Resource tables

The following tables work as a quick cheat-sheet to help you manage your permissions. Note that the tables are not exhaustive; for brevity they do not show wildcard or templated grant strings.

Additionally, these tables do not include available output fields; see the service documentation for guidance.

Refer to the tables for more information about the following resource types:

Account

The Account resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/accounts`	Type `account`	`create`: Create an account `type=<type>;actions=create` `list`: List accounts `type=<type>;actions=list`
`/accounts/<id>`	ID `<id>` Pin `<auth-method-id>` Type `account`	`read`: Read an account `ids=<id>;actions=read` `ids=<pin>;type=<type>;actions=read` `update`: Update an account `ids=<id>;actions=update` `ids=<pin>;type=<type>;actions=update` `delete`: Delete an account `ids=<id>;actions=delete` `ids=<pin>;type=<type>;actions=delete` `set-password`: Set a password on an account, without requiring the current password `ids=<id>;actions=set-password` `ids=<pin>;type=<type>;actions=set-password` `change-password`: Change a password on an account given the current password `ids=<id>;actions=change-password` `ids=<pin>;type=<type>;actions=change-password`

Auth method

The Auth method resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/auth-methods`	Type `auth-method`	`create`: Create an auth method `type=<type>;actions=create` `list`: List auth methods `type=<type>;actions=list`
`/auth-methods/<id>`	ID `<id>` Type `auth-method`	`read`: Read an auth method `ids=<id>;actions=read` `update`: Update an auth method `ids=<id>;actions=update` `delete`: Delete an auth method `ids=<id>;actions=delete` `authenticate`: Authenticate to an auth method `ids=<id>;actions=authenticate`

Auth token

The Auth token resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/auth-tokens`	Type `auth-token`	`list`: List auth tokens `type=<type>;actions=list`
`/auth-tokens/<id>`	ID `<id>` Type `auth-token`	`read`: Read an auth token `ids=<id>;actions=read` `delete`: Delete an auth token `ids=<id>;actions=delete`

Group

The Group resource type supports the following scopes: Global, Org, Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/groups`	Type `group`	`create`: Create a group `type=<type>;actions=create` `list`: List groups `type=<type>;actions=list`
`/groups/<id>`	ID `<id>` Type `group`	`read`: Read a group `ids=<id>;actions=read` `update`: Update a group `ids=<id>;actions=update` `delete`: Delete a group `ids=<id>;actions=delete` `add-members`: Add members to a group `ids=<id>;actions=add-members` `set-members`: Set the full set of members on a group `ids=<id>;actions=set-members` `remove-members`: Remove members from a group `ids=<id>;actions=remove-members`

Host

The Host resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/hosts`	Type `host`	`create`: Create a host `type=<type>;actions=create` `list`: List hosts `type=<type>;actions=list`
`/hosts/<id>`	ID `<id>` Pin `<host-catalog-id>` Type `host`	`read`: Read a host `ids=<id>;actions=read` `ids=<pin>;type=<type>;actions=read` `update`: Update a host `ids=<id>;actions=update` `ids=<pin>;type=<type>;actions=update` `delete`: Delete a host `ids=<id>;actions=delete` `ids=<pin>;type=<type>;actions=delete`

Host catalog

The Host catalog resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/host-catalogs`	Type `host-catalog`	`create`: Create a host catalog `type=<type>;actions=create` `list`: List host catalogs `type=<type>;actions=list`
`/host-catalogs/<id>`	ID `<id>` Type `host-catalog`	`read`: Read a host catalog `ids=<id>;actions=read` `update`: Update a host catalog `ids=<id>;actions=update` `delete`: Delete a host catalog `ids=<id>;actions=delete`

Host set

The Host set resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/host-sets`	Type `host-set`	`create`: Create a host set `type=<type>;actions=create` `list`: List host sets `type=<type>;actions=list`
`/host-sets/<id>`	ID `<id>` Pin `<host-catalog-id>` Type `host-set`	`read`: Read a host set `ids=<id>;actions=read` `ids=<pin>;type=<type>;actions=read` `update`: Update a host set `ids=<id>;actions=update` `ids=<pin>;type=<type>;actions=update` `delete`: Delete a host set `ids=<id>;actions=delete` `ids=<pin>;type=<type>;actions=delete` `add-hosts`: Add hosts to a host-set `ids=<id>;actions=add-hosts` `ids=<pin>;type=<type>;actions=add-hosts` `set-hosts`: Set the full set of hosts on a host set `ids=<id>;actions=set-hosts` `ids=<pin>;type=<type>;actions=set-hosts` `remove-hosts`: Remove hosts from a host set `ids=<id>;actions=remove-hosts` `ids=<pin>;type=<type>;actions=remove-hosts`

Managed group

The Managed group resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/managed-groups`	Type `managed-group`	`create`: Create a managed group `type=<type>;actions=create` `list`: List managed groups `type=<type>;actions=list`
`/managed-groups/<id>`	ID `<id>` Pin `<auth-method-id>` Type `managed-group`	`read`: Read a managed group `ids=<id>;actions=read` `ids=<pin>;type=<type>;actions=read` `update`: Update a managed group `ids=<id>;actions=update` `ids=<pin>;type=<type>;actions=update` `delete`: Delete a managed group `ids=<id>;actions=delete` `ids=<pin>;type=<type>;actions=delete`

Role

The Role resource type supports the following scopes: Global, Org, Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/roles`	Type `role`	`create`: Create a role `type=<type>;actions=create` `list`: List roles `type=<type>;actions=list`
`/roles/<id>`	ID `<id>` Type `role`	`read`: Read a role `ids=<id>;actions=read` `update`: Update a role `ids=<id>;actions=update` `delete`: Delete a role `ids=<id>;actions=delete` `add-principals`: Add principals to a role `ids=<id>;actions=add-principals` `set-principals`: Set the full set of principals on a role `ids=<id>;actions=set-principals` `remove-principals`: Remove principals from a role `ids=<id>;actions=remove-principals` `add-grants`: Add grants to a role `ids=<id>;actions=add-grants` `set-grants`: Set the full set of grants on a role `ids=<id>;actions=set-grants` `remove-grants`: Remove grants from a role `ids=<id>;actions=remove-grants`

Scope

The Scope resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/scopes`	Type `scope`	`create`: Create a scope `type=<type>;actions=create` `list`: List scopes `type=<type>;actions=list`
`/scopes/<id>`	ID `<id>` Type `scope`	`read`: Read a scope `ids=<id>;actions=read` `update`: Update a scope `ids=<id>;actions=update` `delete`: Delete a scope `ids=<id>;actions=delete`

Session

The Session resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/sessions`	Type `session`	`list`: List sessions `type=<type>;actions=list`
`/session/<id>`	ID `<id>` Type `session`	`read`: Read a session `ids=<id>;actions=read` `cancel`: Cancel a session `ids=<id>;actions=cancel` `read:self`: Read a session, which must be associated with the calling user `ids=;type=session;actions=read:self` `cancel:self`: Cancel a session, which must be associated with the calling user `ids=;type=session;actions=cancel:self`

Session recording

The Session recording resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/session-recordings`	Type `session-recording`	`list`: List session recordings `type=<type>;actions=list`
`/session-recordings/<id>`	ID `<id>` Type `session-recording`	`read`: Read a session recording `ids=<id>;actions=read` `download`: Download a session recording `ids=<id>;actions=download` `reapply-storage-policy`: Reapply the storage policy to a session recording `ids=<id>;actions=reapply-storage-policy` `delete`: Delete a session recording `ids=<id>;actions=delete`

Storage bucket

The Storage bucket resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/storage-buckets`	Type `storage-bucket`	`create`: Create a storage bucket `type=<type>;actions=create` `list`: List storage buckets `type=<type>;actions=list`
`/storage-buckets/<id>`	ID `<id>` Type `storage-bucket`	`read`: Read a storage bucket `ids=<id>;actions=read` `update`: Update a storage bucket `ids=<id>;actions=update` `delete`: Delete a storage bucket `ids=<id>;actions=delete`

Target

The Target resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/targets`	Type `target`	`create`: Create a target `type=<type>;actions=create` `list`: List targets `type=<type>;actions=list`
`/targets/<id>`	ID `<id>` Type `target`	`read`: Read a target `ids=<id>;actions=read` `update`: Update a target `ids=<id>;actions=update` `delete`: Delete a target `ids=<id>;actions=delete` `add-host-sources`: Add host sources to a target `ids=<id>;actions=add-host-sources` `set-host-sources`: Set the full set of host sources on a target `ids=<id>;actions=set-host-sources` `remove-host-sources`: Remove host sources from a target `ids=<id>;actions=remove-host-sources` `add-credential-sources`: Add credential sources to a target `ids=<id>;actions=add-credential-sources` `set-credential-sources`: Set the full set of credential sources on a target `ids=<id>;actions=set-credential-sources` `remove-credential-sources`: Remove credential sources from a target `ids=<id>;actions=remove-credential-sources` `authorize-session`: Authorize a session via the target `ids=<id>;actions=authorize-session`

User

The User resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/users`	Type `user`	`create`: Create a user `type=<type>;actions=create` `list`: List users `type=<type>;actions=list`
`/users/<id>`	ID `<id>` Type `user`	`read`: Read a user `ids=<id>;actions=read` `update`: Update a user `ids=<id>;actions=update` `delete`: Delete a user `ids=<id>;actions=delete` `add-accounts`: Add accounts to a user `ids=<id>;actions=add-accounts` `set-accounts`: Set the full set of accounts on a user `ids=<id>;actions=set-accounts` `remove-accounts`: Remove accounts from a user `ids=<id>;actions=remove-accounts`

Worker

The Worker resource type supports the following scopes: Global

API endpoint	Parameters into permissions engine	Available actions / examples
`/workers`	Type `worker`	`list`: List workers `type=<type>;actions=list` `create:controller-led`: Create a worker using the controller-led workflow `type=<type>;actions=create` `type=<type>;actions=create:controller-led` `create:worker-led`: Create a worker using the worker-led workflow `type=<type>;actions=create` `type=<type>;actions=create:worker-led`
`/workers/<id>`	ID `<id>` Type `worker`	`read`: Read a worker `ids=<id>;actions=read` `update`: Update a worker `ids=<id>;actions=update` `delete`: Delete a worker `ids=<id>;actions=delete`