Help us learn about your current experience with the documentation. Take the survey.

Fine-grained permissions for GraphQL API

Tier: Free, Premium, Ultimate
Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

A fine-grained personal access token can access only the resources and permissions you grant it. To use one with the GraphQL API, create a token and define its scope. For more information, see fine-grained personal access tokens.

Available fine-grained permissions

Fine-grained personal access tokens can access the following GraphQL types, mutations, and fields:

Application Security resources

Dependency

Grants the ability to read dependencies.

Action	Access	Kind	Name
Read	Project	Type	`DependencyLocation`
Read	Project	Type	`DependencyTrackedRef`

Finding Token Status

Grants the ability to update finding token statuses.

Action	Access	Kind	Name
Update	Project	Mutation	`RefreshFindingTokenStatus`
Update	Project	Mutation	`RefreshVulnerabilityFindingTokenStatus`

Pipeline Execution Project Schedule

Grants the ability to read pipeline execution project schedules.

Action	Access	Kind	Name
Read	Project	Type	`PipelineExecutionProjectSchedule`

Secrets Manager

Grants the ability to read secrets managers.

Action	Access	Kind	Name
Read	Project	Type	`ProjectSecretsManager`
Read	Group	Type	`GroupSecretsManager`
Read	Group	Type	`SecretsManagerEntitlement`
Read	Group	Mutation	`SecretsManagerStartTrial`

Security Attribute

Grants the ability to create, delete, and update security attributes.

Action	Access	Kind	Name
Create	Group	Mutation	`SecurityAttributeCreate`
Create	Group	Mutation	`SecurityCategoryCreate`
Delete	Group	Mutation	`SecurityAttributeDestroy`
Delete	Group	Mutation	`SecurityCategoryDestroy`
Update	Project	Mutation	`SecurityAttributeProjectUpdate`
Update	Group	Mutation	`SecurityAttributeUpdate`
Update	Group	Mutation	`SecurityCategoryUpdate`

Security Dashboard

Grants the ability to update security dashboards.

Action	Access	Kind	Name
Update	Project	Mutation	`AddProjectToSecurityDashboard`
Update	Project	Mutation	`RemoveProjectFromSecurityDashboard`

Security Scan Profiles

Grants the ability to create, delete, and update security scan profiles.

Action	Access	Kind	Name
Create	Group	Mutation	`SecurityScanProfileCreate`
Delete	Group	Mutation	`SecurityScanProfileDelete`
Update	Group	Mutation	`SecurityScanProfileUpdate`

Vulnerability

Grants the ability to archive, create, read, and update vulnerabilities.

Action	Access	Kind	Name
Archive	Project	Mutation	`VulnerabilitiesArchive`
Create	Project	Mutation	`VulnerabilityCreate`
Read	Project	Type	`CountableVulnerability`
Read	Project	Type	`Vulnerability`
Read	Project	Type	`VulnerabilityScanner`
Read	Project	Field	`MergeRequest.findingReportsComparer`
Read	Project	Field	`Project.vulnerabilityWorkflowExecution`
Update	Project	Mutation	`BulkSetVulnerabilityFindingsDueDates`
Update	Project	Mutation	`VulnerabilityAutoRemediation`
Update	Project	Mutation	`VulnerabilityConfirm`
Update	Project	Mutation	`VulnerabilityDismiss`
Update	Project	Mutation	`VulnerabilityResolve`
Update	Project	Mutation	`VulnerabilityRevertToDetected`

Vulnerability Duo Workflow

Grants the ability to execute vulnerability duo workflows.

Action	Access	Kind	Name
Execute	Project	Mutation	`CancelVulnerabilityWorkflow`
Execute	Project	Mutation	`StartVulnerabilityWorkflow`

Vulnerability Flag

Grants the ability to update vulnerability flags.

Action	Access	Kind	Name
Update	Project	Mutation	`VulnerabilityDismissFalsePositiveFlag`

Vulnerability Issue Link

Grants the ability to create, delete, and read vulnerability issue links.

Action	Access	Kind	Name
Create	Project	Mutation	`SecurityFindingCreateIssue`
Create	Project	Mutation	`SecurityFindingExternalIssueLinkCreate`
Create	Project	Mutation	`SecurityFindingJiraIssueFormUrlCreate`
Create	Project	Mutation	`VulnerabilitiesCreateIssue`
Create	Project	Mutation	`VulnerabilityExternalIssueLinkCreate`
Create	Project	Mutation	`VulnerabilityIssueLinkCreate`
Delete	Project	Mutation	`VulnerabilityExternalIssueLinkDestroy`

Vulnerability Merge Request Link

Grants the ability to create and delete vulnerability merge request links.

Action	Access	Kind	Name
Create	Project	Mutation	`VulnerabilityLinkMergeRequest`
Delete	Project	Mutation	`VulnerabilityUnlinkMergeRequest`

CI/CD resources

Catalog Bundled Resource

Grants the ability to read bundled CI catalog resources.

Action	Access	Kind	Name
Read	Instance	Type	`CiCatalogBundledResource`

Catalog Resource

Grants the ability to create and delete CI catalog resources.

Action	Access	Kind	Name
Create	Project	Mutation	`CatalogResourcesCreate`
Delete	Project	Mutation	`CatalogResourcesDestroy`

CD Application

Grants the ability to create, read, and update continuous deployment applications.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdApplicationCreate`
Read	Instance	Type	`CdApplication`
Update	Instance	Mutation	`CdApplicationUpdate`

CD Application Flow Definition

Grants the ability to create and read continuous deployment application flow definitions.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdApplicationFlowDefinitionCreate`
Read	Instance	Type	`CdApplicationFlowDefinition`

CD Application Link

Grants the ability to create, delete, read, and update continuous deployment application links.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdApplicationLinkCreate`
Delete	Instance	Mutation	`CdApplicationLinkDelete`
Read	Instance	Type	`CdApplicationLink`
Update	Instance	Mutation	`CdApplicationLinkUpdate`

CD Artifact Source

Grants the ability to create and read continuous deployment artifact sources.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdArtifactSourceCreate`
Read	Instance	Type	`CdArtifactSource`
Read	Instance	Type	`CdVersion`

CD Environment

Grants the ability to create, read, and update continuous deployment environments.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdEnvironmentCreate`
Read	Instance	Type	`CdEnvironment`
Read	Instance	Type	`CdEnvironmentApplication`
Read	Instance	Type	`CdEnvironmentDriverBinding`
Update	Instance	Mutation	`CdEnvironmentDriverBindingCreate`
Update	Instance	Mutation	`CdEnvironmentUpdate`

CD Rollout

Grants the ability to create and read CD rollouts.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdRolloutCreate`
Read	Instance	Type	`CdDeployment`
Read	Instance	Type	`CdDeploymentTransition`
Read	Instance	Type	`CdRollout`
Read	Instance	Type	`CdRolloutEnvironment`
Read	Instance	Type	`CdRolloutStep`
Read	Instance	Type	`CdRolloutTransition`

CD Rollout Gate

Grants the ability to resolve CD rollout gates.

Action	Access	Kind	Name
Resolve	Instance	Mutation	`CdRolloutGateResolve`

CD Service

Grants the ability to create, read, and update continuous deployment services.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdServiceCreate`
Read	Instance	Type	`CdService`
Read	Instance	Type	`CdServiceEnvironmentHealth`
Update	Instance	Mutation	`CdServiceUpdate`

CD Version Set

Grants the ability to create and read continuous deployment version sets.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdVersionSetCreate`
Read	Instance	Type	`CdVersionSet`
Read	Instance	Type	`CdVersionSetEntry`

CI Config

Grants the ability to read and validate CI/CD configuration.

Action	Access	Kind	Name
Validate	Project	Mutation	`CiLint`

CI Namespace Settings

Grants the ability to update CI namespace settings.

Action	Access	Kind	Name
Update	Group	Mutation	`NamespaceSettingsUpdate`

CI/CD Setting

Grants the ability to update CI/CD settings.

Action	Access	Kind	Name
Update	Project	Mutation	`ProjectCiCdSettingsUpdate`
Update	Group	Mutation	`SafeDisablePipelineVariables`

Cluster Agent

Grants the ability to create, delete, and read cluster agents.

Action	Access	Kind	Name
Create	Project	Mutation	`CreateClusterAgent`
Delete	Project	Mutation	`ClusterAgentDelete`
Read	Project	Type	`ClusterAgent`

Cluster Agent Token

Grants the ability to create, read, and revoke cluster agent tokens.

Action	Access	Kind	Name
Create	Project	Mutation	`ClusterAgentTokenCreate`

Cluster Agent URL Configuration

Grants the ability to create, delete, and read cluster agent URL configurations.

Action	Access	Kind	Name
Create	Project	Mutation	`ClusterAgentUrlConfigurationCreate`
Delete	Project	Mutation	`ClusterAgentUrlConfigurationDelete`

Deployment

Grants the ability to approve, create, delete, read, and update deployments.

Action	Access	Kind	Name
Approve	Project	Mutation	`ApproveDeployment`

Environment

Grants the ability to create, delete, read, stop, and update environments.

Action	Access	Kind	Name
Create	Project	Mutation	`EnvironmentCreate`
Delete	Project	Mutation	`EnvironmentDelete`
Read	Project	Type	`Environment`
Stop	Project	Mutation	`EnvironmentStop`
Update	Project	Mutation	`EnvironmentUpdate`

Freeze Period

Grants the ability to create, delete, read, and update freeze periods.

Action	Access	Kind	Name
Read	Project	Type	`CiFreezePeriod`

Job

Grants the ability to delete, read, run, and update jobs.

Action	Access	Kind	Name
Read	Project	Type	`CiJob`
Run	Project	Mutation	`JobPlay`
Run	Project	Mutation	`JobRetry`
Update	Project	Mutation	`JobCancel`
Update	Project	Mutation	`JobUnschedule`

Job Artifact

Grants the ability to delete, read, and update job artifacts.

Action	Access	Kind	Name
Delete	Project	Mutation	`ArtifactDestroy`
Delete	Project	Mutation	`BulkDestroyJobArtifacts`
Delete	Project	Mutation	`JobArtifactsDestroy`
Read	Project	Type	`CiJobArtifact`

Merge Train Car

Grants the ability to delete merge train cars.

Action	Access	Kind	Name
Delete	Project	Mutation	`MergeTrainsDeleteCar`

Pipeline

Grants the ability to create, delete, read, and update pipelines.

Action	Access	Kind	Name
Create	Project	Mutation	`PipelineCreate`
Delete	Project	Mutation	`PipelineDestroy`
Read	Project	Type	`CiStage`
Read	Project	Type	`Pipeline`
Update	Project	Mutation	`PipelineCancel`
Update	Project	Mutation	`PipelineRetry`

Pipeline Schedule

Grants the ability to create, delete, read, and update pipeline schedules.

Action	Access	Kind	Name
Create	Project	Mutation	`PipelineScheduleCreate`
Delete	Project	Mutation	`PipelineScheduleDelete`
Read	Project	Type	`PipelineSchedule`
Update	Project	Mutation	`PipelineSchedulePlay`
Update	Project	Mutation	`PipelineScheduleTakeOwnership`
Update	Project	Mutation	`PipelineScheduleUpdate`

Runner

Grants the ability to assign, create, delete, read, and update runners.

Action	Access	Kind	Name
Assign	Project	Mutation	`RunnerAssignToProject`
Assign	Project	Mutation	`RunnerUnassignFromProject`
Create	Project	Mutation	`RunnerCreate`
Create	Group	Mutation	`RunnerCreate`
Create	Instance	Mutation	`RunnerCreate`
Delete	Project	Mutation	`RunnerDelete`
Delete	Group	Mutation	`RunnerDelete`
Delete	Instance	Mutation	`RunnerDelete`
Read	Project	Type	`CiRunner`
Read	Group	Type	`CiRunner`
Read	Instance	Type	`CiRunner`
Update	Project	Mutation	`RunnerCacheClear`
Update	Project	Mutation	`RunnerUpdate`
Update	Group	Mutation	`RunnerUpdate`
Update	Instance	Mutation	`RunnerUpdate`

Terraform State

Grants the ability to create, delete, lock, and read Terraform state.

Action	Access	Kind	Name
Delete	Project	Mutation	`TerraformStateDelete`
Lock	Project	Mutation	`TerraformStateLock`
Lock	Project	Mutation	`TerraformStateUnlock`
Read	Project	Type	`TerraformState`
Read	Project	Type	`TerraformStateProtectionRule`
Read	Project	Type	`TerraformStateVersion`

Terraform State Protection Rule

Grants the ability to create, delete, and update Terraform state protection rules.

Action	Access	Kind	Name
Create	Project	Mutation	`CreateTerraformStateProtectionRule`
Delete	Project	Mutation	`DeleteTerraformStateProtectionRule`
Update	Project	Mutation	`UpdateTerraformStateProtectionRule`

Trigger

Grants the ability to create, delete, read, and update triggers.

Action	Access	Kind	Name
Create	Project	Mutation	`PipelineTriggerCreate`
Delete	Project	Mutation	`PipelineTriggerDelete`
Read	Project	Type	`PipelineTrigger`
Update	Project	Mutation	`PipelineTriggerUpdate`

Verified Namespace

Grants the ability to create verified namespaces.

Action	Access	Kind	Name
Create	Instance	Mutation	`VerifiedNamespaceCreate`

Compliance resources

Audit Event Streaming Destination

Grants the ability to create, delete, and update audit event streaming destinations.

Action	Access	Kind	Name
Create	Group	Mutation	`AuditEventsAmazonS3ConfigurationCreate`
Create	Group	Mutation	`ExternalAuditEventDestinationCreate`
Create	Group	Mutation	`GoogleCloudLoggingConfigurationCreate`
Create	Group	Mutation	`GroupAuditEventStreamingDestinationsCreate`
Create	Instance	Mutation	`AuditEventsInstanceAmazonS3ConfigurationCreate`
Create	Instance	Mutation	`InstanceAuditEventStreamingDestinationsCreate`
Create	Instance	Mutation	`InstanceExternalAuditEventDestinationCreate`
Create	Instance	Mutation	`InstanceGoogleCloudLoggingConfigurationCreate`
Delete	Group	Mutation	`AuditEventsAmazonS3ConfigurationDelete`
Delete	Group	Mutation	`ExternalAuditEventDestinationDestroy`
Delete	Group	Mutation	`GoogleCloudLoggingConfigurationDestroy`
Delete	Group	Mutation	`GroupAuditEventStreamingDestinationsDelete`
Delete	Instance	Mutation	`AuditEventsInstanceAmazonS3ConfigurationDelete`
Delete	Instance	Mutation	`InstanceAuditEventStreamingDestinationsDelete`
Delete	Instance	Mutation	`InstanceExternalAuditEventDestinationDestroy`
Delete	Instance	Mutation	`InstanceGoogleCloudLoggingConfigurationDestroy`
Update	Group	Mutation	`AuditEventsAmazonS3ConfigurationUpdate`
Update	Group	Mutation	`AuditEventsGroupDestinationDenylistEventsAdd`
Update	Group	Mutation	`AuditEventsGroupDestinationDenylistEventsDelete`
Update	Group	Mutation	`AuditEventsGroupDestinationEventsAdd`
Update	Group	Mutation	`AuditEventsGroupDestinationEventsDelete`
Update	Group	Mutation	`AuditEventsGroupDestinationNamespaceFilterCreate`
Update	Group	Mutation	`AuditEventsGroupDestinationNamespaceFilterDelete`
Update	Group	Mutation	`AuditEventsStreamingDestinationEventsAdd`
Update	Group	Mutation	`AuditEventsStreamingDestinationEventsRemove`
Update	Group	Mutation	`AuditEventsStreamingHTTPNamespaceFiltersAdd`
Update	Group	Mutation	`AuditEventsStreamingHTTPNamespaceFiltersDelete`
Update	Group	Mutation	`AuditEventsStreamingHeadersCreate`
Update	Group	Mutation	`AuditEventsStreamingHeadersDestroy`
Update	Group	Mutation	`AuditEventsStreamingHeadersUpdate`
Update	Group	Mutation	`ExternalAuditEventDestinationUpdate`
Update	Group	Mutation	`GoogleCloudLoggingConfigurationUpdate`
Update	Group	Mutation	`GroupAuditEventStreamingDestinationsUpdate`
Update	Instance	Mutation	`AuditEventsInstanceAmazonS3ConfigurationUpdate`
Update	Instance	Mutation	`AuditEventsInstanceDestinationEventsAdd`
Update	Instance	Mutation	`AuditEventsInstanceDestinationEventsDelete`
Update	Instance	Mutation	`AuditEventsInstanceDestinationNamespaceFilterCreate`
Update	Instance	Mutation	`AuditEventsInstanceDestinationNamespaceFilterDelete`
Update	Instance	Mutation	`AuditEventsStreamingDestinationInstanceEventsAdd`
Update	Instance	Mutation	`AuditEventsStreamingDestinationInstanceEventsRemove`
Update	Instance	Mutation	`AuditEventsStreamingInstanceHeadersCreate`
Update	Instance	Mutation	`AuditEventsStreamingInstanceHeadersDestroy`
Update	Instance	Mutation	`AuditEventsStreamingInstanceHeadersUpdate`
Update	Instance	Mutation	`InstanceAuditEventStreamingDestinationsUpdate`
Update	Instance	Mutation	`InstanceExternalAuditEventDestinationUpdate`
Update	Instance	Mutation	`InstanceGoogleCloudLoggingConfigurationUpdate`

Compliance Dashboard

Grants the ability to read compliance dashboards.

Action	Access	Kind	Name
Read	Group	Mutation	`RefreshStandardsAdherenceChecks`

Compliance Framework

Grants the ability to create, delete, and update compliance frameworks.

Action	Access	Kind	Name
Create	Group	Mutation	`CreateComplianceFramework`
Create	Group	Mutation	`CreateComplianceFrameworkFromTemplate`
Create	Group	Mutation	`CreateComplianceRequirement`
Create	Group	Mutation	`CreateComplianceRequirementsControl`
Delete	Group	Mutation	`DestroyComplianceFramework`
Delete	Group	Mutation	`DestroyComplianceRequirement`
Delete	Group	Mutation	`DestroyComplianceRequirementsControl`
Update	Project	Mutation	`ProjectSetComplianceFramework`
Update	Project	Mutation	`ProjectUpdateComplianceFrameworks`
Update	Group	Mutation	`UpdateComplianceFramework`
Update	Group	Mutation	`UpdateComplianceRequirement`
Update	Group	Mutation	`UpdateComplianceRequirementsControl`

Compliance Violations Report

Grants the ability to update compliance violations reports.

Action	Access	Kind	Name
Update	Project	Mutation	`LinkProjectComplianceViolationIssue`
Update	Project	Mutation	`UnlinkProjectComplianceViolationIssue`
Update	Project	Mutation	`UpdateProjectComplianceViolation`

External Status Check

Grants the ability to create, delete, read, retry, and update external status checks.

Action	Access	Kind	Name
Create	Project	Mutation	`BranchRuleExternalStatusCheckCreate`
Delete	Project	Mutation	`BranchRuleExternalStatusCheckDestroy`
Update	Project	Mutation	`BranchRuleExternalStatusCheckUpdate`

Duo resources

AI catalog item

Grants the ability to restore AI catalog items.

Action	Access	Kind	Name
Restore	Project	Mutation	`AiCatalogItemVersionRestore`

AI catalog MCP server

Grants the ability to block AI catalog MCP servers.

Action	Access	Kind	Name
Block	Project	Mutation	`AiCatalogMcpServerSetBlock`
Block	Group	Mutation	`AiCatalogMcpServerSetBlock`

AI tool rule

Grants the ability to read and update AI tool rules, which control per-tool approval (Allow, Ask, Deny) for the Duo Agent Platform.

Action	Access	Kind	Name
Read	Group	Field	`Query.aiToolRules`
Update	Group	Mutation	`BulkUpdateAiToolRules`
Update	Group	Mutation	`UpdateAiToolRule`

AI usage metric

Grants the ability to read per-user GitLab Duo usage metrics.

Action	Access	Kind	Name
Read	Project	Field	`Project.aiUserMetrics`
Read	Group	Field	`Group.aiUserMetrics`

Duo Workflow

Grants the ability to create, read, resume, and update duo workflows.

Action	Access	Kind	Name
Read	User	Type	`DuoWorkflowMergeRequestLink`
Read	User	Type	`DuoWorkflowNoteLink`
Read	User	Type	`DuoWorkflowWorkItemLink`
Read	User	Field	`Note.duoTriggeredSession`
Update	User	Mutation	`UpdateDuoWorkflowAgentPrivileges`
Update	User	Mutation	`UpdateDuoWorkflowWebSearch`

Flows Metadata

Grants the ability to read flows metadata.

Action	Access	Kind	Name
Read	Project	Type	`AiFlowsMetadata`
Read	Group	Type	`AiFlowsMetadata`
Read	Instance	Type	`AiFlowsMetadata`

Model Selection Allowlist

Grants the ability to read and update model selection allowlists.

Action	Access	Kind	Name
Read	Group	Type	`AiModelSelectionAllowList`
Read	Group	Type	`AiModelSelectionAllowListModel`
Read	Instance	Type	`AiModelSelectionAllowList`
Read	Instance	Type	`AiModelSelectionAllowListModel`
Update	Group	Mutation	`AiModelSelectionNamespaceModelAllowlistUpdate`
Update	Instance	Mutation	`AiFeatureSettingModelAllowlistUpdate`

Geo resources

Geo Registry

Grants the ability to update Geo registries.

Action	Access	Kind	Name
Update	Instance	Mutation	`GeoRegistriesBulkUpdate`
Update	Instance	Mutation	`GeoRegistriesUpdate`

GitLab Orbit resources

Knowledge Graph Setting

Grants the ability to update knowledge graph settings.

Action	Access	Kind	Name
Update	Group	Mutation	`OrbitUpdate`

Groups resources

Admin Member Role

Grants the ability to create, delete, read, and update admin member roles.

Action	Access	Kind	Name
Create	Instance	Mutation	`MemberRoleAdminCreate`
Delete	Instance	Mutation	`MemberRoleAdminDelete`
Read	Instance	Type	`AdminMemberRole`
Update	Instance	Mutation	`MemberRoleAdminUpdate`

Group

Grants the ability to archive, create, delete, read, share, transfer, and update groups.

Action	Access	Kind	Name
Read	Group	Type	`Group`
Transfer	Group	Mutation	`GroupTransfer`
Update	Group	Mutation	`GroupUpdate`

LDAP Admin Role Link

Grants the ability to create, delete, and read LDAP admin role links

Action	Access	Kind	Name
Create	Instance	Mutation	`AdminRolesLdapSync`
Create	Instance	Mutation	`LdapAdminRoleLinkCreate`
Delete	Instance	Mutation	`LdapAdminRoleLinkDestroy`
Read	Instance	Type	`LdapAdminRoleLink`

Member Role

Grants the ability to assign, create, delete, read, and update member roles.

Action	Access	Kind	Name
Assign	Instance	Mutation	`MemberRoleToUserAssign`
Create	Group	Mutation	`MemberRoleCreate`
Create	Instance	Mutation	`MemberRoleCreate`
Delete	Group	Mutation	`MemberRoleDelete`
Delete	Instance	Mutation	`MemberRoleDelete`
Update	Group	Mutation	`MemberRoleUpdate`
Update	Instance	Mutation	`MemberRoleUpdate`

Namespace

Grants the ability to read and update namespaces.

Action	Access	Kind	Name
Read	Project	Mutation	`NamespacesRegenerateNewWorkItemEmailAddress`

Namespace Ban

Grants the ability to delete namespace bans.

Action	Access	Kind	Name
Delete	Group	Mutation	`NamespaceBanDestroy`

Preference

Grants the ability to read and update preferences.

Action	Access	Kind	Name
Read	User	Type	`UserPreferences`
Update	User	Mutation	`UserPreferencesUpdate`

Topic

Grants the ability to create, delete, merge, read, and update topics.

Action	Access	Kind	Name
Read	Instance	Type	`Topic`

Integrations resources

Integration Exclusion

Grants the ability to create and delete integration exclusions.

Action	Access	Kind	Name
Create	Instance	Mutation	`IntegrationExclusionCreate`
Delete	Instance	Mutation	`IntegrationExclusionDelete`

Jira Import

Grants the ability to create Jira imports.

Action	Access	Kind	Name
Create	Project	Mutation	`JiraImportStart`
Create	Project	Mutation	`JiraImportUsers`

Monitoring resources

Alert

Grants the ability to update alerts.

Action	Access	Kind	Name
Update	Project	Mutation	`AlertSetAssignees`
Update	Project	Mutation	`UpdateAlertStatus`

Escalation Policy

Grants the ability to create, delete, read, and update escalation policies.

Action	Access	Kind	Name
Create	Project	Mutation	`EscalationPolicyCreate`
Delete	Project	Mutation	`EscalationPolicyDestroy`
Read	Project	Type	`EscalationPolicyType`
Update	Project	Mutation	`EscalationPolicyUpdate`

HTTP Integration

Grants the ability to create, delete, and update HTTP integrations.

Action	Access	Kind	Name
Create	Project	Mutation	`HttpIntegrationCreate`
Create	Project	Mutation	`PrometheusIntegrationCreate`
Delete	Project	Mutation	`HttpIntegrationDestroy`
Update	Project	Mutation	`HttpIntegrationResetToken`
Update	Project	Mutation	`HttpIntegrationUpdate`
Update	Project	Mutation	`PrometheusIntegrationResetToken`
Update	Project	Mutation	`PrometheusIntegrationUpdate`

Issuable Resource Link

Grants the ability to create and delete issuable resource links.

Action	Access	Kind	Name
Create	Project	Mutation	`IssuableResourceLinkCreate`
Delete	Project	Mutation	`IssuableResourceLinkDestroy`

On-call Schedule

Grants the ability to create, delete, and update on-call schedules.

Action	Access	Kind	Name
Create	Project	Mutation	`OncallRotationCreate`
Create	Project	Mutation	`OncallScheduleCreate`
Delete	Project	Mutation	`OncallRotationDestroy`
Delete	Project	Mutation	`OncallScheduleDestroy`
Update	Project	Mutation	`OncallRotationUpdate`
Update	Project	Mutation	`OncallScheduleUpdate`

Sidekiq Job

Grants the ability to drop Sidekiq jobs.

Action	Access	Kind	Name
Drop	Instance	Mutation	`AdminSidekiqQueuesDeleteJobs`

Timeline Event

Grants the ability to create, delete, and update timeline events.

Action	Access	Kind	Name
Create	Project	Mutation	`TimelineEventCreate`
Create	Project	Mutation	`TimelineEventPromoteFromNote`
Create	Project	Mutation	`TimelineEventTagCreate`
Delete	Project	Mutation	`TimelineEventDestroy`
Update	Project	Mutation	`TimelineEventUpdate`

Notifications resources

Todo

Grants the ability to create, delete, read, and update todos.

Action	Access	Kind	Name
Create	Project	Mutation	`AlertTodoCreate`
Create	Project	Mutation	`TodoCreate`
Create	Group	Mutation	`TodoCreate`
Delete	User	Mutation	`TodoDeleteAllDone`
Delete	User	Mutation	`TodoDeleteMany`
Read	User	Type	`Todo`
Update	User	Mutation	`TodoMarkDone`
Update	User	Mutation	`TodoResolveMany`
Update	User	Mutation	`TodoRestore`
Update	User	Mutation	`TodoRestoreMany`
Update	User	Mutation	`TodoSnooze`
Update	User	Mutation	`TodoSnoozeMany`
Update	User	Mutation	`TodoUnSnooze`
Update	User	Mutation	`TodoUnsnoozeMany`
Update	User	Mutation	`TodosMarkAllDone`

Organizations resources

Organization

Grants the ability to create, delete, read, restore, and update organizations.

Action	Access	Kind	Name
Create	Instance	Mutation	`OrganizationCreate`
Delete	Instance	Mutation	`OrganizationDelete`
Read	Instance	Type	`Organization`
Read	Instance	Type	`OrganizationUser`
Restore	Instance	Mutation	`OrganizationRestore`
Update	Instance	Mutation	`OrganizationConfirm`
Update	Instance	Mutation	`OrganizationUpdate`
Update	Instance	Mutation	`OrganizationUserUpdate`

Packages and Registry resources

Container Registry Protection Tag Rule

Grants the ability to create, delete, read, and update container registry protection tag rules.

Action	Access	Kind	Name
Create	Project	Mutation	`createContainerProtectionTagRule`
Delete	Project	Mutation	`DeleteContainerProtectionTagRule`
Update	Project	Mutation	`UpdateContainerProtectionTagRule`

Container Repository

Grants the ability to delete and read container repositories.

Action	Access	Kind	Name
Delete	Project	Mutation	`DestroyContainerRepository`
Delete	Project	Mutation	`DestroyContainerRepositoryTags`

Container Repository Protection Rule

Grants the ability to create, delete, read, and update container repository protection rules.

Action	Access	Kind	Name
Create	Project	Mutation	`CreateContainerProtectionRepositoryRule`
Delete	Project	Mutation	`DeleteContainerProtectionRepositoryRule`
Update	Project	Mutation	`UpdateContainerProtectionRepositoryRule`

Dependency Proxy

Grants the ability to read and update dependency proxies.

Action	Access	Kind	Name
Update	Group	Mutation	`UpdateDependencyProxyImageTtlGroupPolicy`
Update	Group	Mutation	`UpdateDependencyProxySettings`

Package

Grants the ability to create, delete, read, and update packages.

Action	Access	Kind	Name
Create	Project	Mutation	`CreatePackagesProtectionRule`
Delete	Project	Mutation	`DeletePackagesProtectionRule`
Delete	Project	Mutation	`DestroyPackage`
Delete	Project	Mutation	`DestroyPackageFile`
Delete	Project	Mutation	`DestroyPackageFiles`
Update	Project	Mutation	`UpdatePackagesCleanupPolicy`
Update	Project	Mutation	`UpdatePackagesProtectionRule`

Product Analytics resources

Custom Dashboard

Grants the ability to create, delete, and update custom dashboards.

Action	Access	Kind	Name
Create	Instance	Mutation	`CreateCustomDashboard`
Delete	Instance	Mutation	`DeleteCustomDashboard`
Update	Instance	Mutation	`UpdateCustomDashboard`

DevOps Adoption

Grants the ability to enable DevOps adoption for namespaces.

Action	Access	Kind	Name
Enable	Group	Mutation	`EnableDevopsAdoptionNamespace`

Project Features resources

Badge

Grants the ability to create, delete, read, and update badges.

Action	Access	Kind	Name
Read	Instance	Type	`OrganizationUserBadge`

Cycle Analytics

Grants the ability to read cycle analytics.

Action	Access	Kind	Name
Read	Project	Field	`Analytics.mergeRequests`
Read	Group	Field	`Analytics.mergeRequests`

Release

Grants the ability to create, delete, read, and update releases.

Action	Access	Kind	Name
Create	Project	Mutation	`ReleaseAssetLinkCreate`
Create	Project	Mutation	`ReleaseCreate`
Delete	Project	Mutation	`ReleaseDelete`
Update	Project	Mutation	`ReleaseUpdate`

Release Link

Grants the ability to create, delete, read, and update release links.

Action	Access	Kind	Name
Delete	Project	Mutation	`ReleaseAssetLinkDelete`
Update	Project	Mutation	`ReleaseAssetLinkUpdate`

Snippet

Grants the ability to create, delete, read, and update snippets.

Action	Access	Kind	Name
Create	Project	Mutation	`CreateSnippet`
Create	User	Mutation	`CreateSnippet`
Delete	Project	Mutation	`DestroySnippet`
Delete	User	Mutation	`DestroySnippet`
Update	Project	Mutation	`UpdateSnippet`
Update	User	Mutation	`UpdateSnippet`

Project Model Registry and Experiments resources

Model Version

Grants the ability to create, delete, read, and update model versions.

Action	Access	Kind	Name
Create	Project	Mutation	`MlModelVersionCreate`
Delete	Project	Mutation	`MlModelVersionDelete`
Update	Project	Mutation	`MlModelVersionEdit`

Project Planning resources

Custom Attribute

Grants the ability to delete, read, and update custom attributes.

Action	Access	Kind	Name
Delete	Project	Mutation	`DeleteProjectCustomAttribute`
Delete	Group	Mutation	`DeleteGroupCustomAttribute`
Update	Project	Mutation	`ProjectCustomAttributeSet`
Update	Group	Mutation	`SetGroupCustomAttribute`

Design

Grants the ability to create, delete, and update designs.

Action	Access	Kind	Name
Create	Project	Mutation	`DesignManagementUpload`
Delete	Project	Mutation	`DesignManagementDelete`
Update	Project	Mutation	`DesignManagementMove`
Update	Project	Mutation	`DesignManagementUpdate`

Label

Grants the ability to create, delete, promote, read, subscribe, and update labels.

Action	Access	Kind	Name
Create	Project	Mutation	`LabelCreate`
Create	Group	Mutation	`LabelCreate`
Read	Project	Type	`Label`
Read	Group	Type	`Label`
Update	Project	Mutation	`LabelUpdate`
Update	Group	Mutation	`LabelUpdate`

Work Item

Grants the ability to create, delete, read, and update work items such as epics and issues.

Action	Access	Kind	Name
Create ¹	Project	Mutation	`CreateAlertIssue`
Create	Project	Mutation	`CreateDiffNote`
Create	Project	Mutation	`CreateDiscussion`
Create	Project	Mutation	`CreateImageDiffNote`
Create	Project	Mutation	`CreateIssue`
Create	Project	Mutation	`CreateLatestDiffNote`
Create	Project	Mutation	`CreateNote`
Create	Project	Mutation	`WorkItemCreate`
Create	Project	Field	`EpicIssue.createNoteEmail`
Create	Project	Field	`Issue.createNoteEmail`
Create	Project	Field	`WorkItem.createNoteEmail`
Create	Group	Mutation	`CreateDiffNote`
Create	Group	Mutation	`CreateDiscussion`
Create	Group	Mutation	`CreateImageDiffNote`
Create	Group	Mutation	`CreateLatestDiffNote`
Create	Group	Mutation	`CreateNote`
Create	Group	Mutation	`IterationCadenceCreate`
Create	Group	Mutation	`WorkItemCreate`
Delete	Project	Mutation	`DestroyNote`
Delete	Project	Mutation	`WorkItemDelete`
Delete	Group	Mutation	`DestroyNote`
Delete	Group	Mutation	`IterationCadenceDestroy`
Delete	Group	Mutation	`IterationDelete`
Delete	Group	Mutation	`WorkItemDelete`
Read	Project	Type	`Board`
Read	Project	Type	`EpicIssue`
Read	Project	Type	`Issue`
Read	Project	Type	`Milestone`
Read	Project	Type	`Note`
Read	Project	Type	`WorkItem`
Read	Group	Type	`Board`
Read	Group	Type	`BoardEpic`
Read	Group	Type	`Epic`
Read	Group	Type	`Iteration`
Read	Group	Type	`IterationCadence`
Read	Group	Type	`Milestone`
Read	Group	Type	`Note`
Read	Group	Type	`WorkItemMoveTarget`
Update	Project	Mutation	`DiscussionToggleResolve`
Update	Project	Mutation	`IssueLinkAlerts`
Update	Project	Mutation	`IssueMove`
Update	Project	Mutation	`IssueSetAssignees`
Update	Project	Mutation	`IssueSetConfidential`
Update	Project	Mutation	`IssueSetCrmContacts`
Update	Project	Mutation	`IssueSetDueDate`
Update	Project	Mutation	`IssueSetEpic`
Update	Project	Mutation	`IssueSetEscalationPolicy`
Update	Project	Mutation	`IssueSetEscalationStatus`
Update	Project	Mutation	`IssueSetIteration`
Update	Project	Mutation	`IssueSetLocked`
Update	Project	Mutation	`IssueSetSeverity`
Update	Project	Mutation	`IssueSetWeight`
Update	Project	Mutation	`IssueUnlinkAlert`
Update	Project	Mutation	`NoteConvertToThread`
Update	Project	Mutation	`RepositionImageDiffNote`
Update	Project	Mutation	`UpdateImageDiffNote`
Update	Project	Mutation	`UpdateIssue`
Update	Project	Mutation	`UpdateNote`
Update	Project	Mutation	`WorkItemAddClosingMergeRequest`
Update	Project	Mutation	`WorkItemConvert`
Update	Project	Mutation	`WorkItemCreateFromTask`
Update	Project	Mutation	`WorkItemEnableAiPlanning`
Update	Project	Mutation	`WorkItemUpdate`
Update	Project	Mutation	`workItemsReorder`
Update	Group	Mutation	`IterationCadenceUpdate`
Update	Group	Mutation	`UpdateImageDiffNote`
Update	Group	Mutation	`UpdateIteration`
Update	Group	Mutation	`UpdateNote`
Update	Group	Mutation	`WorkItemAddClosingMergeRequest`
Update	Group	Mutation	`WorkItemConvert`
Update	Group	Mutation	`WorkItemEnableAiPlanning`
Update	Group	Mutation	`WorkItemUpdate`
Update	Group	Mutation	`workItemsReorder`

¹ Also requires the Update Alert permission.

Projects resources

Markdown Upload

Grants the ability to create, delete, and read Markdown uploads.

Action	Access	Kind	Name
Create	Project	Mutation	`UploadCreate`
Create	Group	Mutation	`UploadCreate`
Delete	Project	Mutation	`UploadDelete`
Delete	Group	Mutation	`UploadDelete`

Page

Grants the ability to delete, read, and update pages.

Action	Access	Kind	Name
Delete	Project	Mutation	`DeletePagesDeployment`
Delete	Project	Mutation	`RestorePagesDeployment`
Read	Project	Type	`PagesDeployment`
Update	Project	Mutation	`PagesMarkOnboardingComplete`
Update	Project	Mutation	`SetPagesForceHttps`
Update	Project	Mutation	`SetPagesUseUniqueDomain`

Project

Grants the ability to archive, create, delete, fork, read, share, transfer, and update projects.

Action	Access	Kind	Name
Read	Project	Type	`Project`
Read	Project	Type	`RepositoryLanguage`
Transfer	Project	Mutation	`ProjectTransfer`
Update	Project	Mutation	`ProjectSettingsUpdate`
Update	Project	Mutation	`StarProject`

Repository resources

Approval Rule

Grants the ability to create, delete, read, and update approval rules.

Action	Access	Kind	Name
Create	Project	Mutation	`branchRuleApprovalProjectRuleCreate`
Delete	Project	Mutation	`approvalProjectRuleDelete`
Read	Project	Type	`ApprovalProjectRule`
Read	Project	Type	`ApprovalRule`
Update	Project	Mutation	`MergeRequestUpdateApprovalRule`
Update	Project	Mutation	`approvalProjectRuleUpdate`

Branch

Grants the ability to create, delete, protect, and read branches.

Action	Access	Kind	Name
Create	Project	Mutation	`CreateBranch`
Delete	Project	Mutation	`BranchDelete`
Read	Project	Type	`Branch`

Branch Rule

Grants the ability to create, delete, and update branch rules.

Action	Access	Kind	Name
Create	Project	Mutation	`BranchRuleCreate`
Delete	Project	Mutation	`BranchRuleDelete`
Delete	Project	Mutation	`BranchRuleSquashOptionDelete`
Update	Project	Mutation	`BranchRuleSquashOptionUpdate`
Update	Project	Mutation	`BranchRuleUpdate`

Code

Grants the ability to download, push, and read code via Git.

Action	Access	Kind	Name
Push	Project	Mutation	`CommitCreate`
Push	Project	Mutation	`ProjectSyncFork`
Read	Project	Type	`Commit`
Read	Project	Type	`Repository`

Merge Request

Grants the ability to approve, create, delete, merge, read, subscribe, and update merge requests.

Action	Access	Kind	Name
Create	Project	Mutation	`MergeRequestCreate`
Merge	Project	Mutation	`MergeRequestAccept`
Read	Project	Type	`MergeRequest`
Read	Project	Type	`MergeRequestApprovalState`
Read	Project	Type	`MergeRequestWorkItemRelation`
Subscribe	Project	Mutation	`MergeRequestSetSubscription`
Update	Project	Mutation	`DismissPolicyViolations`
Update	Project	Mutation	`MergeRequestBypassSecurityPolicy`
Update	Project	Mutation	`MergeRequestCreateWorkItemRelations`
Update	Project	Mutation	`MergeRequestDestroyRequestedChanges`
Update	Project	Mutation	`MergeRequestDestroyWorkItemRelations`
Update	Project	Mutation	`MergeRequestRequestChanges`
Update	Project	Mutation	`MergeRequestResyncSecurityPolicies`
Update	Project	Mutation	`MergeRequestReviewerRereview`
Update	Project	Mutation	`MergeRequestSetAssignees`
Update	Project	Mutation	`MergeRequestSetBlockingMergeRequests`
Update	Project	Mutation	`MergeRequestSetDraft`
Update	Project	Mutation	`MergeRequestSetLabels`
Update	Project	Mutation	`MergeRequestSetLocked`
Update	Project	Mutation	`MergeRequestSetMilestone`
Update	Project	Mutation	`MergeRequestSetReviewers`
Update	Project	Mutation	`MergeRequestUpdate`

Path Lock

Grants the ability to create path locks.

Action	Access	Kind	Name
Create	Project	Mutation	`ProjectSetLocked`

Push Rule

Grants the ability to create, delete, read, and update push rules.

Action	Access	Kind	Name
Read	Project	Type	`PushRules`

Repository

Grants the ability to create, delete, read, and update repositories.

Action	Access	Kind	Name
Read	Project	Type	`Blob`
Read	Project	Type	`RepositoryBlob`
Read	Project	Type	`Tree`

Repository History

Grants the ability to rewrite repository histories.

Action	Access	Kind	Name
Rewrite	Project	Mutation	`projectBlobsRemove`
Rewrite	Project	Mutation	`projectTextReplace`

Repository Tag

Grants the ability to create, delete, and read repository tags.

Action	Access	Kind	Name
Create	Project	Mutation	`TagCreate`
Delete	Project	Mutation	`TagDelete`
Read	Project	Type	`Tag`

Target Branch Rule

Grants the ability to create and delete target branch rules.

Action	Access	Kind	Name
Create	Project	Mutation	`ProjectTargetBranchRuleCreate`
Delete	Project	Mutation	`ProjectTargetBranchRuleDestroy`

Secrets Management resources

Secrets Manager Enrollment

Grants the ability to read secrets manager enrollments.

Action	Access	Kind	Name
Read	Instance	Type	`SecretsManagerInstanceEnrollment`

Subscription and Licensing resources

Add On Assignment

Grants the ability to create and delete add on assignments.

Action	Access	Kind	Name
Create	Group	Mutation	`UserAddOnAssignmentBulkCreate`
Create	Group	Mutation	`UserAddOnAssignmentCreate`
Create	Instance	Mutation	`UserAddOnAssignmentBulkCreate`
Create	Instance	Mutation	`UserAddOnAssignmentCreate`
Delete	Group	Mutation	`UserAddOnAssignmentBulkRemove`
Delete	Group	Mutation	`UserAddOnAssignmentRemove`
Delete	Instance	Mutation	`UserAddOnAssignmentBulkRemove`
Delete	Instance	Mutation	`UserAddOnAssignmentRemove`

GitLab Subscription

Grants the ability to create, read, and update GitLab subscriptions.

Action	Access	Kind	Name
Update	Instance	Mutation	`GitlabSubscriptionActivate`

Member Approval

Grants the ability to update member approvals.

Action	Access	Kind	Name
Update	Instance	Mutation	`ProcessUserBillablePromotionRequest`

Subscription Usage Cap

Grants the ability to update subscription usage caps.

Action	Access	Kind	Name
Update	Group	Mutation	`UpsertFlatUserCap`
Update	Group	Mutation	`UpsertUserBudgetCapOverrides`
Update	Instance	Mutation	`UpsertFlatUserCap`
Update	Instance	Mutation	`UpsertUserBudgetCapOverrides`

System Access resources

Email

Grants the ability to create, delete, and read emails.

Action	Access	Kind	Name
Read	User	Type	`Email`

Job Token Scope

Grants the ability to read and update job token scopes.

Action	Access	Kind	Name
Update	Project	Mutation	`CiJobTokenScopeUpdatePolicies`

Job Token Scope Allowlist

Grants the ability to create, delete, and read job token scope allowlists.

Action	Access	Kind	Name
Create	Project	Mutation	`CiJobTokenScopeAddGroupOrProject`
Create	Project	Mutation	`CiJobTokenScopeAddProject`
Delete	Project	Mutation	`CiJobTokenScopeRemoveGroup`
Delete	Project	Mutation	`CiJobTokenScopeRemoveProject`

Member

Grants the ability to create, delete, read, and update members.

Action	Access	Kind	Name
Read	Project	Type	`ProjectMember`
Read	Group	Type	`GroupMember`
Read	Group	Mutation	`GroupMembersExport`
Update	Project	Mutation	`ProjectMemberBulkUpdate`
Update	Group	Mutation	`GroupMemberBulkUpdate`

Metadata

Grants the ability to read instance metadata.

Action	Access	Kind	Name
Read	Instance	Type	`GitlabInstanceFeatureFlag`
Read	Instance	Type	`Kas`
Read	Instance	Type	`Metadata`

Personal Access Token

Grants the ability to create, read, revoke, and rotate personal access tokens.

Action	Access	Kind	Name
Create	User	Mutation	`PersonalAccessTokenCreate`
Revoke	User	Mutation	`PersonalAccessTokenRevoke`
Rotate	User	Mutation	`PersonalAccessTokenRotate`

User

Grants the ability to activate, approve, ban, block, create, deactivate, delete, disable two factor, follow, read, reject, unban, unblock, unfollow, and update users.

Action	Access	Kind	Name
Read	User	Type	`AddOnUser`
Read	User	Type	`AutocompletedUser`
Read	User	Type	`CurrentUser`
Read	User	Type	`MergeRequestAssignee`
Read	User	Type	`MergeRequestAuthor`
Read	User	Type	`MergeRequestParticipant`
Read	User	Type	`MergeRequestReviewer`
Read	User	Type	`UserCore`

Value Stream resources

Value Stream

Grants the ability to create, delete, and update value streams.

Action	Access	Kind	Name
Create	Project	Mutation	`ValueStreamCreate`
Create	Group	Mutation	`ValueStreamCreate`
Delete	Project	Mutation	`ValueStreamDestroy`
Delete	Group	Mutation	`ValueStreamDestroy`
Update	Project	Mutation	`ValueStreamUpdate`
Update	Group	Mutation	`ValueStreamUpdate`

Wiki resources

Wiki

Grants the ability to create, delete, read, subscribe, and update wikis.

Action	Access	Kind	Name
Subscribe	Project	Mutation	`WikiPageSubscribe`

Workspace resources

Cluster Agent Mapping

Grants the ability to create and delete cluster agent mappings.

Action	Access	Kind	Name
Create	Group	Mutation	`NamespaceCreateRemoteDevelopmentClusterAgentMapping`
Create	Instance	Mutation	`OrganizationCreateClusterAgentMapping`
Delete	Group	Mutation	`NamespaceDeleteRemoteDevelopmentClusterAgentMapping`
Delete	Instance	Mutation	`OrganizationDeleteClusterAgentMapping`

Workspace

Grants the ability to create and update workspaces.

Action	Access	Kind	Name
Create	Project	Mutation	`WorkspaceCreate`
Update	Project	Mutation	`WorkspaceUpdate`