Resource tables

The following tables work as a quick cheat-sheet to help you manage your permissions. Note that the tables are not exhaustive; for brevity they do not show wildcard or templated grant strings.

Additionally, these tables do not include available output fields; see the service documentation for guidance.

Refer to the tables for more information about the following resource types:

Account

The Account resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/accounts`	Type `account`	`create`: Create an account `type=<type>;actions=create` `list`: List accounts `type=<type>;actions=list`
`/accounts/<id>`	ID `<id>` Pin `<auth-method-id>` Type `account`	`read`: Read an account `ids=<id>;actions=read` `ids=<pin>;type=<type>;actions=read` `update`: Update an account `ids=<id>;actions=update` `ids=<pin>;type=<type>;actions=update` `delete`: Delete an account `ids=<id>;actions=delete` `ids=<pin>;type=<type>;actions=delete` `change-password`: Change a password on an account given the current password `ids=<id>;actions=change-password` `ids=<pin>;type=<type>;actions=change-password` `set-password`: Set a password on an account, without requiring the current password `ids=<id>;actions=set-password` `ids=<pin>;type=<type>;actions=set-password`

Alias

The Alias resource type supports the following scopes: Global, Org, Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/aliases`	Type `alias`	`create`: Create an alias `type=<type>;actions=create` `list`: List aliass `type=<type>;actions=list`
`/aliases/<id>`	ID `<id>` Type `alias`	`read`: Read an alias `ids=<id>;actions=read` `update`: Update an alias `ids=<id>;actions=update` `delete`: Delete an alias `ids=<id>;actions=delete`

Auth method

The Auth method resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/auth-methods`	Type `auth-method`	`create`: Create an auth method `type=<type>;actions=create` `list`: List auth methods `type=<type>;actions=list`
`/auth-methods/<id>`	ID `<id>` Type `auth-method`	`read`: Read an auth method `ids=<id>;actions=read` `update`: Update an auth method `ids=<id>;actions=update` `delete`: Delete an auth method `ids=<id>;actions=delete` `authenticate`: Authenticate to an auth method `ids=<id>;actions=authenticate` `change-state`: `ids=<id>;actions=change-state`

Auth token

The Auth token resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/auth-tokens`	Type `auth-token`	`list`: List auth tokens `type=<type>;actions=list`
`/auth-tokens/<id>`	ID `<id>` Type `auth-token`	`read`: Read an auth token `ids=<id>;actions=read` `delete`: Delete an auth token `ids=<id>;actions=delete` `delete:self`: `ids=<id>;actions=delete:self` `read:self`: `ids=<id>;actions=read:self`

Billing

API endpoint	Parameters into permissions engine	Available actions / examples
`/billing`	Type `billing`	`monthly-active-users`: `type=<type>;actions=monthly-active-users`

Credential

The Credential resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/credentials`	Type `credential`	`create`: Create a credential `type=<type>;actions=create` `list`: List credentials `type=<type>;actions=list`
`/credentials/<id>`	ID `<id>` Pin `<credential-store-id>` Type `credential`	`read`: Read a credential `ids=<id>;actions=read` `ids=<pin>;type=<type>;actions=read` `update`: Update a credential `ids=<id>;actions=update` `ids=<pin>;type=<type>;actions=update` `delete`: Delete a credential `ids=<id>;actions=delete` `ids=<pin>;type=<type>;actions=delete`

Credential library

The Credential library resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/credential-libraries`	Type `credential-library`	`create`: Create a credential library `type=<type>;actions=create` `list`: List credential librarys `type=<type>;actions=list`
`/credential-libraries/<id>`	ID `<id>` Pin `<credential-store-id>` Type `credential-library`	`read`: Read a credential library `ids=<id>;actions=read` `ids=<pin>;type=<type>;actions=read` `update`: Update a credential library `ids=<id>;actions=update` `ids=<pin>;type=<type>;actions=update` `delete`: Delete a credential library `ids=<id>;actions=delete` `ids=<pin>;type=<type>;actions=delete`

Credential store

The Credential store resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/credential-stores`	Type `credential-store`	`create`: Create a credential store `type=<type>;actions=create` `list`: List credential stores `type=<type>;actions=list`
`/credential-stores/<id>`	ID `<id>` Type `credential-store`	`read`: Read a credential store `ids=<id>;actions=read` `update`: Update a credential store `ids=<id>;actions=update` `delete`: Delete a credential store `ids=<id>;actions=delete`

Group

The Group resource type supports the following scopes: Global, Org, Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/groups`	Type `group`	`create`: Create a group `type=<type>;actions=create` `list`: List groups `type=<type>;actions=list`
`/groups/<id>`	ID `<id>` Type `group`	`read`: Read a group `ids=<id>;actions=read` `update`: Update a group `ids=<id>;actions=update` `delete`: Delete a group `ids=<id>;actions=delete` `add-members`: Add members to a group `ids=<id>;actions=add-members` `remove-members`: Remove members from a group `ids=<id>;actions=remove-members` `set-members`: Set the full set of members on a group `ids=<id>;actions=set-members`

Host

The Host resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/hosts`	Type `host`	`create`: Create a host `type=<type>;actions=create` `list`: List hosts `type=<type>;actions=list`
`/hosts/<id>`	ID `<id>` Pin `<host-catalog-id>` Type `host`	`read`: Read a host `ids=<id>;actions=read` `ids=<pin>;type=<type>;actions=read` `update`: Update a host `ids=<id>;actions=update` `ids=<pin>;type=<type>;actions=update` `delete`: Delete a host `ids=<id>;actions=delete` `ids=<pin>;type=<type>;actions=delete`

Host catalog

The Host catalog resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/host-catalogs`	Type `host-catalog`	`create`: Create a host catalog `type=<type>;actions=create` `list`: List host catalogs `type=<type>;actions=list`
`/host-catalogs/<id>`	ID `<id>` Type `host-catalog`	`read`: Read a host catalog `ids=<id>;actions=read` `update`: Update a host catalog `ids=<id>;actions=update` `delete`: Delete a host catalog `ids=<id>;actions=delete`

Host set

The Host set resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/host-sets`	Type `host-set`	`create`: Create a host set `type=<type>;actions=create` `list`: List host sets `type=<type>;actions=list`
`/host-sets/<id>`	ID `<id>` Pin `<host-catalog-id>` Type `host-set`	`read`: Read a host set `ids=<id>;actions=read` `ids=<pin>;type=<type>;actions=read` `update`: Update a host set `ids=<id>;actions=update` `ids=<pin>;type=<type>;actions=update` `delete`: Delete a host set `ids=<id>;actions=delete` `ids=<pin>;type=<type>;actions=delete` `add-hosts`: Add hosts to a host set `ids=<id>;actions=add-hosts` `ids=<pin>;type=<type>;actions=add-hosts` `remove-hosts`: Remove hosts from a host set `ids=<id>;actions=remove-hosts` `ids=<pin>;type=<type>;actions=remove-hosts` `set-hosts`: Set the full set of hosts on a host set `ids=<id>;actions=set-hosts` `ids=<pin>;type=<type>;actions=set-hosts`

Managed group

The Managed group resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/managed-groups`	Type `managed-group`	`create`: Create a managed group `type=<type>;actions=create` `list`: List managed groups `type=<type>;actions=list`
`/managed-groups/<id>`	ID `<id>` Pin `<auth-method-id>` Type `managed-group`	`read`: Read a managed group `ids=<id>;actions=read` `ids=<pin>;type=<type>;actions=read` `update`: Update a managed group `ids=<id>;actions=update` `ids=<pin>;type=<type>;actions=update` `delete`: Delete a managed group `ids=<id>;actions=delete` `ids=<pin>;type=<type>;actions=delete`

Policy

API endpoint	Parameters into permissions engine	Available actions / examples
`/policies`	Type `policy`	`create`: Create a policy `type=<type>;actions=create` `list`: List policys `type=<type>;actions=list`
`/policies/<id>`	ID `<id>` Type `policy`	`read`: Read a policy `ids=<id>;actions=read` `update`: Update a policy `ids=<id>;actions=update` `delete`: Delete a policy `ids=<id>;actions=delete`

Role

The Role resource type supports the following scopes: Global, Org, Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/roles`	Type `role`	`create`: Create a role `type=<type>;actions=create` `list`: List roles `type=<type>;actions=list`
`/roles/<id>`	ID `<id>` Type `role`	`read`: Read a role `ids=<id>;actions=read` `update`: Update a role `ids=<id>;actions=update` `delete`: Delete a role `ids=<id>;actions=delete` `add-grant-scopes`: Add grant scopes to a role `ids=<id>;actions=add-grant-scopes` `add-grants`: Add grants to a role `ids=<id>;actions=add-grants` `add-principals`: Add principals to a role `ids=<id>;actions=add-principals` `remove-grant-scopes`: Remove grant scopes from a role `ids=<id>;actions=remove-grant-scopes` `remove-grants`: Remove grants from a role `ids=<id>;actions=remove-grants` `remove-principals`: Remove principals from a role `ids=<id>;actions=remove-principals` `set-grant-scopes`: Set the full set of grant scopes on a role `ids=<id>;actions=set-grant-scopes` `set-grants`: Set the full set of grants on a role `ids=<id>;actions=set-grants` `set-principals`: Set the full set of principals on a role `ids=<id>;actions=set-principals`

Scope

The Scope resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/scopes`	Type `scope`	`create`: Create a scope `type=<type>;actions=create` `destroy-key-version`: `type=<type>;actions=destroy-key-version` `list`: List scopes `type=<type>;actions=list` `list-key-version-destruction-jobs`: `type=<type>;actions=list-key-version-destruction-jobs` `list-keys`: `type=<type>;actions=list-keys` `rotate-keys`: `type=<type>;actions=rotate-keys`
`/scopes/<id>`	ID `<id>` Type `scope`	`read`: Read a scope `ids=<id>;actions=read` `update`: Update a scope `ids=<id>;actions=update` `delete`: Delete a scope `ids=<id>;actions=delete` `attach-storage-policy`: `ids=<id>;actions=attach-storage-policy` `detach-storage-policy`: `ids=<id>;actions=detach-storage-policy`

Session

The Session resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/sessions`	Type `session`	`list`: List sessions `type=<type>;actions=list`
`/sessions/<id>`	ID `<id>` Type `session`	`read`: Read a session `ids=<id>;actions=read` `cancel`: Cancel a session `ids=<id>;actions=cancel` `cancel:self`: Cancel a session, which must be associated with the calling user `ids=<id>;actions=cancel:self` `read:self`: Read a session, which must be associated with the calling user `ids=<id>;actions=read:self`

Session recording

The Session recording resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/session-recordings`	Type `session-recording`	`list`: List session recordings `type=<type>;actions=list`
`/session-recordings/<id>`	ID `<id>` Type `session-recording`	`read`: Read a session recording `ids=<id>;actions=read` `delete`: Delete a session recording `ids=<id>;actions=delete` `download`: Download a session recording `ids=<id>;actions=download` `reapply-storage-policy`: Reapply the storage policy to a session recording `ids=<id>;actions=reapply-storage-policy`

Storage bucket

The Storage bucket resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/storage-buckets`	Type `storage-bucket`	`create`: Create a storage bucket `type=<type>;actions=create` `list`: List storage buckets `type=<type>;actions=list`
`/storage-buckets/<id>`	ID `<id>` Type `storage-bucket`	`read`: Read a storage bucket `ids=<id>;actions=read` `update`: Update a storage bucket `ids=<id>;actions=update` `delete`: Delete a storage bucket `ids=<id>;actions=delete`

Target

The Target resource type supports the following scopes: Project

API endpoint	Parameters into permissions engine	Available actions / examples
`/targets`	Type `target`	`create`: Create a target `type=<type>;actions=create` `list`: List targets `type=<type>;actions=list`
`/targets/<id>`	ID `<id>` Type `target`	`read`: Read a target `ids=<id>;actions=read` `update`: Update a target `ids=<id>;actions=update` `delete`: Delete a target `ids=<id>;actions=delete` `add-credential-sources`: Add credential sources to a target `ids=<id>;actions=add-credential-sources` `add-host-sources`: Add host sources to a target `ids=<id>;actions=add-host-sources` `authorize-session`: Authorize a session via the target `ids=<id>;actions=authorize-session` `remove-credential-sources`: Remove credential sources from a target `ids=<id>;actions=remove-credential-sources` `remove-host-sources`: Remove host sources from a target `ids=<id>;actions=remove-host-sources` `set-credential-sources`: Set the full set of credential sources on a target `ids=<id>;actions=set-credential-sources` `set-host-sources`: Set the full set of host sources on a target `ids=<id>;actions=set-host-sources`

User

The User resource type supports the following scopes: Global, Org

API endpoint	Parameters into permissions engine	Available actions / examples
`/users`	Type `user`	`create`: Create a user `type=<type>;actions=create` `list`: List users `type=<type>;actions=list`
`/users/<id>`	ID `<id>` Type `user`	`read`: Read a user `ids=<id>;actions=read` `update`: Update a user `ids=<id>;actions=update` `delete`: Delete a user `ids=<id>;actions=delete` `add-accounts`: Add accounts to a user `ids=<id>;actions=add-accounts` `list-resolvable-aliases`: `ids=<id>;actions=list-resolvable-aliases` `remove-accounts`: Remove accounts from a user `ids=<id>;actions=remove-accounts` `set-accounts`: Set the full set of accounts on a user `ids=<id>;actions=set-accounts`

Worker

The Worker resource type supports the following scopes: Global

API endpoint	Parameters into permissions engine	Available actions / examples
`/workers`	Type `worker`	`create:controller-led`: Create a worker using the controller-led workflow `type=<type>;actions=create:controller-led` `type=<type>;actions=create:controller-led` `create:worker-led`: Create a worker using the worker-led workflow `type=<type>;actions=create:worker-led` `type=<type>;actions=create:worker-led` `list`: List workers `type=<type>;actions=list` `read-certificate-authority`: `type=<type>;actions=read-certificate-authority` `reinitialize-certificate-authority`: `type=<type>;actions=reinitialize-certificate-authority`
`/workers/<id>`	ID `<id>` Type `worker`	`read`: Read a worker `ids=<id>;actions=read` `update`: Update a worker `ids=<id>;actions=update` `delete`: Delete a worker `ids=<id>;actions=delete` `add-worker-tags`: Add worker tags to a worker `ids=<id>;actions=add-worker-tags` `remove-worker-tags`: Remove worker tags from a worker `ids=<id>;actions=remove-worker-tags` `set-worker-tags`: Set the full set of worker tags on a worker `ids=<id>;actions=set-worker-tags`