Skip to main content

Role permissions

This table lists every permission a role can hold, and which of the Viewer and Publisher roles hold it on a new installation. The Administrator role holds every permission.

Administrators can grant or revoke each permission on the Viewer and Publisher roles, except the ones marked administrator-only. See Customizing user roles.

The table assumes that the configuration file sets none of the deprecated role settings, such as Authorization.PublishersCanManageRunAs. The first time Connect starts, on a new installation or after an upgrade, it copies the values of these settings into the corresponding permissions. If the configuration file sets any of them, the Viewer and Publisher roles can start from different grants. A server upgraded from an earlier release keeps the permissions its roles already held.

Permission Description Viewer Publisher Administrator-only
users:create Create new users No No No
users:read List users No Yes No
users:update Modify user accounts No No Yes
users:delete Remove users No No Yes
users:lock Lock and unlock user accounts No No Yes
users:update-profile Modify another user’s names, email, username, and avatar No No Yes
users:reset-password Send another user a password reset link No No Yes
users:export Export the user list as CSV No No Yes
users:update-provider-fields Modify a user’s identity-provider-managed fields via the API No No Yes
users:read-email View another user’s email address Yes Yes No
users:read-provider-details View another user’s identity-provider details No No No
users:read-groups View the groups another user belongs to No No No
users:search-remote Search for users from a remote authentication provider No Yes No
users:create-api-key Create API keys for other users No No Yes
content:publish Create and publish new content No Yes No
content:read View any content regardless of its access list No No Yes
content:read-settings View any content’s settings, logs, and access list regardless of its access list No No Yes
content:update Modify content you collaborate on, including its runtime, git repository, and thumbnail No Yes No
content:update-permissions Manage any content’s access list regardless of its access list No No Yes
content:delete Remove content No Yes No
content:update-runas Update RunAs settings for content No No No
content:create-runas Set RunAs settings when creating content No No No
content:update-service-account Set a content item’s Kubernetes service account No No No
content:select-environment Choose a non-default execution environment or image for content No No No
content:verify-public-access Test a content item’s public access configuration No Yes No
content:update-override Modify any content’s settings, including its variants, schedules, runtime, git repository, and access type up to the administrator limit, regardless of its access list No No Yes
content:delete-override Remove any content regardless of its access list No No Yes
groups:create Create new groups No No No
groups:read List groups and group members No Yes No
groups:update Modify groups No No No
groups:delete Remove groups No No No
groups:search-remote Search for groups from a remote authentication provider No Yes No
groups:read-provider-details View a group’s identity-provider details No No No
vanities:create Create vanity URLs No Yes No
vanities:delete Remove vanity URLs No Yes No
vanities:read View every vanity URL, including for content the caller cannot otherwise see No No Yes
vanities:set-reserved-path Set a vanity URL that begins with an existing username No No No
bundles:upload Upload bundles No Yes No
bundles:deploy Deploy bundles to content No Yes No
bundles:build Build bundle environments No Yes No
bundles:build-override Build bundle environments for any content regardless of its access list No No Yes
bundles:read-override View any content’s bundles and their tags regardless of its access list No No Yes
bundles:update-override Add and remove tags on any content’s bundles regardless of its access list No No Yes
bundles:delete-override Remove any content’s bundles regardless of its access list No No Yes
tags:read List tags Yes Yes No
tags:create Create tags and tag categories No No No
tags:update Rename tags and tag categories No No No
tags:delete Remove tags and tag categories No No No
instrumentation:read-own View content visit and Shiny usage data for content you own or can edit No Yes No
instrumentation:read Read content visit and Shiny usage data No No Yes
feature-usage:read Read feature usage data No Yes No
server-settings:read Read server settings and runtime installations No Yes No
identity:manage Manage users and groups No No Yes
roles:read View roles and the permissions they grant No No Yes
roles:create Create roles No No Yes
roles:update Modify roles and the permissions they grant No No Yes
roles:delete Remove roles No No Yes
roles:request Request an account role upgrade or access to content Yes Yes No
roles:request-permission Request a permission for your role No No No
environments:read View execution environments No Yes No
environments:create Create execution environments No No No
environments:delete Remove execution environments No No No
environments:update Modify execution environments, including their tags No No No
environments:update-permissions Manage execution environment access lists No No Yes
environments:use-override Use any execution environment regardless of its access list No No Yes
oauth-integrations:read View OAuth integrations available to you, and the templates they are created from No Yes No
oauth-integrations:read-associations View which content an OAuth integration is associated with, bypassing per-integration ACLs No No Yes
oauth-integrations:create Create OAuth integrations No No Yes
oauth-integrations:delete Remove OAuth integrations No No Yes
oauth-integrations:update Modify OAuth integrations, including their tags No No Yes
oauth-integrations:verify Test OAuth integration credentials No No Yes
oauth-integrations:associate Associate OAuth integrations with content No Yes No
oauth-integrations:exchange-credentials Exchange a subject token for OAuth credentials No Yes No
oauth-integrations:read-sessions View any user’s OAuth integration sessions No No Yes
oauth-integrations:delete-sessions Remove any user’s OAuth integration sessions No No Yes
oauth-clients:delete Remove OAuth clients No No Yes
metrics:read-system View server-wide process and deployment metrics No No No
metrics:read-users View counts of users by role No No No
metrics:read-dashboard View the server metrics dashboard No Yes No
packages:read View the server-wide package inventory, including for content the caller cannot otherwise see No No Yes
email-subscriptions:read View the email address of external users who receive email from content No No No
system:read-sensitive View sensitive server settings, such as licensing and deprecated-setting warnings No No No
system:update-runtimes Choose which installed runtime versions content may use No No Yes
system:system-check Start, view, and delete system check runs No No No
system:diagnostics Download a server diagnostic bundle No No Yes
system:email View mail settings and send a test email No No No
system:custom-messages View and modify custom messages No No Yes
system:storage View content and server storage usage, including for content the caller cannot otherwise see No No Yes
system:audit-logs View audit logs and available audit actions No No Yes
system:runtime-caches View and remove runtime package caches No No No
service-tokens:create Create service tokens No No Yes
service-tokens:delete Remove service tokens No No Yes
service-tokens:read View service tokens and available scopes No No No
documentation:read View the server’s custom documentation Yes Yes No
documentation:update Upload custom documentation No No No
documentation:delete Remove custom documentation No No No
chronicle:read View whether Chronicle is enabled and running No No No
hosts:read View registered execution hosts No No No
jobs:read View every schedule and job statistics, including for content the caller cannot otherwise see No No Yes
jobs:read-queue View the job queue No No No
jobs:delete-queue Remove items from the job queue No No No
groups:read-ownership View which content items a group has access to, including content the caller cannot otherwise see No No Yes
offhost-service-accounts:read View off-host launcher service accounts No Yes No
trusted-publishers:create Create trusted publisher configurations for content No Yes No
trusted-publishers:delete Remove trusted publisher configurations No Yes No
repo:read Browse a git repository’s branches and manifest directories No Yes No
gallery:read Browse and deploy from the Connect Gallery No Yes No
gallery:read-admin-extensions See Gallery extensions marked for administrators No No No
gateway:read-usage Export the AI Gateway usage log No No No
gateway:read-pricing View AI Gateway provider and model pricing, and configured pricing overrides No Yes No
gateway:update-pricing Configure AI Gateway model pricing overrides No No No
gateway:read-own-usage View the caller’s own AI Gateway usage No Yes No
users:read-ai-budget View a user’s AI budget No No No
users:update-ai-budget Modify a user’s AI budget No No No

Default permissions

On a new installation whose configuration file sets none of the deprecated role settings, the Viewer and Publisher roles hold the permissions below. Every other permission in the table above starts revoked for both roles. The Viewer role also holds users:read while current user execution uses the Connect nameservice.

Viewer

  • users:read-email: View another user’s email address
  • tags:read: List tags
  • roles:request: Request an account role upgrade or access to content
  • documentation:read: View the server’s custom documentation

Publisher

The Publisher role holds these permissions, which include every Viewer permission:

  • users:read: List users
  • users:read-email: View another user’s email address
  • users:search-remote: Search for users from a remote authentication provider
  • content:publish: Create and publish new content
  • content:update: Modify content you collaborate on, including its runtime, git repository, and thumbnail
  • content:delete: Remove content
  • content:verify-public-access: Test a content item’s public access configuration
  • groups:read: List groups and group members
  • groups:search-remote: Search for groups from a remote authentication provider
  • vanities:create: Create vanity URLs
  • vanities:delete: Remove vanity URLs
  • bundles:upload: Upload bundles
  • bundles:deploy: Deploy bundles to content
  • bundles:build: Build bundle environments
  • tags:read: List tags
  • instrumentation:read-own: View content visit and Shiny usage data for content you own or can edit
  • feature-usage:read: Read feature usage data
  • server-settings:read: Read server settings and runtime installations
  • roles:request: Request an account role upgrade or access to content
  • environments:read: View execution environments
  • oauth-integrations:read: View OAuth integrations available to you, and the templates they are created from
  • oauth-integrations:associate: Associate OAuth integrations with content
  • oauth-integrations:exchange-credentials: Exchange a subject token for OAuth credentials
  • metrics:read-dashboard: View the server metrics dashboard
  • documentation:read: View the server’s custom documentation
  • offhost-service-accounts:read: View off-host launcher service accounts
  • trusted-publishers:create: Create trusted publisher configurations for content
  • trusted-publishers:delete: Remove trusted publisher configurations
  • repo:read: Browse a git repository’s branches and manifest directories
  • gallery:read: Browse and deploy from the Connect Gallery
  • gateway:read-pricing: View AI Gateway provider and model pricing, and configured pricing overrides
  • gateway:read-own-usage: View the caller’s own AI Gateway usage

Permissions that depend on others

Connect does not grant one permission because a role holds another, so some permissions do nothing useful on their own. Grant them together:

  • content:update decides whether an account can own or edit content. Without it, Connect treats the account as a viewer of every content item, including the ones it creates or is added to as an owner or collaborator. A role with content:publish or the bundles:* permissions but without content:update can create content, but cannot deploy to it or change it.
  • A permission that changes something usually needs its matching read permission for the dashboard to offer it. For example, the System > Tags page needs tags:read, so a role with tags:create but without tags:read can create tags only with the API.

Creating users

A role with users:create can create accounts with any role that holds no permission the creating role lacks. With the default permissions plus users:create, a Viewer can create Viewer accounts and a Publisher can create Viewer and Publisher accounts. Only an Administrator can create Administrator accounts. Because the Publisher role holds every permission the Viewer role holds, a Publisher with users:create can always create Viewer accounts.

Feature-gated permissions

Some permissions apply only while their feature is turned on. Connect does not list them, or let you grant or revoke them, while the feature is off: