  • DELETE /api/v1/{tenant}/apps/{uid}
  • DELETE /api/v1/{tenant}/apps

EXECUTE

  • POST /api/v1/{tenant}/apps/view/{id}/dispatch/{dispatch}
  • GET /api/v1/{tenant}/apps/view/{id}/streams/{stream}

ACCESS_FILES

  • GET /api/v1/{tenant}/apps/view/{id}/file/preview
  • GET /api/v1/{tenant}/apps/view/{id}/file/meta
  • GET /api/v1/{tenant}/apps/view/{id}/file/download

ACCESS_LOGS

  • GET /api/v1/{tenant}/apps/view/{uid}/logs/download

Notes

  • PUBLIC apps are accessible without authentication for view and dispatch. PRIVATE apps require appropriate APP actions.
TESTSUITE

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: view tests and test results.
  • CREATE: create a test.
  • UPDATE: update or enable/disable tests.
  • DELETE: delete tests.
  • EXECUTE: run tests.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/tests/{namespace}/{id}
  • GET /api/v1/{tenant}/tests/search
  • POST /api/v1/{tenant}/tests/validate
  • GET /api/v1/{tenant}/tests/results/{id}
  • POST /api/v1/{tenant}/tests/results/search/last
  • GET /api/v1/{tenant}/tests/results/search

CREATE

  • POST /api/v1/{tenant}/tests

UPDATE

  • PUT /api/v1/{tenant}/tests/{namespace}/{id}
  • POST /api/v1/{tenant}/tests/disable/by-ids
  • POST /api/v1/{tenant}/tests/enable/by-ids

DELETE

  • DELETE /api/v1/{tenant}/tests/{namespace}/{id}
  • DELETE /api/v1/{tenant}/tests/by-ids

EXECUTE

  • POST /api/v1/{tenant}/tests/{namespace}/{id}/run
  • POST /api/v1/{tenant}/tests/run
ASSET

Scope: Tenant (with namespace checks when the asset has a namespace)

Actions and their meaning

  • VIEW / LIST: view assets and their dependency or usage graphs.
  • CREATE: create assets.
  • UPDATE: edit existing assets.
  • DELETE: delete assets and purge their usage and lineage records.
  • LOCK: acquire a write lock on an asset (from a flow task or the UI).
  • UNLOCK: release a write lock on an asset (from a flow task or the UI). UI unlock is forced regardless of owner.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/assets/{id}
  • GET /api/v1/{tenant}/assets/{id}/dependencies
  • GET /api/v1/{tenant}/assets/search
  • GET /api/v1/{tenant}/assets/usages/search
  • GET /api/v1/{tenant}/assets/lineage-events/search

CREATE

  • POST /api/v1/{tenant}/assets

UPDATE

  • PUT /api/v1/{tenant}/assets/{id}

DELETE

  • DELETE /api/v1/{tenant}/assets/{id}
  • DELETE /api/v1/{tenant}/assets/by-ids
  • DELETE /api/v1/{tenant}/assets/by-query
  • DELETE /api/v1/{tenant}/assets/usages/by-query
  • DELETE /api/v1/{tenant}/assets/lineage-events/by-query

LOCK

  • POST /api/v1/{tenant}/assets/{id}/lock

UNLOCK

  • DELETE /api/v1/{tenant}/assets/{id}/lock
MCP_SERVER

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: view MCP server configuration and registered tools.
  • CREATE: create an MCP server.
  • UPDATE: update an MCP server.
  • DELETE: delete an MCP server.

Notes

  • Connecting an AI agent to a PRIVATE server also requires FLOW: EXECUTE on at least one namespace with a flow that has an McpToolTrigger pointing at that server.
COPILOT

Scope: Tenant

Actions and their meaning

  • USE: access AI flow generation and Copilot features.

Endpoints

USE (any COPILOT action)

  • POST /api/v1/{tenant}/ai/generate/flow
AUDITLOG

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: search audit logs.
  • EXPORT: export audit logs.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/auditlogs/search
  • POST /api/v1/{tenant}/auditlogs/find

EXPORT

  • GET /api/v1/{tenant}/auditlogs/export

Notes

  • Cross-tenant audit log endpoints under /api/v1/auditlogs/... (no tenant segment) are instance-owner-only and are not controlled by AUDITLOG permissions.
  • GET /api/v1/{tenant}/auditlogs/history/{detailId} and GET /api/v1/{tenant}/auditlogs/{id}/diff are not controlled by AUDITLOG. They check your permission on the audited resource instead:
    • Most entries require VIEW on the audited resource type in the entry’s namespace. Entries without a namespace, such as App, Asset, Case, Namespace, Test suite, and Dashboard entries, require a tenant-wide VIEW grant.
    • Namespace file entries require NAMESPACE MANAGE_FILES.
    • Entries for instance-level resources, such as banners, tenants, worker groups, and security integrations, require an instance owner. So do policies with INSTANCE or STATIC scope.
    • An instance owner with AUDITLOG VIEW can view entries for ROLE, INVITATION, GROUP, BINDING, USER, and SERVICE_ACCOUNT.
    • The history endpoint returns every entry with the given resource ID, including entries for resources with the same ID in other namespaces. If you lack permission on any of them, the request fails.
SYSTEM_SETTINGS

Scope: Tenant

Actions and their meaning

  • VIEW: read instance-level settings.
  • UPDATE: modify instance-level settings.
TENANT_SETTINGS

Scope: Tenant

Actions and their meaning

  • VIEW: read tenant-level settings.
  • UPDATE: modify tenant-level settings.
USER

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: view user details and group membership.
  • CREATE / UPDATE / DELETE: manage users.
  • MANAGE_GROUP_MEMBERSHIP: update a user’s group assignments.
  • IMPERSONATE: impersonate a user to test their access.

Notes

  • USER is not included in any of the standard managed roles (Viewer, Launcher, Editor, Developer). Only Admin includes it. Custom roles with USER actions are intended for platform administrators.
  • IAM user management endpoints under /api/v1/users (no tenant segment) are instance-owner-only and do not require USER permissions.
GROUP

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: view groups and their members.
  • CREATE: create groups.
  • UPDATE: update group metadata.
  • DELETE: delete groups.
  • MANAGE_MEMBERS: add or remove members from a group.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/groups/{id}
  • GET /api/v1/{tenant}/groups/search
  • POST /api/v1/{tenant}/groups/autocomplete
  • POST /api/v1/{tenant}/groups/ids
  • GET /api/v1/{tenant}/groups/{id}/members

CREATE

  • POST /api/v1/{tenant}/groups

UPDATE

  • PUT /api/v1/{tenant}/groups/{id}

DELETE

  • DELETE /api/v1/{tenant}/groups/{id}

MANAGE_MEMBERS

  • PUT /api/v1/{tenant}/groups/{id}/members/{userId}
  • PUT /api/v1/{tenant}/groups/{id}/members/membership/{userId}
  • DELETE /api/v1/{tenant}/groups/{id}/members/{userId}
  • PUT /api/v1/{tenant}/users/{id}/groups

Notes

  • SCIM group endpoints (/integrations/{integration}/scim/v2/Groups) also use GROUP permissions.
ROLE

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: view roles and their permissions.
  • CREATE: create roles.
  • UPDATE: update roles.
  • DELETE: delete roles.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/roles/{id}
  • GET /api/v1/{tenant}/roles/search
  • POST /api/v1/{tenant}/roles/autocomplete
  • POST /api/v1/{tenant}/roles/ids
  • GET /api/v1/{tenant}/acls/permissions (any ROLE action)
  • GET /api/v1/{tenant}/acls/templates (any ROLE action)

CREATE

  • POST /api/v1/{tenant}/roles

UPDATE

  • PUT /api/v1/{tenant}/roles/{id}

DELETE

  • DELETE /api/v1/{tenant}/roles/{id}
BINDING

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: view bindings.
  • CREATE: create a binding.
  • DELETE: delete a binding.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/bindings/{id}
  • GET /api/v1/{tenant}/bindings/search

CREATE

  • POST /api/v1/{tenant}/bindings
  • POST /api/v1/{tenant}/bindings/bulk

DELETE

  • DELETE /api/v1/{tenant}/bindings/{id}

Notes

  • Bindings are immutable. To change a binding’s scope or roles, delete it and create a new one.
SERVICE_ACCOUNT

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: view service accounts and their API tokens.
  • CREATE: create service accounts.
  • UPDATE: update service accounts and issue API tokens.
  • DELETE: delete service accounts or revoke API tokens.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/service-accounts/{id}
  • GET /api/v1/{tenant}/service-accounts/{id}/api-tokens

CREATE

  • POST /api/v1/{tenant}/service-accounts

UPDATE

  • PUT /api/v1/{tenant}/service-accounts/{id}
  • POST /api/v1/{tenant}/service-accounts/{id}/api-tokens

DELETE

  • DELETE /api/v1/{tenant}/service-accounts/{id}
  • DELETE /api/v1/{tenant}/service-accounts/{id}/api-tokens/{tokenId}

Notes

  • Instance-owner-only endpoints under /api/v1/service-accounts (no tenant segment) do not use SERVICE_ACCOUNT permissions.
INVITATION

Scope: Tenant

Actions and their meaning

  • VIEW / LIST: view invitations.
  • CREATE: send an invitation.
  • DELETE: revoke an invitation.

Endpoints

VIEW / LIST

  • GET /api/v1/{tenant}/invitations/search
  • GET /api/v1/{tenant}/invitations/email/{email}
  • GET /api/v1/{tenant}/invitations/{id}

CREATE

  • POST /api/v1/{tenant}/invitations

DELETE

  • DELETE /api/v1/{tenant}/invitations/{id}
POLICY

Scope: Namespace or Tenant (a policy targets either a namespace or the full tenant, and is authorized accordingly)

Actions and their meaning

  • VIEW: read a single policy.
  • LIST: search or browse policies.
  • CREATE: create a policy.
  • UPDATE: update a policy.
  • DELETE: delete a policy.
  • EXECUTE: dry-run evaluate a policy against every flow in its scope without persisting any changes.
  • EXPORT: export policies as YAML.
  • IMPORT: import policies from a YAML file. Each document is authorized against its own scope before anything is written — a single denial rejects the whole import.

Endpoints

VIEW

  • GET /api/v1/{tenant}/policies/{id} (tenant-scope)
  • GET /api/v1/{tenant}/namespaces/{namespace}/policies/{id} (namespace-scope)

LIST

  • GET /api/v1/{tenant}/policies/search (tenant-scope)
  • GET /api/v1/{tenant}/namespaces/{namespace}/policies/search (namespace-scope)

CREATE

  • POST /api/v1/{tenant}/policies (tenant-scope)
  • POST /api/v1/{tenant}/namespaces/{namespace}/policies (namespace-scope)

UPDATE

  • PUT /api/v1/{tenant}/policies/{id} (tenant-scope)
  • PUT /api/v1/{tenant}/namespaces/{namespace}/policies/{id} (namespace-scope)

DELETE

  • DELETE /api/v1/{tenant}/policies/{id} (tenant-scope)
  • DELETE /api/v1/{tenant}/policies/delete/by-ids (tenant-scope)
  • DELETE /api/v1/{tenant}/namespaces/{namespace}/policies/{id} (namespace-scope)
  • DELETE /api/v1/{tenant}/namespaces/{namespace}/policies/delete/by-ids (namespace-scope)

EXECUTE (dry-run evaluate)

  • GET /api/v1/{tenant}/policies/{id}/evaluate (tenant-scope)
  • GET /api/v1/{tenant}/namespaces/{namespace}/policies/{id}/evaluate (namespace-scope)

EXPORT

  • POST /api/v1/{tenant}/policies/export (tenant-scope, all policies)
  • POST /api/v1/{tenant}/policies/export/by-ids (tenant-scope, by IDs)
  • POST /api/v1/{tenant}/namespaces/{namespace}/policies/export (namespace-scope, all policies)
  • POST /api/v1/{tenant}/namespaces/{namespace}/policies/export/by-ids (namespace-scope, by IDs)

IMPORT

  • POST /api/v1/{tenant}/policies/import

VALIDATE (any POLICY VIEW action — no dedicated check)

  • POST /api/v1/{tenant}/policies/validate
  • POST /api/v1/{tenant}/namespaces/{namespace}/policies/validate

Notes

  • Instance-scope policy endpoints (/api/v1/instance/policies/...) manage read-only static policies declared in server configuration and are instance-owner-only; they are not governed by POLICY RBAC permissions.

Was this page helpful?