Reference
Permissions
What a member or an API key may do in an org, which built-in roles hold each permission, and which routes need it.
Every management API route checks one permission against the credential that calls it: an org member's role, or an API key's own permissions. A route that refuses answers 403 with the code insufficient_permissions, and missing_permission names the permission.
The built-in roles: the owner holds every permission; an admin holds all but deleting the org and handing it over; a member holds org.read and every .view permission but org.apiKeys.view. An org can also make its own roles from any set of these permissions.
| Permission | Owner | Admin | Member | Routes that need it |
|---|---|---|---|---|
org.read | Yes | Yes | Yes | GET /v1/orgs/{org} |
org.edit | Yes | Yes | No | PATCH /v1/orgs/{org} |
org.delete | Yes | No | No | DELETE /v1/orgs/{org} |
org.members.view | Yes | Yes | Yes | GET /v1/orgs/{org}/rolesGET /v1/orgs/{org}/membersGET /v1/orgs/{org}/invites |
org.members.edit | Yes | Yes | No | POST /v1/orgs/{org}/rolesPATCH /v1/orgs/{org}/roles/{role}DELETE /v1/orgs/{org}/roles/{role}PATCH /v1/orgs/{org}/members/{user}DELETE /v1/orgs/{org}/members/{user}POST /v1/orgs/{org}/invitesDELETE /v1/orgs/{org}/invites/{invite} |
org.ownership.transfer | Yes | No | No | POST /v1/orgs/{org}/transfer-ownership |
org.brands.view | Yes | Yes | Yes | GET /v1/orgs/{org}/brandsGET /v1/orgs/{org}/brands/{brand}GET /v1/orgs/{org}/brands/{brand}/themePOST /v1/orgs/{org}/brands/{brand}/theme/previewPOST /v1/orgs/{org}/brands/{brand}/sign-in-previewGET /v1/orgs/{org}/brands/{brand}/files/{file}GET /v1/orgs/{org}/brands/{brand}/emailGET /v1/orgs/{org}/brands/{brand}/custom-domainGET /v1/orgs/{org}/brands/{brand}/sign-in-providers |
org.brands.edit | Yes | Yes | No | POST /v1/orgs/{org}/brandsPATCH /v1/orgs/{org}/brands/{brand}DELETE /v1/orgs/{org}/brands/{brand}DELETE /v1/orgs/{org}/brands/{brand}/logoPATCH /v1/orgs/{org}/brands/{brand}/themeDELETE /v1/orgs/{org}/brands/{brand}/theme/backgroundPOST /v1/orgs/{org}/brands/{brand}/filesPOST /v1/orgs/{org}/brands/{brand}/files/{file}/finalizePATCH /v1/orgs/{org}/brands/{brand}/emailPOST /v1/orgs/{org}/brands/{brand}/email/reply-to/confirmationPOST /v1/orgs/{org}/brands/{brand}/email/testPOST /v1/orgs/{org}/brands/{brand}/custom-domainDELETE /v1/orgs/{org}/brands/{brand}/custom-domainPOST /v1/orgs/{org}/brands/{brand}/custom-domain/verifyPATCH /v1/orgs/{org}/brands/{brand}/sign-in-providers/{provider} |
org.apps.view | Yes | Yes | Yes | GET /v1/orgs/{org}/brands/{brand}/appsGET /v1/orgs/{org}/brands/{brand}/apps/{app}GET /v1/orgs/{org}/change-requests/{request}GET /v1/orgs/{org}/brands/{brand}/apps/{app}/apis |
org.apps.edit | Yes | Yes | No | POST /v1/orgs/{org}/brands/{brand}/appsPATCH /v1/orgs/{org}/brands/{brand}/apps/{app}DELETE /v1/orgs/{org}/brands/{brand}/apps/{app}POST /v1/orgs/{org}/brands/{brand}/apps/{app}/rotate-secretPOST /v1/orgs/{org}/change-requestsPOST /v1/orgs/{org}/change-requests/{request}/approvePOST /v1/orgs/{org}/change-requests/{request}/declinePUT /v1/orgs/{org}/brands/{brand}/apps/{app}/apis/{api}DELETE /v1/orgs/{org}/brands/{brand}/apps/{app}/apis/{api} |
org.apis.view | Yes | Yes | Yes | GET /v1/orgs/{org}/brands/{brand}/apisGET /v1/orgs/{org}/brands/{brand}/apis/{api} |
org.apis.edit | Yes | Yes | No | POST /v1/orgs/{org}/brands/{brand}/apisPATCH /v1/orgs/{org}/brands/{brand}/apis/{api}DELETE /v1/orgs/{org}/brands/{brand}/apis/{api} |
org.connections.view | Yes | Yes | Yes | GET /v1/orgs/{org}/sign-in-providers |
org.connections.edit | Yes | Yes | No | PUT /v1/orgs/{org}/sign-in-providers/{provider}/appDELETE /v1/orgs/{org}/sign-in-providers/{provider}/appPUT /v1/orgs/{org}/brands/{brand}/sign-in-providers/{provider}/appDELETE /v1/orgs/{org}/brands/{brand}/sign-in-providers/{provider}/app |
org.webhooks.view | Yes | Yes | Yes | GET /v1/orgs/{org}/webhooksGET /v1/orgs/{org}/webhooks/{webhook}GET /v1/orgs/{org}/webhooks/{webhook}/deliveries |
org.webhooks.edit | Yes | Yes | No | POST /v1/orgs/{org}/webhooksPATCH /v1/orgs/{org}/webhooks/{webhook}DELETE /v1/orgs/{org}/webhooks/{webhook}POST /v1/orgs/{org}/webhooks/{webhook}/rotate-secretPOST /v1/orgs/{org}/webhooks/{webhook}/test |
org.tokenGates.view | Yes | Yes | Yes | GET /v1/orgs/{org}/token-gatesGET /v1/orgs/{org}/token-gates/{gate}POST /v1/orgs/{org}/token-gates/check |
org.tokenGates.edit | Yes | Yes | No | POST /v1/orgs/{org}/token-gatesPATCH /v1/orgs/{org}/token-gates/{gate}DELETE /v1/orgs/{org}/token-gates/{gate} |
org.emailDomains.view | Yes | Yes | Yes | GET /v1/orgs/{org}/email-domainsGET /v1/orgs/{org}/email-domains/{domain} |
org.emailDomains.edit | Yes | Yes | No | POST /v1/orgs/{org}/email-domainsDELETE /v1/orgs/{org}/email-domains/{domain}POST /v1/orgs/{org}/email-domains/{domain}/check |
org.billing.view | Yes | Yes | Yes | GET /v1/orgs/{org}/billing/invoicesGET /v1/orgs/{org}/billing/usage |
org.billing.edit | Yes | Yes | No | POST /v1/orgs/{org}/billing/checkoutPOST /v1/orgs/{org}/billing/planPOST /v1/orgs/{org}/billing/portal |
org.users.view | Yes | Yes | Yes | GET /v1/orgs/{org}/brands/{brand}/usersGET /v1/orgs/{org}/brands/{brand}/users/{user}GET /v1/orgs/{org}/brands/{brand}/users/{user}/passkeysGET /v1/orgs/{org}/brands/{brand}/users/{user}/consentsGET /v1/orgs/{org}/brands/{brand}/users/{user}/api-keys |
org.users.edit | Yes | Yes | No | POST /v1/orgs/{org}/brands/{brand}/usersPATCH /v1/orgs/{org}/brands/{brand}/users/{user}POST /v1/orgs/{org}/brands/{brand}/users/{user}/revoke-sessionsDELETE /v1/orgs/{org}/brands/{brand}/users/{user}/passkeys/{passkey}POST /v1/orgs/{org}/brands/{brand}/users/{user}/deletionDELETE /v1/orgs/{org}/brands/{brand}/users/{user}/deletionDELETE /v1/orgs/{org}/brands/{brand}/users/{user}/consents/{consent}DELETE /v1/orgs/{org}/brands/{brand}/users/{user}/api-keys/{key} |
org.apiKeys.view | Yes | Yes | No | GET /v1/orgs/{org}/api-keysGET /v1/orgs/{org}/api-keys/{key} |
org.apiKeys.edit | Yes | Yes | No | POST /v1/orgs/{org}/api-keysDELETE /v1/orgs/{org}/api-keys/{key} |
org.auditLog.view | Yes | Yes | Yes | GET /v1/orgs/{org}/audit-log |