Permissions reference
Permission names double as API token abilities. The owner holds every permission. The role matrix is on Teams, roles and permissions.
| Permission | Grants | Roles (besides owner) |
|---|---|---|
alerting.view |
View alert rules, channels, history; receive in-app notifications | admin, developer, viewer |
alerting.manage |
Manage alert channels and rules | admin |
audit.view |
View the audit log | admin |
builds.view |
View builds, build logs and builders | admin, developer, viewer |
builds.manage |
Cancel builds and manage builders | admin, developer |
databases.view |
View database servers, databases, users and backups | admin, developer, viewer |
databases.manage |
Create and drop databases and users, manage backup schedules, run backups | admin, developer |
databases.credentials.reveal |
Reveal database user passwords | admin, developer |
databases.restore |
Restore backups (overwrites data) | admin |
databases.storage.manage |
Manage backup storage providers and credentials | admin |
deployments.view |
View deployments, their output and releases | admin, developer, viewer |
deployments.create |
Deploy sites; cancel queued, waiting or building deployments | admin, developer |
deployments.rollback |
Roll sites back to an earlier release | admin, developer |
deployments.manage |
Strategy, health checks, retention, push-to-deploy, deploy hooks | admin, developer |
edge.view |
View domains, certificates and routing rules; domain options and DNS checks | admin, developer, viewer |
edge.manage |
Manage domains, certificates, redirects, security rules and load balancers | admin, developer |
edge.dns.manage |
DNS provider credentials (DNS-01) and generated-domain settings | admin |
fleet.agents.manage |
Issue install commands, revoke and upgrade agents | admin |
fleet.commands.view |
View agent command output | admin, developer, viewer |
insights.view |
View insights, issues and scheduled task health | admin, developer, viewer |
insights.manage |
Resolve, assign and comment on issues; configure thresholds and heartbeats | admin, developer |
members.view |
View members and teams | admin, developer, viewer |
members.manage |
Invite, remove and change roles of members | admin |
teams.manage |
Create teams and manage their members | admin |
network.view |
View firewalls, private networks and load balancers | admin, developer, viewer |
network.manage |
Manage firewall rules and private networks | admin, developer |
organization.update |
Rename the organization | admin |
organization.delete |
Delete the organization | (owner only) |
processes.view |
View workers, daemons, scheduled jobs and status | admin, developer, viewer |
processes.manage |
Manage workers, daemons and scheduled jobs; restart processes | admin, developer |
projects.view |
View projects, environments and canvases | admin, developer, viewer |
projects.manage |
Create, rename, delete projects and environments; arrange and create services on the canvas | admin, developer |
providers.view |
View cloud provider credentials and catalogs | admin, developer, viewer |
providers.manage |
Add, rotate and remove cloud provider credentials | admin |
recipes.view |
View recipes and run history | admin, developer, viewer |
recipes.manage |
Create, edit and delete recipes | admin, developer |
recipes.run |
Run recipes (arbitrary scripts, possibly as root) | admin |
servers.view |
View servers, metrics and provisioning logs | admin, developer, viewer |
servers.create |
Create servers | admin, developer |
servers.manage |
Manage PHP, settings, SSH keys and re-provision servers | admin, developer |
servers.delete |
Delete servers | admin |
ssh_keys.manage |
Add and remove organization SSH keys | admin, developer |
sites.view |
View sites, settings and command history | admin, developer, viewer |
sites.create |
Create sites | admin, developer |
sites.manage |
Change site settings, servers, deploy scripts, Laravel toggles | admin, developer |
sites.delete |
Delete sites | admin |
sites.env.view |
Reveal site environment variables | admin, developer |
sites.env.manage |
Edit site environment variables | admin, developer |
sites.commands.run |
Run commands in a site on its servers | admin, developer |
sites.compose.policy |
Allow privileged Docker Compose files | admin |
source_control.view |
View git connections, repositories and pushes | admin, developer, viewer |
source_control.manage |
Connect and disconnect git providers | admin |
telemetry.view |
View server metrics, logs and traces | admin, developer, viewer |
telemetry.manage |
Configure telemetry endpoints and provision Grafana | admin |
templates.view |
Browse the catalog and the organization’s templates | admin, developer, viewer |
templates.manage |
Import, edit and delete the organization’s templates | admin, developer |
terminal.open |
Open web terminal sessions | admin |
terminal.attach |
Watch other members’ shared sessions | admin |
terminal.control |
Type into and close sessions opened by others | admin |
terminal.recordings.view |
Replay other members’ recordings | admin |