Fine-grained permissions for GraphQL API

<!-- This documentation is auto-generated by a Rake task. Please do not edit this file directly. To update this file, run: `bundle exec rake gitlab:permissions:graphql:compile_docs`. To make changes to the output of the Rake task, edit `tooling/authz/permissions/docs/templates/granular_pat_graphql_fields.md.erb`. -->

{{< details >}}

• Tier: Free, Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

{{< /details >}}

{{< history >}}

• Generally available in GitLab 19.2.

{{< /history >}}

A fine-grained personal access token can access only the resources and permissions you grant it. To use one with the GraphQL API, create a token and define its scope. For more information, see fine-grained personal access tokens.

Available fine-grained permissions

Fine-grained personal access tokens can access the following GraphQL types, mutations, and fields:

Application Security resources

Dependency

Grants the ability to read dependencies.

Action	Access	Kind	Name
Read	Project	Type	DependencyLocation

Pipeline Execution Project Schedule

Grants the ability to read pipeline execution project schedules.

Action	Access	Kind	Name
Read	Project	Type	PipelineExecutionProjectSchedule

Secrets Manager

Grants the ability to read secrets managers.

Action	Access	Kind	Name
Read	Project	Type	ProjectSecretsManager
Read	Group	Type	GroupSecretsManager
Read	Group	Type	SecretsManagerEntitlement
Read	Group	Mutation	SecretsManagerStartTrial

Vulnerability

Grants the ability to create, read, and update vulnerabilities.

Action	Access	Kind	Name
Create	Project	Mutation	VulnerabilityCreate
Read	Project	Type	CountableVulnerability
Read	Project	Type	Vulnerability
Read	Project	Type	VulnerabilityScanner
Read	Project	Field	MergeRequest.findingReportsComparer
Update	Project	Mutation	VulnerabilityAutoRemediation
Update	Project	Mutation	VulnerabilityConfirm
Update	Project	Mutation	VulnerabilityDismiss
Update	Project	Mutation	VulnerabilityResolve
Update	Project	Mutation	VulnerabilityRevertToDetected

CI/CD resources

Catalog Resource

Grants the ability to create and delete CI catalog resources.

Action	Access	Kind	Name
Create	Project	Mutation	CatalogResourcesCreate
Delete	Project	Mutation	CatalogResourcesDestroy

CD Application

Grants the ability to create, read, and update continuous deployment applications.

Action	Access	Kind	Name
Create	Instance	Mutation	CdApplicationCreate
Read	Instance	Type	CdApplication
Update	Instance	Mutation	CdApplicationUpdate

CD Application Flow Definition

Grants the ability to create and read continuous deployment application flow definitions.

Action	Access	Kind	Name
Create	Instance	Mutation	CdApplicationFlowDefinitionCreate
Read	Instance	Type	CdApplicationFlowDefinition

CD Application Link

Grants the ability to create and read continuous deployment application links.

Action	Access	Kind	Name
Create	Instance	Mutation	CdApplicationLinkCreate
Read	Instance	Type	CdApplicationLink

CD Artifact Source

Grants the ability to create and read continuous deployment artifact sources.

Action	Access	Kind	Name
Create	Instance	Mutation	CdArtifactSourceCreate
Read	Instance	Type	CdArtifactSource
Read	Instance	Type	CdVersion

CD Environment

Grants the ability to create, read, and update continuous deployment environments.

Action	Access	Kind	Name
Create	Instance	Mutation	CdEnvironmentCreate
Read	Instance	Type	CdEnvironment
Read	Instance	Type	CdEnvironmentDriverBinding
Update	Instance	Mutation	CdEnvironmentUpdate

CD Rollout

Grants the ability to create and read CD rollouts.

Action	Access	Kind	Name
Create	Instance	Mutation	CdRolloutCreate
Read	Instance	Type	CdDeployment
Read	Instance	Type	CdDeploymentTransition
Read	Instance	Type	CdRollout
Read	Instance	Type	CdRolloutEnvironment
Read	Instance	Type	CdRolloutTransition

CD Rollout Gate

Grants the ability to resolve CD rollout gates.

Action	Access	Kind	Name
Resolve	Instance	Mutation	CdRolloutGateResolve

CD Service

Grants the ability to create, read, and update continuous deployment services.

Action	Access	Kind	Name
Create	Instance	Mutation	CdServiceCreate
Read	Instance	Type	CdService
Read	Instance	Type	CdServiceEnvironmentHealth
Update	Instance	Mutation	CdServiceUpdate

CD Version Set

Grants the ability to create and read continuous deployment version sets.

Action	Access	Kind	Name
Create	Instance	Mutation	CdVersionSetCreate
Read	Instance	Type	CdVersionSet
Read	Instance	Type	CdVersionSetEntry

CI Config

Grants the ability to read and validate CI/CD configuration.

Action	Access	Kind	Name
Validate	Project	Mutation	CiLint

CI/CD Setting

Grants the ability to update CI/CD settings.

Action	Access	Kind	Name
Update	Project	Mutation	ProjectCiCdSettingsUpdate
Update	Group	Mutation	SafeDisablePipelineVariables

Cluster Agent

Grants the ability to create, delete, and read cluster agents.

Action	Access	Kind	Name
Create	Project	Mutation	CreateClusterAgent
Delete	Project	Mutation	ClusterAgentDelete
Read	Project	Type	ClusterAgent

Cluster Agent Token

Grants the ability to create, read, and revoke cluster agent tokens.

Action	Access	Kind	Name
Create	Project	Mutation	ClusterAgentTokenCreate

Cluster Agent URL Configuration

Grants the ability to create, delete, and read cluster agent URL configurations.

Action	Access	Kind	Name
Create	Project	Mutation	ClusterAgentUrlConfigurationCreate
Delete	Project	Mutation	ClusterAgentUrlConfigurationDelete

Deployment

Grants the ability to approve, create, delete, read, and update deployments.

Action	Access	Kind	Name
Approve	Project	Mutation	ApproveDeployment

Environment

Grants the ability to create, delete, read, stop, and update environments.

Action	Access	Kind	Name
Create	Project	Mutation	EnvironmentCreate
Delete	Project	Mutation	EnvironmentDelete
Read	Project	Type	Environment
Stop	Project	Mutation	EnvironmentStop
Update	Project	Mutation	EnvironmentUpdate

Freeze Period

Grants the ability to create, delete, read, and update freeze periods.

Action	Access	Kind	Name
Read	Project	Type	CiFreezePeriod

Job

Grants the ability to delete, read, run, and update jobs.

Action	Access	Kind	Name
Read	Project	Type	CiJob
Run	Project	Mutation	JobPlay
Run	Project	Mutation	JobRetry
Update	Project	Mutation	JobCancel
Update	Project	Mutation	JobUnschedule

Job Artifact

Grants the ability to delete, read, and update job artifacts.

Action	Access	Kind	Name
Delete	Project	Mutation	ArtifactDestroy
Delete	Project	Mutation	BulkDestroyJobArtifacts
Delete	Project	Mutation	JobArtifactsDestroy
Read	Project	Type	CiJobArtifact

Pipeline

Grants the ability to create, delete, read, and update pipelines.

Action	Access	Kind	Name
Create	Project	Mutation	PipelineCreate
Delete	Project	Mutation	PipelineDestroy
Read	Project	Type	CiStage
Read	Project	Type	Pipeline
Update	Project	Mutation	PipelineCancel
Update	Project	Mutation	PipelineRetry

Pipeline Schedule

Grants the ability to create, delete, read, and update pipeline schedules.

Action	Access	Kind	Name
Create	Project	Mutation	PipelineScheduleCreate
Delete	Project	Mutation	PipelineScheduleDelete
Read	Project	Type	PipelineSchedule
Update	Project	Mutation	PipelineSchedulePlay
Update	Project	Mutation	PipelineScheduleTakeOwnership
Update	Project	Mutation	PipelineScheduleUpdate

Runner

Grants the ability to assign, create, delete, read, and update runners.

Action	Access	Kind	Name
Assign	Project	Mutation	RunnerAssignToProject
Assign	Project	Mutation	RunnerUnassignFromProject
Create	Project	Mutation	RunnerCreate
Create	Group	Mutation	RunnerCreate
Create	Instance	Mutation	RunnerCreate
Delete	Project	Mutation	RunnerDelete
Delete	Group	Mutation	RunnerDelete
Delete	Instance	Mutation	RunnerDelete
Read	Project	Type	CiRunner
Read	Group	Type	CiRunner
Read	Instance	Type	CiRunner
Update	Project	Mutation	RunnerCacheClear
Update	Project	Mutation	RunnerUpdate
Update	Group	Mutation	RunnerUpdate
Update	Instance	Mutation	RunnerUpdate

Terraform State

Grants the ability to create, delete, lock, read, and update Terraform state.

Action	Access	Kind	Name
Delete	Project	Mutation	TerraformStateDelete
Lock	Project	Mutation	TerraformStateLock
Lock	Project	Mutation	TerraformStateUnlock
Read	Project	Type	TerraformState
Read	Project	Type	TerraformStateProtectionRule
Read	Project	Type	TerraformStateVersion
Update	Project	Mutation	UpdateTerraformStateProtectionRule

Terraform State Protection Rule

Grants the ability to create, delete, and update Terraform state protection rules.

Action	Access	Kind	Name
Create	Project	Mutation	CreateTerraformStateProtectionRule
Delete	Project	Mutation	DeleteTerraformStateProtectionRule

Trigger

Grants the ability to create, delete, read, and update triggers.

Action	Access	Kind	Name
Create	Project	Mutation	PipelineTriggerCreate
Delete	Project	Mutation	PipelineTriggerDelete
Read	Project	Type	PipelineTrigger
Update	Project	Mutation	PipelineTriggerUpdate

Duo resources

AI catalog item

Grants the ability to restore AI catalog items.

Action	Access	Kind	Name
Restore	Project	Mutation	AiCatalogItemVersionRestore

AI tool rule

Grants the ability to read and update AI tool rules, which control per-tool approval (Allow, Ask, Deny) for the Duo Agent Platform.

Action	Access	Kind	Name
Read	Group	Field	Query.aiToolRules
Update	Group	Mutation	BulkUpdateAiToolRules
Update	Group	Mutation	UpdateAiToolRule

Duo Workflow

Grants the ability to create, read, resume, and update duo workflows.

Action	Access	Kind	Name
Read	User	Type	DuoWorkflowWorkItemLink
Update	User	Mutation	UpdateDuoWorkflowAgentPrivileges

Flows Metadata

Grants the ability to read flows metadata.

Action	Access	Kind	Name
Read	Project	Type	AiFlowsMetadata
Read	Group	Type	AiFlowsMetadata
Read	Instance	Type	AiFlowsMetadata

Model Selection Allowlist

Grants the ability to read and update model selection allowlists.

Action	Access	Kind	Name
Read	Group	Type	AiModelSelectionAllowList
Read	Group	Type	AiModelSelectionAllowListModel
Read	Instance	Type	AiModelSelectionAllowList
Read	Instance	Type	AiModelSelectionAllowListModel
Update	Group	Mutation	AiModelSelectionNamespaceModelAllowlistUpdate
Update	Instance	Mutation	AiFeatureSettingModelAllowlistUpdate

Groups resources

Admin Member Role

Grants the ability to create, delete, read, and update admin member roles.

Action	Access	Kind	Name
Create	Instance	Mutation	MemberRoleAdminCreate
Delete	Instance	Mutation	MemberRoleAdminDelete
Read	Instance	Type	AdminMemberRole
Update	Instance	Mutation	MemberRoleAdminUpdate

Group

Grants the ability to archive, create, delete, read, share, transfer, and update groups.

Action	Access	Kind	Name
Read	Group	Type	Group
Update	Group	Mutation	GroupUpdate

LDAP Admin Role Link

Grants the ability to create, delete, and read LDAP admin role links

Action	Access	Kind	Name
Create	Instance	Mutation	AdminRolesLdapSync
Create	Instance	Mutation	LdapAdminRoleLinkCreate
Delete	Instance	Mutation	LdapAdminRoleLinkDestroy
Read	Instance	Type	LdapAdminRoleLink

Member Role

Grants the ability to create, delete, and read member roles.

Action	Access	Kind	Name
Create	Group	Mutation	MemberRoleCreate
Create	Instance	Mutation	MemberRoleCreate

Preference

Grants the ability to read and update preferences.

Action	Access	Kind	Name
Read	User	Type	UserPreferences
Update	User	Mutation	UserPreferencesUpdate

Topic

Grants the ability to create, delete, merge, read, and update topics.

Action	Access	Kind	Name
Read	Instance	Type	Topic

Monitoring resources

Escalation Policy

Grants the ability to read escalation policies.

Action	Access	Kind	Name
Read	Project	Type	EscalationPolicyType

Notifications resources

Todo

Grants the ability to create, delete, read, and update todos.

Action	Access	Kind	Name
Create	Project	Mutation	TodoCreate
Create	Group	Mutation	TodoCreate
Delete	User	Mutation	TodoDeleteAllDone
Delete	User	Mutation	TodoDeleteMany
Read	User	Type	Todo
Update	User	Mutation	TodoMarkDone
Update	User	Mutation	TodoResolveMany
Update	User	Mutation	TodoRestore
Update	User	Mutation	TodoRestoreMany
Update	User	Mutation	TodoSnooze
Update	User	Mutation	TodoSnoozeMany
Update	User	Mutation	TodoUnSnooze
Update	User	Mutation	TodoUnsnoozeMany
Update	User	Mutation	TodosMarkAllDone

Organizations resources

Organization

Grants the ability to create, delete, read, and update organizations.

Action	Access	Kind	Name
Create	Instance	Mutation	OrganizationCreate
Delete	Instance	Mutation	OrganizationDelete
Read	Instance	Type	Organization
Read	Instance	Type	OrganizationUser
Update	Instance	Mutation	OrganizationConfirm
Update	Instance	Mutation	OrganizationUpdate
Update	Instance	Mutation	OrganizationUserUpdate

Packages and Registry resources

Container Registry Protection Tag Rule

Grants the ability to create, delete, read, and update container registry protection tag rules.

Action	Access	Kind	Name
Create	Project	Mutation	createContainerProtectionTagRule
Delete	Project	Mutation	DeleteContainerProtectionTagRule
Update	Project	Mutation	UpdateContainerProtectionTagRule

Container Repository

Grants the ability to delete and read container repositories.

Action	Access	Kind	Name
Delete	Project	Mutation	DestroyContainerRepository
Delete	Project	Mutation	DestroyContainerRepositoryTags

Container Repository Protection Rule

Grants the ability to create, delete, read, and update container repository protection rules.

Action	Access	Kind	Name
Create	Project	Mutation	CreateContainerProtectionRepositoryRule
Delete	Project	Mutation	DeleteContainerProtectionRepositoryRule
Update	Project	Mutation	UpdateContainerProtectionRepositoryRule

Dependency Proxy

Grants the ability to read and update dependency proxies.

Action	Access	Kind	Name
Update	Group	Mutation	UpdateDependencyProxyImageTtlGroupPolicy
Update	Group	Mutation	UpdateDependencyProxySettings

Package

Grants the ability to create, delete, read, and update packages.

Action	Access	Kind	Name
Create	Project	Mutation	CreatePackagesProtectionRule
Delete	Project	Mutation	DeletePackagesProtectionRule
Delete	Project	Mutation	DestroyPackage
Delete	Project	Mutation	DestroyPackageFile
Delete	Project	Mutation	DestroyPackageFiles
Update	Project	Mutation	UpdatePackagesCleanupPolicy
Update	Project	Mutation	UpdatePackagesProtectionRule

Project Features resources

Badge

Grants the ability to create, delete, read, and update badges.

Action	Access	Kind	Name
Read	Instance	Type	OrganizationUserBadge

Cycle Analytics

Grants the ability to read cycle analytics.

Action	Access	Kind	Name
Read	Project	Field	Analytics.mergeRequests
Read	Group	Field	Analytics.mergeRequests

Release

Grants the ability to create, delete, read, and update releases.

Action	Access	Kind	Name
Create	Project	Mutation	ReleaseAssetLinkCreate
Create	Project	Mutation	ReleaseCreate
Delete	Project	Mutation	ReleaseDelete
Update	Project	Mutation	ReleaseUpdate

Snippet

Grants the ability to create, delete, read, and update snippets.

Action	Access	Kind	Name
Create	Project	Mutation	CreateSnippet
Create	User	Mutation	CreateSnippet
Delete	Project	Mutation	DestroySnippet
Delete	User	Mutation	DestroySnippet
Update	Project	Mutation	UpdateSnippet
Update	User	Mutation	UpdateSnippet

Project Model Registry and Experiments resources

Model Version

Grants the ability to create, delete, read, and update model versions.

Action	Access	Kind	Name
Create	Project	Mutation	MlModelVersionCreate
Delete	Project	Mutation	MlModelVersionDelete
Update	Project	Mutation	MlModelVersionEdit

Project Planning resources

Custom Attribute

Grants the ability to delete, read, and update custom attributes.

Action	Access	Kind	Name
Delete	Project	Mutation	DeleteProjectCustomAttribute
Delete	Group	Mutation	DeleteGroupCustomAttribute
Update	Project	Mutation	ProjectCustomAttributeSet
Update	Group	Mutation	SetGroupCustomAttribute

Label

Grants the ability to create, delete, promote, read, subscribe, and update labels.

Action	Access	Kind	Name
Create	Project	Mutation	LabelCreate
Create	Group	Mutation	LabelCreate
Read	Project	Type	Label
Read	Group	Type	Label
Update	Project	Mutation	LabelUpdate
Update	Group	Mutation	LabelUpdate

Work Item

Grants the ability to create, delete, read, and update work items such as epics and issues.

Action	Access	Kind	Name
Create	Project	Mutation	CreateDiffNote
Create	Project	Mutation	CreateDiscussion
Create	Project	Mutation	CreateImageDiffNote
Create	Project	Mutation	CreateIssue
Create	Project	Mutation	CreateLatestDiffNote
Create	Project	Mutation	CreateNote
Create	Project	Mutation	WorkItemCreate
Create	Project	Field	EpicIssue.createNoteEmail
Create	Project	Field	Issue.createNoteEmail
Create	Project	Field	WorkItem.createNoteEmail
Create	Group	Mutation	CreateDiffNote
Create	Group	Mutation	CreateDiscussion
Create	Group	Mutation	CreateImageDiffNote
Create	Group	Mutation	CreateLatestDiffNote
Create	Group	Mutation	CreateNote
Create	Group	Mutation	IterationCadenceCreate
Create	Group	Mutation	WorkItemCreate
Delete	Project	Mutation	DestroyNote
Delete	Project	Mutation	WorkItemDelete
Delete	Group	Mutation	DestroyNote
Delete	Group	Mutation	IterationCadenceDestroy
Delete	Group	Mutation	IterationDelete
Delete	Group	Mutation	WorkItemDelete
Read	Project	Type	Board
Read	Project	Type	EpicIssue
Read	Project	Type	Issue
Read	Project	Type	Milestone
Read	Project	Type	Note
Read	Project	Type	WorkItem
Read	Group	Type	Board
Read	Group	Type	BoardEpic
Read	Group	Type	Epic
Read	Group	Type	Iteration
Read	Group	Type	IterationCadence
Read	Group	Type	Milestone
Read	Group	Type	Note
Read	Group	Type	WorkItemMoveTarget
Update	Project	Mutation	IssueLinkAlerts
Update	Project	Mutation	IssueMove
Update	Project	Mutation	IssueSetAssignees
Update	Project	Mutation	IssueSetConfidential
Update	Project	Mutation	IssueSetCrmContacts
Update	Project	Mutation	IssueSetDueDate
Update	Project	Mutation	IssueSetEpic
Update	Project	Mutation	IssueSetEscalationPolicy
Update	Project	Mutation	IssueSetEscalationStatus
Update	Project	Mutation	IssueSetIteration
Update	Project	Mutation	IssueSetLocked
Update	Project	Mutation	IssueSetSeverity
Update	Project	Mutation	IssueSetWeight
Update	Project	Mutation	IssueUnlinkAlert
Update	Project	Mutation	UpdateImageDiffNote
Update	Project	Mutation	UpdateIssue
Update	Project	Mutation	UpdateNote
Update	Project	Mutation	WorkItemAddClosingMergeRequest
Update	Project	Mutation	WorkItemConvert
Update	Project	Mutation	WorkItemCreateFromTask
Update	Project	Mutation	WorkItemUpdate
Update	Project	Mutation	workItemsReorder
Update	Group	Mutation	IterationCadenceUpdate
Update	Group	Mutation	UpdateImageDiffNote
Update	Group	Mutation	UpdateIteration
Update	Group	Mutation	UpdateNote
Update	Group	Mutation	WorkItemAddClosingMergeRequest
Update	Group	Mutation	WorkItemConvert
Update	Group	Mutation	WorkItemUpdate
Update	Group	Mutation	workItemsReorder

Projects resources

Markdown Upload

Grants the ability to create, delete, and read Markdown uploads.

Action	Access	Kind	Name
Create	Project	Mutation	UploadCreate
Create	Group	Mutation	UploadCreate
Delete	Project	Mutation	UploadDelete
Delete	Group	Mutation	UploadDelete

Page

Grants the ability to delete, read, and update pages.

Action	Access	Kind	Name
Delete	Project	Mutation	DeletePagesDeployment
Delete	Project	Mutation	RestorePagesDeployment
Read	Project	Type	PagesDeployment
Update	Project	Mutation	PagesMarkOnboardingComplete
Update	Project	Mutation	SetPagesForceHttps
Update	Project	Mutation	SetPagesUseUniqueDomain

Project

Grants the ability to archive, create, delete, fork, read, share, transfer, and update projects.

Action	Access	Kind	Name
Read	Project	Type	Project
Read	Project	Type	RepositoryLanguage
Update	Project	Mutation	ProjectSettingsUpdate
Update	Project	Mutation	StarProject

Repository resources

Approval Rule

Grants the ability to create, delete, read, and update approval rules.

Action	Access	Kind	Name
Create	Project	Mutation	branchRuleApprovalProjectRuleCreate
Delete	Project	Mutation	approvalProjectRuleDelete
Read	Project	Type	ApprovalProjectRule
Read	Project	Type	ApprovalRule
Update	Project	Mutation	MergeRequestUpdateApprovalRule
Update	Project	Mutation	approvalProjectRuleUpdate

Branch

Grants the ability to create, delete, protect, and read branches.

Action	Access	Kind	Name
Create	Project	Mutation	CreateBranch
Delete	Project	Mutation	BranchDelete
Read	Project	Type	Branch

Branch Rule

Grants the ability to create and update branch rules.

Action	Access	Kind	Name
Create	Project	Mutation	BranchRuleCreate
Update	Project	Mutation	BranchRuleUpdate

Code

Grants the ability to download, push, and read code via Git.

Action	Access	Kind	Name
Push	Project	Mutation	CommitCreate
Push	Project	Mutation	ProjectSyncFork
Read	Project	Type	Commit
Read	Project	Type	Repository

Merge Request

Grants the ability to approve, create, delete, merge, read, subscribe, and update merge requests.

Action	Access	Kind	Name
Create	Project	Mutation	MergeRequestCreate
Merge	Project	Mutation	MergeRequestAccept
Read	Project	Type	MergeRequest
Read	Project	Type	MergeRequestApprovalState
Read	Project	Type	MergeRequestWorkItemRelation
Update	Project	Mutation	DismissPolicyViolations
Update	Project	Mutation	MergeRequestBypassSecurityPolicy
Update	Project	Mutation	MergeRequestCreateWorkItemRelations
Update	Project	Mutation	MergeRequestDestroyRequestedChanges
Update	Project	Mutation	MergeRequestDestroyWorkItemRelations
Update	Project	Mutation	MergeRequestRequestChanges
Update	Project	Mutation	MergeRequestSetAssignees
Update	Project	Mutation	MergeRequestSetBlockingMergeRequests
Update	Project	Mutation	MergeRequestSetDraft
Update	Project	Mutation	MergeRequestSetLabels
Update	Project	Mutation	MergeRequestSetLocked
Update	Project	Mutation	MergeRequestSetMilestone
Update	Project	Mutation	MergeRequestSetReviewers
Update	Project	Mutation	MergeRequestUpdate

Push Rule

Grants the ability to create, delete, read, and update push rules.

Action	Access	Kind	Name
Read	Project	Type	PushRules

Repository

Grants the ability to create, delete, read, and update repositories.

Action	Access	Kind	Name
Read	Project	Type	Blob
Read	Project	Type	RepositoryBlob
Read	Project	Type	Tree

Repository Tag

Grants the ability to create, delete, and read repository tags.

Action	Access	Kind	Name
Create	Project	Mutation	TagCreate
Delete	Project	Mutation	TagDelete
Read	Project	Type	Tag

System Access resources

Email

Grants the ability to create, delete, and read emails.

Action	Access	Kind	Name
Read	User	Type	Email

Job Token Scope

Grants the ability to read and update job token scopes.

Action	Access	Kind	Name
Update	Project	Mutation	CiJobTokenScopeUpdatePolicies

Job Token Scope Allowlist

Grants the ability to create, delete, and read job token scope allowlists.

Action	Access	Kind	Name
Create	Project	Mutation	CiJobTokenScopeAddGroupOrProject
Create	Project	Mutation	CiJobTokenScopeAddProject
Delete	Project	Mutation	CiJobTokenScopeRemoveGroup
Delete	Project	Mutation	CiJobTokenScopeRemoveProject

Member

Grants the ability to create, delete, read, and update members.

Action	Access	Kind	Name
Read	Project	Type	ProjectMember
Read	Group	Type	GroupMember
Update	Project	Mutation	ProjectMemberBulkUpdate
Update	Group	Mutation	GroupMemberBulkUpdate

Metadata

Grants the ability to read instance metadata.

Action	Access	Kind	Name
Read	Instance	Type	GitlabInstanceFeatureFlag
Read	Instance	Type	Kas
Read	Instance	Type	Metadata

Personal Access Token

Grants the ability to create, read, revoke, and rotate personal access tokens.

Action	Access	Kind	Name
Create	User	Mutation	PersonalAccessTokenCreate
Revoke	User	Mutation	PersonalAccessTokenRevoke
Rotate	User	Mutation	PersonalAccessTokenRotate

User

Grants the ability to activate, approve, ban, block, create, deactivate, delete, disable two factor, follow, read, reject, unban, unblock, unfollow, and update users.

Action	Access	Kind	Name
Read	User	Type	AddOnUser
Read	User	Type	AutocompletedUser
Read	User	Type	CurrentUser
Read	User	Type	MergeRequestAssignee
Read	User	Type	MergeRequestAuthor
Read	User	Type	MergeRequestParticipant
Read	User	Type	MergeRequestReviewer
Read	User	Type	UserCore