Skip to content

Commit 02e62cb

Browse files
anttiviljamianttiviljami
authored
Merge pull request #108 from epilot-dev/docs/grant-actions-reference
Add grant actions reference documentation
2 parents c675be3 + 8d29be1 commit 02e62cb

2 files changed

Lines changed: 382 additions & 0 deletions

File tree

‎docs/auth/grant-actions.md‎

Lines changed: 381 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,381 @@
1+
---
2+
sidebar_position: 5
3+
---
4+
5+
# Grant Actions Reference
6+
7+
Complete reference of all permission grant actions supported by the epilot permissions system. See [Permissions](/docs/auth/permissions) for concepts and evaluation rules.
8+
9+
Actions follow a `{domain}:{operation}` pattern. Use `{domain}:*` to grant all operations in a domain.
10+
11+
## Entity
12+
13+
Entity permissions are scoped per schema using the `resource` field (e.g. `contact:*`, `opportunity:*`).
14+
15+
| Action | Description |
16+
|---|---|
17+
| `entity:*` | All entity operations |
18+
| `entity:view` | View entities |
19+
| `entity:create` | Create entities (also "Upload Files" for file entities) |
20+
| `entity:edit` | Edit entities |
21+
| `entity:bulk_edit` | Bulk edit entities |
22+
| `entity:delete` | Delete entities |
23+
| `entity:export` | Export entities |
24+
| `entity:import` | Import entities |
25+
| `entity:download` | Download files |
26+
| `entity:generate_document` | Generate documents |
27+
| `entity:save_document_template` | Save new document templates |
28+
| `entity:deduplicate` | Deduplicate entities (contact, account only) |
29+
| `entity:invite_partner` | Invite partners |
30+
31+
### Entity Attributes
32+
33+
Attribute-level permissions control visibility of individual fields. Resources follow the pattern `{schema}:{group}:{attribute}`.
34+
35+
| Action | Description |
36+
|---|---|
37+
| `entity:attribute:view` | View specific entity attributes |
38+
| `entity:attribute:edit` | Edit specific entity attributes |
39+
| `entity:attribute:*` | All attribute operations |
40+
41+
**Resource pattern examples:**
42+
43+
| Pattern | Matches |
44+
|---|---|
45+
| `contact:*:*` | All attributes on contacts |
46+
| `contact:Personal Details:email` | The email field in the Personal Details group on contacts |
47+
| `*:*:_tags` | The `_tags` field across all schemas and groups |
48+
| `*` | All attributes on all schemas |
49+
50+
:::note
51+
System metadata fields (`_id`, `_title`, `_org`, `_schema`, `_created_at`, `_updated_at`, `_tags`, `_purpose`, `_owners`, `_acl`, `_manifest`) are always returned regardless of attribute permissions.
52+
:::
53+
54+
### Entity Capabilities
55+
56+
| Action | Description |
57+
|---|---|
58+
| `entity:capability:*` | All capability operations |
59+
| `entity:capability:view` | View capabilities (e.g. product items on orders) |
60+
| `entity:capability:create` | Create capability items |
61+
| `entity:capability:edit` | Edit capability items |
62+
| `entity:capability:delete` | Delete capability items |
63+
64+
## Messaging
65+
66+
| Action | Description |
67+
|---|---|
68+
| `message:*` | All messaging operations |
69+
| `message:view` | View messages |
70+
| `message:send` | Send messages |
71+
| `message:bulk_send` | Send bulk messages |
72+
| `message:delete` | Delete messages |
73+
74+
:::info
75+
`message:view` and `message:send` implicitly depend on `entity:view` / `entity:*` for `message` and `thread` entity schemas.
76+
:::
77+
78+
## Workflows
79+
80+
### Workflow Definitions
81+
82+
| Action | Description |
83+
|---|---|
84+
| `workflow:definition:*` | All workflow definition operations |
85+
| `workflow:definition:view` | View workflow definitions |
86+
| `workflow:definition:create` | Create workflow definitions |
87+
| `workflow:definition:edit` | Edit workflow definitions |
88+
| `workflow:definition:delete` | Delete workflow definitions |
89+
90+
### Workflow Execution
91+
92+
| Action | Description |
93+
|---|---|
94+
| `workflow:execution:*` | All workflow execution operations |
95+
| `workflow:execution:view` | View all tasks from workflows |
96+
| `workflow:execution:trigger` | Trigger workflows |
97+
| `workflow:execution:cancel` | Cancel or reopen workflows |
98+
| `workflow:execution:delete` | Delete workflows |
99+
| `workflow:execution:update_details` | Update workflow assignee and due dates |
100+
| `workflow:execution:task:view_assigned` | View only assigned tasks |
101+
| `workflow:execution:task:update` | Update task status |
102+
| `workflow:execution:task:update_assigned` | Update assigned task status only |
103+
| `workflow:execution:task:assign` | Assign workflow tasks |
104+
| `workflow:execution:task:update_date` | Set or change task due date |
105+
| `workflow:execution:task:add` | Add new tasks |
106+
| `workflow:execution:task:notes` | View, create, edit and delete notes in tasks |
107+
108+
## Automation
109+
110+
| Action | Description |
111+
|---|---|
112+
| `automation:*` | All automation operations |
113+
| `automation:view` | View automation flows |
114+
| `automation:create` | Create automation flows |
115+
| `automation:edit` | Edit automation flows |
116+
| `automation:delete` | Delete automation flows |
117+
| `automation:trigger` | Trigger automations |
118+
119+
## Users & Roles
120+
121+
### Users
122+
123+
| Action | Description |
124+
|---|---|
125+
| `user:*` | All user operations |
126+
| `user:view` | View users |
127+
| `user:invite` | Invite users |
128+
| `user:delete` | Delete users |
129+
130+
### Roles
131+
132+
| Action | Description |
133+
|---|---|
134+
| `role:*` | All role operations |
135+
| `role:view` | View roles |
136+
| `role:assign` | Assign roles to users |
137+
| `role:create` | Create roles |
138+
| `role:delete` | Delete roles |
139+
140+
### Groups
141+
142+
| Action | Description |
143+
|---|---|
144+
| `group:*` | All group operations |
145+
| `group:view` | View groups |
146+
| `group:create` | Create groups |
147+
| `group:edit` | Edit groups |
148+
| `group:delete` | Delete groups |
149+
150+
### Access Tokens
151+
152+
| Action | Description |
153+
|---|---|
154+
| `token:*` | All token operations |
155+
| `token:create` | Create access tokens |
156+
157+
### Partner Users
158+
159+
| Action | Description |
160+
|---|---|
161+
| `partner:user:*` | All partner user operations |
162+
| `partner:user:view` | View partner users |
163+
| `partner:user:create` | Create partner users |
164+
| `partner:user:update_roles` | Update partner user roles |
165+
| `partner:user:delete` | Delete partner users |
166+
| `partner:user_limit:set` | Set partner user limit |
167+
168+
## Organization
169+
170+
| Action | Description |
171+
|---|---|
172+
| `organization:*` | All organization operations |
173+
| `organization:edit` | Update organization |
174+
| `organization:settings` | Update organization settings |
175+
| `organization:sso` | Configure SSO |
176+
177+
## Schema & Entity Builder
178+
179+
| Action | Description |
180+
|---|---|
181+
| `schema:*` | All schema operations |
182+
| `schema:view` | View entity schemas |
183+
| `entity_manager:*` | All entity manager operations |
184+
| `entity_manager:view` | View entity manager |
185+
186+
## Email
187+
188+
### Email Settings
189+
190+
| Action | Description |
191+
|---|---|
192+
| `email_setting:*` | All email settings operations |
193+
| `email_setting:view` | View email settings |
194+
| `email_setting:create` | Create email settings |
195+
| `email_setting:edit` | Edit email settings |
196+
| `email_setting:delete` | Delete email settings |
197+
198+
### epilot Email Addresses
199+
200+
| Action | Description |
201+
|---|---|
202+
| `epilot_email_address:*` | All epilot email address operations |
203+
| `epilot_email_address:view` | View epilot email addresses |
204+
| `epilot_email_address:edit` | Edit epilot email addresses |
205+
206+
## Portals
207+
208+
### Customer Portal
209+
210+
| Action | Description |
211+
|---|---|
212+
| `customer_portal:*` | All customer portal operations |
213+
| `customer_portal:view` | View customer portals |
214+
| `customer_portal:create` | Create customer portals |
215+
| `customer_portal:edit` | Edit customer portals |
216+
| `customer_portal:activate` | Activate customer portals |
217+
| `customer_portal:delete` | Delete customer portals |
218+
219+
### Installer Portal
220+
221+
| Action | Description |
222+
|---|---|
223+
| `installer_portal:*` | All installer portal operations |
224+
| `installer_portal:view` | View installer portals |
225+
| `installer_portal:create` | Create installer portals |
226+
| `installer_portal:edit` | Edit installer portals |
227+
| `installer_portal:activate` | Activate installer portals |
228+
| `installer_portal:delete` | Delete installer portals |
229+
230+
## Webhooks
231+
232+
| Action | Description |
233+
|---|---|
234+
| `webhook:*` | All webhook operations |
235+
| `webhook:view` | View webhooks |
236+
| `webhook:create` | Create webhooks |
237+
| `webhook:edit` | Edit webhooks |
238+
| `webhook:delete` | Delete webhooks |
239+
240+
## Integrations
241+
242+
| Action | Description |
243+
|---|---|
244+
| `integration:*` | All integration operations |
245+
| `integration:view` | View integrations |
246+
| `integration:manage` | Manage integrations |
247+
248+
## Dashboard
249+
250+
| Action | Description |
251+
|---|---|
252+
| `dashboard:*` | All dashboard operations |
253+
| `dashboard:create` | Create dashboards |
254+
| `dashboard:edit` | Edit dashboards |
255+
| `dashboard:delete` | Delete dashboards |
256+
257+
## Design Builder
258+
259+
| Action | Description |
260+
|---|---|
261+
| `design:*` | All design operations |
262+
| `design:view` | View designs |
263+
| `design:create` | Create designs |
264+
| `design:edit` | Edit designs |
265+
| `design:delete` | Delete designs |
266+
267+
## Label Builder
268+
269+
| Action | Description |
270+
|---|---|
271+
| `label_builder:*` | All label builder operations |
272+
| `label_builder:view` | View label builder |
273+
| `label_builder:create` | Create families, labels, and file collections |
274+
| `label_builder:edit` | Edit families, labels, and file collections |
275+
| `label_builder:delete` | Delete families, labels, and file collections |
276+
| `label_builder:create_standalone_labels` | Create standalone labels |
277+
278+
## Variables
279+
280+
| Action | Description |
281+
|---|---|
282+
| `variable:*` | All variable operations |
283+
| `variable:view` | View variables |
284+
| `variable:create` | Create variables |
285+
| `variable:edit` | Edit variables |
286+
| `variable:delete` | Delete variables |
287+
288+
## Kanban
289+
290+
| Action | Description |
291+
|---|---|
292+
| `kanban:*` | All kanban operations |
293+
| `kanban:view` | View kanban boards |
294+
| `kanban:all_assignee_filters` | Filter by all assignees |
295+
| `kanban:set_org_default_board` | Set default board for organization |
296+
297+
## Apps
298+
299+
| Action | Description |
300+
|---|---|
301+
| `app:*` | All app operations |
302+
| `app:view` | View app installations |
303+
| `app:install` | Install apps |
304+
| `app:uninstall` | Uninstall apps |
305+
306+
## Blueprints
307+
308+
| Action | Description |
309+
|---|---|
310+
| `blueprint:*` | All blueprint operations |
311+
| `blueprint:view` | View blueprints |
312+
| `blueprint:install` | Install blueprints |
313+
314+
## Event Catalog
315+
316+
| Action | Description |
317+
|---|---|
318+
| `event_catalog:*` | All event catalog operations |
319+
| `event_catalog:view` | View event catalog |
320+
| `event_catalog:manage` | Manage event catalog |
321+
322+
## Data Management
323+
324+
| Action | Description |
325+
|---|---|
326+
| `data_management:*` | All data management operations |
327+
| `data_management:view` | View data management configuration |
328+
| `data_management:edit` | Edit data management configuration |
329+
330+
## Datalake
331+
332+
| Action | Description |
333+
|---|---|
334+
| `datalake:*` | All datalake operations |
335+
| `datalake:view` | View datalake settings |
336+
337+
## Environments & Secrets
338+
339+
| Action | Description |
340+
|---|---|
341+
| `environments:*` | All environment operations |
342+
| `environments:edit` | Manage environments and secrets |
343+
| `environments:delete` | Delete environments and secrets |
344+
345+
## File Collections
346+
347+
| Action | Description |
348+
|---|---|
349+
| `file_collection:*` | All file collection operations |
350+
| `file_collection:view` | View personal file collections |
351+
| `file_collection_builder:*` | All file collection builder operations |
352+
| `file_collection_builder:view` | View file collection builder |
353+
354+
## Meter Reading
355+
356+
| Action | Description |
357+
|---|---|
358+
| `meter_reading:*` | All meter reading operations |
359+
| `meter_reading:view` | View meter readings |
360+
| `meter_reading:create` | Create meter readings |
361+
| `meter_reading:edit` | Edit meter readings |
362+
| `meter_reading:activate` | Activate meter readings |
363+
| `meter_reading:delete` | Delete meter readings |
364+
365+
## Audit Logs
366+
367+
| Action | Description |
368+
|---|---|
369+
| `audit_log:view` | View audit logs |
370+
371+
## Notes
372+
373+
| Action | Description |
374+
|---|---|
375+
| `note:*` | All note operations |
376+
377+
## See Also
378+
379+
- [Permissions](/docs/auth/permissions) -- core concepts, evaluation rules, role types
380+
- [Authorization](/docs/auth/authorization) -- how epilot authorizes API requests
381+
- [Permissions API](/api/permissions) -- API reference

‎docs/auth/permissions.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ This role allows all entity, messaging, and workflow operations, but explicitly
202202

203203
## See Also
204204

205+
- [Grant Actions Reference](/docs/auth/grant-actions) -- complete list of all supported permission actions
205206
- [Authorization](/docs/auth/authorization) -- how epilot authorizes API requests
206207
- [Token Types](/docs/auth/token-types) -- comparison of all epilot token types
207208
- [Security Architecture](/docs/auth/security) -- platform security overview

0 commit comments

Comments
 (0)