Fine-grained permissions for GraphQL API

<!-- This documentation is auto-generated by a Rake task. Please do not edit this file directly. To update this file, run: `bundle exec rake gitlab:permissions:graphql:compile_docs`. To make changes to the output of the Rake task, edit `tooling/authz/permissions/docs/templates/granular_pat_graphql_fields.md.erb`. -->

{{< details >}}

• Tier: Free, Premium, Ultimate
• Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

{{< /details >}}

{{< history >}}

• Generally available in GitLab 19.2.

{{< /history >}}

A fine-grained personal access token can access only the resources and permissions you grant it. To use one with the GraphQL API, create a token and define its scope. For more information, see fine-grained personal access tokens.

Available fine-grained permissions

Fine-grained personal access tokens can access the following GraphQL types, mutations, and fields:

Application Security resources

Dependency

Grants the ability to read dependencies.

Action	Access	Kind	Name
Read	Project	Type	DependencyLocation
Read	Project	Type	DependencyTrackedRef

Finding Token Status

Grants the ability to update finding token statuses.

Action	Access	Kind	Name
Update	Project	Mutation	RefreshFindingTokenStatus
Update	Project	Mutation	RefreshVulnerabilityFindingTokenStatus

Pipeline Execution Project Schedule

Grants the ability to read pipeline execution project schedules.

Action	Access	Kind	Name
Read	Project	Type	PipelineExecutionProjectSchedule

Secrets Manager

Grants the ability to read secrets managers.

Action	Access	Kind	Name
Read	Project	Type	ProjectSecretsManager
Read	Group	Type	GroupSecretsManager
Read	Group	Type	SecretsManagerEntitlement
Read	Group	Mutation	SecretsManagerStartTrial

Security Attribute

Grants the ability to create, delete, and update security attributes.

Action	Access	Kind	Name
Create	Group	Mutation	SecurityAttributeCreate
Create	Group	Mutation	SecurityCategoryCreate
Delete	Group	Mutation	SecurityAttributeDestroy
Delete	Group	Mutation	SecurityCategoryDestroy
Update	Project	Mutation	SecurityAttributeProjectUpdate
Update	Group	Mutation	SecurityAttributeUpdate
Update	Group	Mutation	SecurityCategoryUpdate

Security Dashboard

Grants the ability to update security dashboards.

Action	Access	Kind	Name
Update	Project	Mutation	AddProjectToSecurityDashboard
Update	Project	Mutation	RemoveProjectFromSecurityDashboard

Security Scan Profiles

Grants the ability to create, delete, and update security scan profiles.

Action	Access	Kind	Name
Create	Group	Mutation	SecurityScanProfileCreate
Delete	Group	Mutation	SecurityScanProfileDelete
Update	Group	Mutation	SecurityScanProfileUpdate

Vulnerability

Grants the ability to archive, create, read, and update vulnerabilities.

Action	Access	Kind	Name
Archive	Project	Mutation	VulnerabilitiesArchive
Create	Project	Mutation	VulnerabilityCreate
Read	Project	Type	CountableVulnerability
Read	Project	Type	Vulnerability
Read	Project	Type	VulnerabilityScanner
Read	Project	Field	MergeRequest.findingReportsComparer
Read	Project	Field	Project.vulnerabilityWorkflowExecution
Update	Project	Mutation	BulkSetVulnerabilityFindingsDueDates
Update	Project	Mutation	VulnerabilityAutoRemediation
Update	Project	Mutation	VulnerabilityConfirm
Update	Project	Mutation	VulnerabilityDismiss
Update	Project	Mutation	VulnerabilityResolve
Update	Project	Mutation	VulnerabilityRevertToDetected

Vulnerability Duo Workflow

Grants the ability to execute vulnerability duo workflows.

Action	Access	Kind	Name
Execute	Project	Mutation	CancelVulnerabilityWorkflow
Execute	Project	Mutation	StartVulnerabilityWorkflow

Vulnerability Flag

Grants the ability to update vulnerability flags.

Action	Access	Kind	Name
Update	Project	Mutation	VulnerabilityDismissFalsePositiveFlag

Vulnerability Issue Link

Grants the ability to create, delete, and read vulnerability issue links.

Action	Access	Kind	Name
Create	Project	Mutation	SecurityFindingCreateIssue
Create	Project	Mutation	SecurityFindingExternalIssueLinkCreate
Create	Project	Mutation	SecurityFindingJiraIssueFormUrlCreate
Create	Project	Mutation	VulnerabilitiesCreateIssue
Create	Project	Mutation	VulnerabilityExternalIssueLinkCreate
Create	Project	Mutation	VulnerabilityIssueLinkCreate
Delete	Project	Mutation	VulnerabilityExternalIssueLinkDestroy

Vulnerability Merge Request Link

Grants the ability to create and delete vulnerability merge request links.

Action	Access	Kind	Name
Create	Project	Mutation	VulnerabilityLinkMergeRequest
Delete	Project	Mutation	VulnerabilityUnlinkMergeRequest

CI/CD resources

Catalog Bundled Resource

Grants the ability to read bundled CI catalog resources.

Action	Access	Kind	Name
Read	Instance	Type	CiCatalogBundledResource

Catalog Resource

Grants the ability to create and delete CI catalog resources.

Action	Access	Kind	Name
Create	Project	Mutation	CatalogResourcesCreate
Delete	Project	Mutation	CatalogResourcesDestroy

CD Application

Grants the ability to create, read, and update continuous deployment applications.

Action	Access	Kind	Name
Create	Instance	Mutation	CdApplicationCreate
Read	Instance	Type	CdApplication
Update	Instance	Mutation	CdApplicationUpdate

CD Application Flow Definition

Grants the ability to create and read continuous deployment application flow definitions.

Action	Access	Kind	Name
Create	Instance	Mutation	CdApplicationFlowDefinitionCreate
Read	Instance	Type	CdApplicationFlowDefinition

CD Application Link

Grants the ability to create, delete, read, and update continuous deployment application links.

Action	Access	Kind	Name
Create	Instance	Mutation	CdApplicationLinkCreate
Delete	Instance	Mutation	CdApplicationLinkDelete
Read	Instance	Type	CdApplicationLink
Update	Instance	Mutation	CdApplicationLinkUpdate

CD Artifact Source

Grants the ability to create and read continuous deployment artifact sources.

Action	Access	Kind	Name
Create	Instance	Mutation	CdArtifactSourceCreate
Read	Instance	Type	CdArtifactSource
Read	Instance	Type	CdVersion

CD Environment

Grants the ability to create, read, and update continuous deployment environments.

Action	Access	Kind	Name
Create	Instance	Mutation	CdEnvironmentCreate
Read	Instance	Type	CdEnvironment
Read	Instance	Type	CdEnvironmentApplication
Read	Instance	Type	CdEnvironmentDriverBinding
Update	Instance	Mutation	CdEnvironmentDriverBindingCreate
Update	Instance	Mutation	CdEnvironmentUpdate

CD Rollout

Grants the ability to create and read CD rollouts.

Action	Access	Kind	Name
Create	Instance	Mutation	CdRolloutCreate
Read	Instance	Type	CdDeployment
Read	Instance	Type	CdDeploymentTransition
Read	Instance	Type	CdRollout
Read	Instance	Type	CdRolloutEnvironment
Read	Instance	Type	CdRolloutStep
Read	Instance	Type	CdRolloutTransition

CD Rollout Gate

Grants the ability to resolve CD rollout gates.

Action	Access	Kind	Name
Resolve	Instance	Mutation	CdRolloutGateResolve

CD Service

Grants the ability to create, read, and update continuous deployment services.

Action	Access	Kind	Name
Create	Instance	Mutation	CdServiceCreate
Read	Instance	Type	CdService
Read	Instance	Type	CdServiceEnvironmentHealth
Update	Instance	Mutation	CdServiceUpdate

CD Version Set

Grants the ability to create and read continuous deployment version sets.

Action	Access	Kind	Name
Create	Instance	Mutation	CdVersionSetCreate
Read	Instance	Type	CdVersionSet
Read	Instance	Type	CdVersionSetEntry

CI Config

Grants the ability to read and validate CI/CD configuration.

Action	Access	Kind	Name
Validate	Project	Mutation	CiLint

CI Namespace Settings

Grants the ability to update CI namespace settings.

Action	Access	Kind	Name
Update	Group	Mutation	NamespaceSettingsUpdate

CI/CD Setting

Grants the ability to update CI/CD settings.

Action	Access	Kind	Name
Update	Project	Mutation	ProjectCiCdSettingsUpdate
Update	Group	Mutation	SafeDisablePipelineVariables

Cluster Agent

Grants the ability to create, delete, and read cluster agents.

Action	Access	Kind	Name
Create	Project	Mutation	CreateClusterAgent
Delete	Project	Mutation	ClusterAgentDelete
Read	Project	Type	ClusterAgent

Cluster Agent Token

Grants the ability to create, read, and revoke cluster agent tokens.

Action	Access	Kind	Name
Create	Project	Mutation	ClusterAgentTokenCreate

Cluster Agent URL Configuration

Grants the ability to create, delete, and read cluster agent URL configurations.

Action	Access	Kind	Name
Create	Project	Mutation	ClusterAgentUrlConfigurationCreate
Delete	Project	Mutation	ClusterAgentUrlConfigurationDelete

Deployment

Grants the ability to approve, create, delete, read, and update deployments.

Action	Access	Kind	Name
Approve	Project	Mutation	ApproveDeployment

Environment

Grants the ability to create, delete, read, stop, and update environments.

Action	Access	Kind	Name
Create	Project	Mutation	EnvironmentCreate
Delete	Project	Mutation	EnvironmentDelete
Read	Project	Type	Environment
Stop	Project	Mutation	EnvironmentStop
Update	Project	Mutation	EnvironmentUpdate

Freeze Period

Grants the ability to create, delete, read, and update freeze periods.

Action	Access	Kind	Name
Read	Project	Type	CiFreezePeriod

Job

Grants the ability to delete, read, run, and update jobs.

Action	Access	Kind	Name
Read	Project	Type	CiJob
Run	Project	Mutation	JobPlay
Run	Project	Mutation	JobRetry
Update	Project	Mutation	JobCancel
Update	Project	Mutation	JobUnschedule

Job Artifact

Grants the ability to delete, read, and update job artifacts.

Action	Access	Kind	Name
Delete	Project	Mutation	ArtifactDestroy
Delete	Project	Mutation	BulkDestroyJobArtifacts
Delete	Project	Mutation	JobArtifactsDestroy
Read	Project	Type	CiJobArtifact

Merge Train Car

Grants the ability to delete merge train cars.

Action	Access	Kind	Name
Delete	Project	Mutation	MergeTrainsDeleteCar

Pipeline

Grants the ability to create, delete, read, and update pipelines.

Action	Access	Kind	Name
Create	Project	Mutation	PipelineCreate
Delete	Project	Mutation	PipelineDestroy
Read	Project	Type	CiStage
Read	Project	Type	Pipeline
Update	Project	Mutation	PipelineCancel
Update	Project	Mutation	PipelineRetry

Pipeline Schedule

Grants the ability to create, delete, read, and update pipeline schedules.

Action	Access	Kind	Name
Create	Project	Mutation	PipelineScheduleCreate
Delete	Project	Mutation	PipelineScheduleDelete
Read	Project	Type	PipelineSchedule
Update	Project	Mutation	PipelineSchedulePlay
Update	Project	Mutation	PipelineScheduleTakeOwnership
Update	Project	Mutation	PipelineScheduleUpdate

Runner

Grants the ability to assign, create, delete, read, and update runners.

Action	Access	Kind	Name
Assign	Project	Mutation	RunnerAssignToProject
Assign	Project	Mutation	RunnerUnassignFromProject
Create	Project	Mutation	RunnerCreate
Create	Group	Mutation	RunnerCreate
Create	Instance	Mutation	RunnerCreate
Delete	Project	Mutation	RunnerDelete
Delete	Group	Mutation	RunnerDelete
Delete	Instance	Mutation	RunnerDelete
Read	Project	Type	CiRunner
Read	Group	Type	CiRunner
Read	Instance	Type	CiRunner
Update	Project	Mutation	RunnerCacheClear
Update	Project	Mutation	RunnerUpdate
Update	Group	Mutation	RunnerUpdate
Update	Instance	Mutation	RunnerUpdate

Terraform State

Grants the ability to create, delete, lock, and read Terraform state.

Action	Access	Kind	Name
Delete	Project	Mutation	TerraformStateDelete
Lock	Project	Mutation	TerraformStateLock
Lock	Project	Mutation	TerraformStateUnlock
Read	Project	Type	TerraformState
Read	Project	Type	TerraformStateProtectionRule
Read	Project	Type	TerraformStateVersion

Terraform State Protection Rule

Grants the ability to create, delete, and update Terraform state protection rules.

Action	Access	Kind	Name
Create	Project	Mutation	CreateTerraformStateProtectionRule
Delete	Project	Mutation	DeleteTerraformStateProtectionRule
Update	Project	Mutation	UpdateTerraformStateProtectionRule

Trigger

Grants the ability to create, delete, read, and update triggers.

Action	Access	Kind	Name
Create	Project	Mutation	PipelineTriggerCreate
Delete	Project	Mutation	PipelineTriggerDelete
Read	Project	Type	PipelineTrigger
Update	Project	Mutation	PipelineTriggerUpdate

Verified Namespace

Grants the ability to create verified namespaces.

Action	Access	Kind	Name
Create	Instance	Mutation	VerifiedNamespaceCreate

Compliance resources

Audit Event Streaming Destination

Grants the ability to create, delete, and update audit event streaming destinations.

Action	Access	Kind	Name
Create	Group	Mutation	AuditEventsAmazonS3ConfigurationCreate
Create	Group	Mutation	ExternalAuditEventDestinationCreate
Create	Group	Mutation	GoogleCloudLoggingConfigurationCreate
Create	Group	Mutation	GroupAuditEventStreamingDestinationsCreate
Create	Instance	Mutation	AuditEventsInstanceAmazonS3ConfigurationCreate
Create	Instance	Mutation	InstanceAuditEventStreamingDestinationsCreate
Create	Instance	Mutation	InstanceExternalAuditEventDestinationCreate
Create	Instance	Mutation	InstanceGoogleCloudLoggingConfigurationCreate
Delete	Group	Mutation	AuditEventsAmazonS3ConfigurationDelete
Delete	Group	Mutation	ExternalAuditEventDestinationDestroy
Delete	Group	Mutation	GoogleCloudLoggingConfigurationDestroy
Delete	Group	Mutation	GroupAuditEventStreamingDestinationsDelete
Delete	Instance	Mutation	AuditEventsInstanceAmazonS3ConfigurationDelete
Delete	Instance	Mutation	InstanceAuditEventStreamingDestinationsDelete
Delete	Instance	Mutation	InstanceExternalAuditEventDestinationDestroy
Delete	Instance	Mutation	InstanceGoogleCloudLoggingConfigurationDestroy
Update	Group	Mutation	AuditEventsAmazonS3ConfigurationUpdate
Update	Group	Mutation	AuditEventsGroupDestinationDenylistEventsAdd
Update	Group	Mutation	AuditEventsGroupDestinationDenylistEventsDelete
Update	Group	Mutation	AuditEventsGroupDestinationEventsAdd
Update	Group	Mutation	AuditEventsGroupDestinationEventsDelete
Update	Group	Mutation	AuditEventsGroupDestinationNamespaceFilterCreate
Update	Group	Mutation	AuditEventsGroupDestinationNamespaceFilterDelete
Update	Group	Mutation	AuditEventsStreamingDestinationEventsAdd
Update	Group	Mutation	AuditEventsStreamingDestinationEventsRemove
Update	Group	Mutation	AuditEventsStreamingHTTPNamespaceFiltersAdd
Update	Group	Mutation	AuditEventsStreamingHTTPNamespaceFiltersDelete
Update	Group	Mutation	AuditEventsStreamingHeadersCreate
Update	Group	Mutation	AuditEventsStreamingHeadersDestroy
Update	Group	Mutation	AuditEventsStreamingHeadersUpdate
Update	Group	Mutation	ExternalAuditEventDestinationUpdate
Update	Group	Mutation	GoogleCloudLoggingConfigurationUpdate
Update	Group	Mutation	GroupAuditEventStreamingDestinationsUpdate
Update	Instance	Mutation	AuditEventsInstanceAmazonS3ConfigurationUpdate
Update	Instance	Mutation	AuditEventsInstanceDestinationEventsAdd
Update	Instance	Mutation	AuditEventsInstanceDestinationEventsDelete
Update	Instance	Mutation	AuditEventsInstanceDestinationNamespaceFilterCreate
Update	Instance	Mutation	AuditEventsInstanceDestinationNamespaceFilterDelete
Update	Instance	Mutation	AuditEventsStreamingDestinationInstanceEventsAdd
Update	Instance	Mutation	AuditEventsStreamingDestinationInstanceEventsRemove
Update	Instance	Mutation	AuditEventsStreamingInstanceHeadersCreate
Update	Instance	Mutation	AuditEventsStreamingInstanceHeadersDestroy
Update	Instance	Mutation	AuditEventsStreamingInstanceHeadersUpdate
Update	Instance	Mutation	InstanceAuditEventStreamingDestinationsUpdate
Update	Instance	Mutation	InstanceExternalAuditEventDestinationUpdate
Update	Instance	Mutation	InstanceGoogleCloudLoggingConfigurationUpdate

Compliance Dashboard

Grants the ability to read compliance dashboards.

Action	Access	Kind	Name
Read	Group	Mutation	RefreshStandardsAdherenceChecks

Compliance Framework

Grants the ability to create, delete, and update compliance frameworks.

Action	Access	Kind	Name
Create	Group	Mutation	CreateComplianceFramework
Create	Group	Mutation	CreateComplianceFrameworkFromTemplate
Create	Group	Mutation	CreateComplianceRequirement
Create	Group	Mutation	CreateComplianceRequirementsControl
Delete	Group	Mutation	DestroyComplianceFramework
Delete	Group	Mutation	DestroyComplianceRequirement
Delete	Group	Mutation	DestroyComplianceRequirementsControl
Update	Project	Mutation	ProjectSetComplianceFramework
Update	Project	Mutation	ProjectUpdateComplianceFrameworks
Update	Group	Mutation	UpdateComplianceFramework
Update	Group	Mutation	UpdateComplianceRequirement
Update	Group	Mutation	UpdateComplianceRequirementsControl

Compliance Violations Report

Grants the ability to update compliance violations reports.

Action	Access	Kind	Name
Update	Project	Mutation	LinkProjectComplianceViolationIssue
Update	Project	Mutation	UnlinkProjectComplianceViolationIssue
Update	Project	Mutation	UpdateProjectComplianceViolation

External Status Check

Grants the ability to create, delete, read, retry, and update external status checks.

Action	Access	Kind	Name
Create	Project	Mutation	BranchRuleExternalStatusCheckCreate
Delete	Project	Mutation	BranchRuleExternalStatusCheckDestroy
Update	Project	Mutation	BranchRuleExternalStatusCheckUpdate

Duo resources

AI catalog item

Grants the ability to restore AI catalog items.

Action	Access	Kind	Name
Restore	Project	Mutation	AiCatalogItemVersionRestore

AI catalog MCP server

Grants the ability to block AI catalog MCP servers.

Action	Access	Kind	Name
Block	Project	Mutation	AiCatalogMcpServerSetBlock
Block	Group	Mutation	AiCatalogMcpServerSetBlock

AI tool rule

Grants the ability to read and update AI tool rules, which control per-tool approval (Allow, Ask, Deny) for the Duo Agent Platform.

Action	Access	Kind	Name
Read	Group	Field	Query.aiToolRules
Update	Group	Mutation	BulkUpdateAiToolRules
Update	Group	Mutation	UpdateAiToolRule

AI usage metric

Grants the ability to read per-user GitLab Duo usage metrics.

Action	Access	Kind	Name
Read	Project	Field	Project.aiUserMetrics
Read	Group	Field	Group.aiUserMetrics

Duo Workflow

Grants the ability to create, read, resume, and update duo workflows.

Action	Access	Kind	Name
Read	User	Type	DuoWorkflowMergeRequestLink
Read	User	Type	DuoWorkflowNoteLink
Read	User	Type	DuoWorkflowWorkItemLink
Read	User	Field	Note.duoTriggeredSession
Update	User	Mutation	UpdateDuoWorkflowAgentPrivileges
Update	User	Mutation	UpdateDuoWorkflowWebSearch

Flows Metadata

Grants the ability to read flows metadata.

Action	Access	Kind	Name
Read	Project	Type	AiFlowsMetadata
Read	Group	Type	AiFlowsMetadata
Read	Instance	Type	AiFlowsMetadata

Model Selection Allowlist

Grants the ability to read and update model selection allowlists.

Action	Access	Kind	Name
Read	Group	Type	AiModelSelectionAllowList
Read	Group	Type	AiModelSelectionAllowListModel
Read	Instance	Type	AiModelSelectionAllowList
Read	Instance	Type	AiModelSelectionAllowListModel
Update	Group	Mutation	AiModelSelectionNamespaceModelAllowlistUpdate
Update	Instance	Mutation	AiFeatureSettingModelAllowlistUpdate

Geo resources

Geo Registry

Grants the ability to update Geo registries.

Action	Access	Kind	Name
Update	Instance	Mutation	GeoRegistriesBulkUpdate
Update	Instance	Mutation	GeoRegistriesUpdate

GitLab Orbit resources

Knowledge Graph Setting

Grants the ability to update knowledge graph settings.

Action	Access	Kind	Name
Update	Group	Mutation	OrbitUpdate

Groups resources

Admin Member Role

Grants the ability to create, delete, read, and update admin member roles.

Action	Access	Kind	Name
Create	Instance	Mutation	MemberRoleAdminCreate
Delete	Instance	Mutation	MemberRoleAdminDelete
Read	Instance	Type	AdminMemberRole
Update	Instance	Mutation	MemberRoleAdminUpdate

Group

Grants the ability to archive, create, delete, read, share, transfer, and update groups.

Action	Access	Kind	Name
Read	Group	Type	Group
Transfer	Group	Mutation	GroupTransfer
Update	Group	Mutation	GroupUpdate

LDAP Admin Role Link

Grants the ability to create, delete, and read LDAP admin role links

Action	Access	Kind	Name
Create	Instance	Mutation	AdminRolesLdapSync
Create	Instance	Mutation	LdapAdminRoleLinkCreate
Delete	Instance	Mutation	LdapAdminRoleLinkDestroy
Read	Instance	Type	LdapAdminRoleLink

Member Role

Grants the ability to assign, create, delete, read, and update member roles.

Action	Access	Kind	Name
Assign	Instance	Mutation	MemberRoleToUserAssign
Create	Group	Mutation	MemberRoleCreate
Create	Instance	Mutation	MemberRoleCreate
Delete	Group	Mutation	MemberRoleDelete
Delete	Instance	Mutation	MemberRoleDelete
Update	Group	Mutation	MemberRoleUpdate
Update	Instance	Mutation	MemberRoleUpdate

Namespace

Grants the ability to read and update namespaces.

Action	Access	Kind	Name
Read	Project	Mutation	NamespacesRegenerateNewWorkItemEmailAddress

Namespace Ban

Grants the ability to delete namespace bans.

Action	Access	Kind	Name
Delete	Group	Mutation	NamespaceBanDestroy

Preference

Grants the ability to read and update preferences.

Action	Access	Kind	Name
Read	User	Type	UserPreferences
Update	User	Mutation	UserPreferencesUpdate

Topic

Grants the ability to create, delete, merge, read, and update topics.

Action	Access	Kind	Name
Read	Instance	Type	Topic

Integrations resources

Integration Exclusion

Grants the ability to create and delete integration exclusions.

Action	Access	Kind	Name
Create	Instance	Mutation	IntegrationExclusionCreate
Delete	Instance	Mutation	IntegrationExclusionDelete

Jira Import

Grants the ability to create Jira imports.

Action	Access	Kind	Name
Create	Project	Mutation	JiraImportStart
Create	Project	Mutation	JiraImportUsers

Monitoring resources

Alert

Grants the ability to update alerts.

Action	Access	Kind	Name
Update	Project	Mutation	AlertSetAssignees
Update	Project	Mutation	UpdateAlertStatus

Escalation Policy

Grants the ability to create, delete, read, and update escalation policies.

Action	Access	Kind	Name
Create	Project	Mutation	EscalationPolicyCreate
Delete	Project	Mutation	EscalationPolicyDestroy
Read	Project	Type	EscalationPolicyType
Update	Project	Mutation	EscalationPolicyUpdate

HTTP Integration

Grants the ability to create, delete, and update HTTP integrations.

Action	Access	Kind	Name
Create	Project	Mutation	HttpIntegrationCreate
Create	Project	Mutation	PrometheusIntegrationCreate
Delete	Project	Mutation	HttpIntegrationDestroy
Update	Project	Mutation	HttpIntegrationResetToken
Update	Project	Mutation	HttpIntegrationUpdate
Update	Project	Mutation	PrometheusIntegrationResetToken
Update	Project	Mutation	PrometheusIntegrationUpdate

Issuable Resource Link

Grants the ability to create and delete issuable resource links.

Action	Access	Kind	Name
Create	Project	Mutation	IssuableResourceLinkCreate
Delete	Project	Mutation	IssuableResourceLinkDestroy

On-call Schedule

Grants the ability to create, delete, and update on-call schedules.

Action	Access	Kind	Name
Create	Project	Mutation	OncallRotationCreate
Create	Project	Mutation	OncallScheduleCreate
Delete	Project	Mutation	OncallRotationDestroy
Delete	Project	Mutation	OncallScheduleDestroy
Update	Project	Mutation	OncallRotationUpdate
Update	Project	Mutation	OncallScheduleUpdate

Sidekiq Job

Grants the ability to drop Sidekiq jobs.

Action	Access	Kind	Name
Drop	Instance	Mutation	AdminSidekiqQueuesDeleteJobs

Timeline Event

Grants the ability to create, delete, and update timeline events.

Action	Access	Kind	Name
Create	Project	Mutation	TimelineEventCreate
Create	Project	Mutation	TimelineEventPromoteFromNote
Create	Project	Mutation	TimelineEventTagCreate
Delete	Project	Mutation	TimelineEventDestroy
Update	Project	Mutation	TimelineEventUpdate

Notifications resources

Todo

Grants the ability to create, delete, read, and update todos.

Action	Access	Kind	Name
Create	Project	Mutation	AlertTodoCreate
Create	Project	Mutation	TodoCreate
Create	Group	Mutation	TodoCreate
Delete	User	Mutation	TodoDeleteAllDone
Delete	User	Mutation	TodoDeleteMany
Read	User	Type	Todo
Update	User	Mutation	TodoMarkDone
Update	User	Mutation	TodoResolveMany
Update	User	Mutation	TodoRestore
Update	User	Mutation	TodoRestoreMany
Update	User	Mutation	TodoSnooze
Update	User	Mutation	TodoSnoozeMany
Update	User	Mutation	TodoUnSnooze
Update	User	Mutation	TodoUnsnoozeMany
Update	User	Mutation	TodosMarkAllDone

Organizations resources

Organization

Grants the ability to create, delete, read, restore, and update organizations.

Action	Access	Kind	Name
Create	Instance	Mutation	OrganizationCreate
Delete	Instance	Mutation	OrganizationDelete
Read	Instance	Type	Organization
Read	Instance	Type	OrganizationUser
Restore	Instance	Mutation	OrganizationRestore
Update	Instance	Mutation	OrganizationConfirm
Update	Instance	Mutation	OrganizationUpdate
Update	Instance	Mutation	OrganizationUserUpdate

Organization User

Grants the ability to delete organization users.

Action	Access	Kind	Name
Delete	Instance	Mutation	OrganizationUserDelete

Packages and Registry resources

Container Expiration Policy

Grants the ability to update container expiration policies.

Action	Access	Kind	Name
Update	Project	Mutation	UpdateContainerExpirationPolicy

Container Registry Protection Tag Rule

Grants the ability to create, delete, read, and update container registry protection tag rules.

Action	Access	Kind	Name
Create	Project	Mutation	createContainerProtectionTagRule
Delete	Project	Mutation	DeleteContainerProtectionTagRule
Update	Project	Mutation	UpdateContainerProtectionTagRule

Container Repository

Grants the ability to delete and read container repositories.

Action	Access	Kind	Name
Delete	Project	Mutation	DestroyContainerRepository
Delete	Project	Mutation	DestroyContainerRepositoryTags

Container Repository Protection Rule

Grants the ability to create, delete, read, and update container repository protection rules.

Action	Access	Kind	Name
Create	Project	Mutation	CreateContainerProtectionRepositoryRule
Delete	Project	Mutation	DeleteContainerProtectionRepositoryRule
Update	Project	Mutation	UpdateContainerProtectionRepositoryRule

Dependency Proxy

Grants the ability to read and update dependency proxies.

Action	Access	Kind	Name
Update	Group	Mutation	UpdateDependencyProxyImageTtlGroupPolicy
Update	Group	Mutation	UpdateDependencyProxySettings

Dependency Proxy Packages Setting

Grants the ability to update dependency proxy packages settings.

Action	Access	Kind	Name
Update	Project	Mutation	UpdateDependencyProxyPackagesSettings

Package

Grants the ability to create, delete, read, and update packages.

Action	Access	Kind	Name
Create	Project	Mutation	CreatePackagesProtectionRule
Delete	Project	Mutation	DeletePackagesProtectionRule
Delete	Project	Mutation	DestroyPackage
Delete	Project	Mutation	DestroyPackageFile
Delete	Project	Mutation	DestroyPackageFiles
Update	Project	Mutation	UpdatePackagesCleanupPolicy
Update	Project	Mutation	UpdatePackagesProtectionRule

Package Setting

Grants the ability to update package settings.

Action	Access	Kind	Name
Update	Project	Mutation	UpdateNamespacePackageSettings
Update	Group	Mutation	UpdateNamespacePackageSettings
Update	User	Mutation	UpdateNamespacePackageSettings

Virtual Registry

Grants the ability to create, delete, read, and update virtual registries.

Action	Access	Kind	Name
Create	Group	Mutation	ContainerUpstreamCreate
Create	Group	Mutation	ContainerVirtualRegistryCreate
Create	Group	Mutation	ContainerVirtualRegistryUpstreamCreate
Create	Group	Mutation	MavenUpstreamCreate
Create	Group	Mutation	MavenVirtualRegistryCreate
Delete	Group	Mutation	ContainerUpstreamCacheDelete
Delete	Group	Mutation	ContainerUpstreamDelete
Delete	Group	Mutation	ContainerVirtualRegistryCacheDelete
Delete	Group	Mutation	ContainerVirtualRegistryDelete
Delete	Group	Mutation	ContainerVirtualRegistryUpstreamDelete
Delete	Group	Mutation	MavenUpstreamCacheDelete
Delete	Group	Mutation	MavenUpstreamDelete
Delete	Group	Mutation	MavenVirtualRegistryCacheDelete
Delete	Group	Mutation	MavenVirtualRegistryDelete
Delete	Group	Mutation	MavenVirtualRegistryUpstreamDelete
Update	Group	Mutation	ContainerUpstreamTest
Update	Group	Mutation	ContainerUpstreamUpdate
Update	Group	Mutation	ContainerVirtualRegistryUpdate
Update	Group	Mutation	ContainerVirtualRegistryUpstreamUpdate
Update	Group	Mutation	MavenUpstreamUpdate
Update	Group	Mutation	MavenVirtualRegistryUpdate
Update	Group	Mutation	MavenVirtualRegistryUpstreamUpdate
Update	Group	Mutation	UpdateVirtualRegistriesSetting

Virtual Registry Cleanup Policy

Grants the ability to create, delete, read, and update virtual registry cleanup policies.

Action	Access	Kind	Name
Update	Group	Mutation	VirtualRegistriesCleanupPolicyUpsert

Product Analytics resources

Custom Dashboard

Grants the ability to create, delete, and update custom dashboards.

Action	Access	Kind	Name
Create	Instance	Mutation	CreateCustomDashboard
Delete	Instance	Mutation	DeleteCustomDashboard
Update	Instance	Mutation	UpdateCustomDashboard

DevOps Adoption

Grants the ability to enable DevOps adoption for namespaces.

Action	Access	Kind	Name
Enable	Group	Mutation	EnableDevopsAdoptionNamespace

Project Features resources

Badge

Grants the ability to create, delete, read, and update badges.

Action	Access	Kind	Name
Read	Instance	Type	OrganizationUserBadge

Cycle Analytics

Grants the ability to read cycle analytics.

Action	Access	Kind	Name
Read	Project	Field	Analytics.mergeRequests
Read	Group	Field	Analytics.mergeRequests

Release

Grants the ability to create, delete, read, and update releases.

Action	Access	Kind	Name
Create	Project	Mutation	ReleaseAssetLinkCreate
Create	Project	Mutation	ReleaseCreate
Delete	Project	Mutation	ReleaseDelete
Update	Project	Mutation	ReleaseUpdate

Release Link

Grants the ability to create, delete, read, and update release links.

Action	Access	Kind	Name
Delete	Project	Mutation	ReleaseAssetLinkDelete
Update	Project	Mutation	ReleaseAssetLinkUpdate

Snippet

Grants the ability to create, delete, read, and update snippets.

Action	Access	Kind	Name
Create	Project	Mutation	CreateSnippet
Create	User	Mutation	CreateSnippet
Delete	Project	Mutation	DestroySnippet
Delete	User	Mutation	DestroySnippet
Update	Project	Mutation	UpdateSnippet
Update	User	Mutation	UpdateSnippet

Project Model Registry and Experiments resources

ML Model

Grants the ability to create, delete, read, and update ML models.

Action	Access	Kind	Name
Create	Project	Mutation	MlModelCreate
Delete	Project	Mutation	MlModelDelete
Delete	Project	Mutation	MlModelDestroy
Update	Project	Mutation	MlModelEdit

Model Version

Grants the ability to create, delete, read, and update model versions.

Action	Access	Kind	Name
Create	Project	Mutation	MlModelVersionCreate
Delete	Project	Mutation	MlModelVersionDelete
Update	Project	Mutation	MlModelVersionEdit

Project Planning resources

Custom Attribute

Grants the ability to delete, read, and update custom attributes.

Action	Access	Kind	Name
Delete	Project	Mutation	DeleteProjectCustomAttribute
Delete	Group	Mutation	DeleteGroupCustomAttribute
Update	Project	Mutation	ProjectCustomAttributeSet
Update	Group	Mutation	SetGroupCustomAttribute

Design

Grants the ability to create, delete, and update designs.

Action	Access	Kind	Name
Create	Project	Mutation	DesignManagementUpload
Delete	Project	Mutation	DesignManagementDelete
Update	Project	Mutation	DesignManagementMove
Update	Project	Mutation	DesignManagementUpdate

Label

Grants the ability to create, delete, promote, read, subscribe, and update labels.

Action	Access	Kind	Name
Create	Project	Mutation	LabelCreate
Create	Group	Mutation	LabelCreate
Read	Project	Type	Label
Read	Group	Type	Label
Update	Project	Mutation	LabelUpdate
Update	Group	Mutation	LabelUpdate

Work Item

Grants the ability to create, delete, read, and update work items such as epics and issues.

Action	Access	Kind	Name
Create <sup>1</sup>	Project	Mutation	CreateAlertIssue
Create	Project	Mutation	CreateDiffNote
Create	Project	Mutation	CreateDiscussion
Create	Project	Mutation	CreateImageDiffNote
Create	Project	Mutation	CreateIssue
Create	Project	Mutation	CreateLatestDiffNote
Create	Project	Mutation	CreateNote
Create	Project	Mutation	WorkItemCreate
Create	Project	Field	EpicIssue.createNoteEmail
Create	Project	Field	Issue.createNoteEmail
Create	Project	Field	WorkItem.createNoteEmail
Create	Group	Mutation	CreateDiffNote
Create	Group	Mutation	CreateDiscussion
Create	Group	Mutation	CreateImageDiffNote
Create	Group	Mutation	CreateLatestDiffNote
Create	Group	Mutation	CreateNote
Create	Group	Mutation	IterationCadenceCreate
Create	Group	Mutation	WorkItemCreate
Delete	Project	Mutation	DestroyNote
Delete	Project	Mutation	WorkItemDelete
Delete	Group	Mutation	DestroyNote
Delete	Group	Mutation	IterationCadenceDestroy
Delete	Group	Mutation	IterationDelete
Delete	Group	Mutation	WorkItemDelete
Read	Project	Type	Board
Read	Project	Type	EpicIssue
Read	Project	Type	Issue
Read	Project	Type	Milestone
Read	Project	Type	Note
Read	Project	Type	WorkItem
Read	Group	Type	Board
Read	Group	Type	BoardEpic
Read	Group	Type	Epic
Read	Group	Type	Iteration
Read	Group	Type	IterationCadence
Read	Group	Type	Milestone
Read	Group	Type	Note
Read	Group	Type	WorkItemMoveTarget
Update	Project	Mutation	DiscussionToggleResolve
Update	Project	Mutation	IssueLinkAlerts
Update	Project	Mutation	IssueMove
Update	Project	Mutation	IssueSetAssignees
Update	Project	Mutation	IssueSetConfidential
Update	Project	Mutation	IssueSetCrmContacts
Update	Project	Mutation	IssueSetDueDate
Update	Project	Mutation	IssueSetEpic
Update	Project	Mutation	IssueSetEscalationPolicy
Update	Project	Mutation	IssueSetEscalationStatus
Update	Project	Mutation	IssueSetIteration
Update	Project	Mutation	IssueSetLocked
Update	Project	Mutation	IssueSetSeverity
Update	Project	Mutation	IssueSetWeight
Update	Project	Mutation	IssueUnlinkAlert
Update	Project	Mutation	NoteConvertToThread
Update	Project	Mutation	RepositionImageDiffNote
Update	Project	Mutation	UpdateImageDiffNote
Update	Project	Mutation	UpdateIssue
Update	Project	Mutation	UpdateNote
Update	Project	Mutation	WorkItemAddClosingMergeRequest
Update	Project	Mutation	WorkItemConvert
Update	Project	Mutation	WorkItemCreateFromTask
Update	Project	Mutation	WorkItemEnableAiPlanning
Update	Project	Mutation	WorkItemUpdate
Update	Project	Mutation	workItemsReorder
Update	Group	Mutation	IterationCadenceUpdate
Update	Group	Mutation	UpdateImageDiffNote
Update	Group	Mutation	UpdateIteration
Update	Group	Mutation	UpdateNote
Update	Group	Mutation	WorkItemAddClosingMergeRequest
Update	Group	Mutation	WorkItemConvert
Update	Group	Mutation	WorkItemEnableAiPlanning
Update	Group	Mutation	WorkItemUpdate
Update	Group	Mutation	workItemsReorder

¹ Also requires the Update Alert permission.

Projects resources

Markdown Upload

Grants the ability to create, delete, and read Markdown uploads.

Action	Access	Kind	Name
Create	Project	Mutation	UploadCreate
Create	Group	Mutation	UploadCreate
Delete	Project	Mutation	UploadDelete
Delete	Group	Mutation	UploadDelete

Page

Grants the ability to delete, read, and update pages.

Action	Access	Kind	Name
Delete	Project	Mutation	DeletePagesDeployment
Delete	Project	Mutation	RestorePagesDeployment
Read	Project	Type	PagesDeployment
Update	Project	Mutation	PagesMarkOnboardingComplete
Update	Project	Mutation	SetPagesForceHttps
Update	Project	Mutation	SetPagesUseUniqueDomain

Project

Grants the ability to archive, create, delete, fork, read, share, transfer, and update projects.

Action	Access	Kind	Name
Read	Project	Type	Project
Read	Project	Type	RepositoryLanguage
Transfer	Project	Mutation	ProjectTransfer
Update	Project	Mutation	ProjectSettingsUpdate
Update	Project	Mutation	StarProject

Repository resources

Approval Rule

Grants the ability to create, delete, read, and update approval rules.

Action	Access	Kind	Name
Create	Project	Mutation	branchRuleApprovalProjectRuleCreate
Delete	Project	Mutation	approvalProjectRuleDelete
Read	Project	Type	ApprovalProjectRule
Read	Project	Type	ApprovalRule
Update	Project	Mutation	MergeRequestUpdateApprovalRule
Update	Project	Mutation	approvalProjectRuleUpdate

Branch

Grants the ability to create, delete, protect, and read branches.

Action	Access	Kind	Name
Create	Project	Mutation	CreateBranch
Delete	Project	Mutation	BranchDelete
Read	Project	Type	Branch

Branch Rule

Grants the ability to create, delete, and update branch rules.

Action	Access	Kind	Name
Create	Project	Mutation	BranchRuleCreate
Delete	Project	Mutation	BranchRuleDelete
Delete	Project	Mutation	BranchRuleSquashOptionDelete
Update	Project	Mutation	BranchRuleSquashOptionUpdate
Update	Project	Mutation	BranchRuleUpdate

Code

Grants the ability to download, push, and read code via Git.

Action	Access	Kind	Name
Push	Project	Mutation	CommitCreate
Push	Project	Mutation	ProjectSyncFork
Read	Project	Type	Commit
Read	Project	Type	Repository

Merge Request

Grants the ability to approve, create, delete, merge, read, subscribe, and update merge requests.

Action	Access	Kind	Name
Create	Project	Mutation	MergeRequestCreate
Merge	Project	Mutation	MergeRequestAccept
Read	Project	Type	MergeRequest
Read	Project	Type	MergeRequestApprovalState
Read	Project	Type	MergeRequestWorkItemRelation
Subscribe	Project	Mutation	MergeRequestSetSubscription
Update	Project	Mutation	DismissPolicyViolations
Update	Project	Mutation	MergeRequestBypassSecurityPolicy
Update	Project	Mutation	MergeRequestCreateWorkItemRelations
Update	Project	Mutation	MergeRequestDestroyRequestedChanges
Update	Project	Mutation	MergeRequestDestroyWorkItemRelations
Update	Project	Mutation	MergeRequestRequestChanges
Update	Project	Mutation	MergeRequestResyncSecurityPolicies
Update	Project	Mutation	MergeRequestReviewerRereview
Update	Project	Mutation	MergeRequestSetAssignees
Update	Project	Mutation	MergeRequestSetBlockingMergeRequests
Update	Project	Mutation	MergeRequestSetDraft
Update	Project	Mutation	MergeRequestSetLabels
Update	Project	Mutation	MergeRequestSetLocked
Update	Project	Mutation	MergeRequestSetMilestone
Update	Project	Mutation	MergeRequestSetReviewers
Update	Project	Mutation	MergeRequestUpdate

Path Lock

Grants the ability to create path locks.

Action	Access	Kind	Name
Create	Project	Mutation	ProjectSetLocked

Push Rule

Grants the ability to create, delete, read, and update push rules.

Action	Access	Kind	Name
Read	Project	Type	PushRules

Repository

Grants the ability to create, delete, read, and update repositories.

Action	Access	Kind	Name
Read	Project	Type	Blob
Read	Project	Type	RepositoryBlob
Read	Project	Type	Tree

Repository History

Grants the ability to rewrite repository histories.

Action	Access	Kind	Name
Rewrite	Project	Mutation	projectBlobsRemove
Rewrite	Project	Mutation	projectTextReplace

Repository Tag

Grants the ability to create, delete, and read repository tags.

Action	Access	Kind	Name
Create	Project	Mutation	TagCreate
Delete	Project	Mutation	TagDelete
Read	Project	Type	Tag

Target Branch Rule

Grants the ability to create and delete target branch rules.

Action	Access	Kind	Name
Create	Project	Mutation	ProjectTargetBranchRuleCreate
Delete	Project	Mutation	ProjectTargetBranchRuleDestroy

Secrets Management resources

Secrets Manager Enrollment

Grants the ability to read secrets manager enrollments.

Action	Access	Kind	Name
Read	Instance	Type	SecretsManagerInstanceEnrollment

Subscription and Licensing resources

Add On Assignment

Grants the ability to create and delete add on assignments.

Action	Access	Kind	Name
Create	Group	Mutation	UserAddOnAssignmentBulkCreate
Create	Group	Mutation	UserAddOnAssignmentCreate
Create	Instance	Mutation	UserAddOnAssignmentBulkCreate
Create	Instance	Mutation	UserAddOnAssignmentCreate
Delete	Group	Mutation	UserAddOnAssignmentBulkRemove
Delete	Group	Mutation	UserAddOnAssignmentRemove
Delete	Instance	Mutation	UserAddOnAssignmentBulkRemove
Delete	Instance	Mutation	UserAddOnAssignmentRemove

GitLab Subscription

Grants the ability to create, read, and update GitLab subscriptions.

Action	Access	Kind	Name
Update	Instance	Mutation	GitlabSubscriptionActivate

Member Approval

Grants the ability to update member approvals.

Action	Access	Kind	Name
Update	Instance	Mutation	ProcessUserBillablePromotionRequest

Subscription Usage Cap

Grants the ability to update subscription usage caps.

Action	Access	Kind	Name
Update	Group	Mutation	UpsertFlatUserCap
Update	Group	Mutation	UpsertUserBudgetCapOverrides
Update	Instance	Mutation	UpsertFlatUserCap
Update	Instance	Mutation	UpsertUserBudgetCapOverrides

System Access resources

Email

Grants the ability to create, delete, and read emails.

Action	Access	Kind	Name
Read	User	Type	Email

Job Token Scope

Grants the ability to read and update job token scopes.

Action	Access	Kind	Name
Update	Project	Mutation	CiJobTokenScopeUpdatePolicies

Job Token Scope Allowlist

Grants the ability to create, delete, and read job token scope allowlists.

Action	Access	Kind	Name
Create	Project	Mutation	CiJobTokenScopeAddGroupOrProject
Create	Project	Mutation	CiJobTokenScopeAddProject
Delete	Project	Mutation	CiJobTokenScopeRemoveGroup
Delete	Project	Mutation	CiJobTokenScopeRemoveProject

Member

Grants the ability to create, delete, read, and update members.

Action	Access	Kind	Name
Read	Project	Type	ProjectMember
Read	Group	Type	GroupMember
Read	Group	Mutation	GroupMembersExport
Update	Project	Mutation	ProjectMemberBulkUpdate
Update	Group	Mutation	GroupMemberBulkUpdate

Metadata

Grants the ability to read instance metadata.

Action	Access	Kind	Name
Read	Instance	Type	GitlabInstanceFeatureFlag
Read	Instance	Type	Kas
Read	Instance	Type	Metadata

Personal Access Token

Grants the ability to create, read, revoke, and rotate personal access tokens.

Action	Access	Kind	Name
Create	User	Mutation	PersonalAccessTokenCreate
Revoke	User	Mutation	PersonalAccessTokenRevoke
Rotate	User	Mutation	PersonalAccessTokenRotate

User

Grants the ability to activate, approve, ban, block, create, deactivate, delete, disable two factor, follow, read, reject, unban, unblock, unfollow, and update users.

Action	Access	Kind	Name
Read	User	Type	AddOnUser
Read	User	Type	AutocompletedUser
Read	User	Type	CurrentUser
Read	User	Type	MergeRequestAssignee
Read	User	Type	MergeRequestAuthor
Read	User	Type	MergeRequestParticipant
Read	User	Type	MergeRequestReviewer
Read	User	Type	UserCore

Value Stream resources

Value Stream

Grants the ability to create, delete, and update value streams.

Action	Access	Kind	Name
Create	Project	Mutation	ValueStreamCreate
Create	Group	Mutation	ValueStreamCreate
Delete	Project	Mutation	ValueStreamDestroy
Delete	Group	Mutation	ValueStreamDestroy
Update	Project	Mutation	ValueStreamUpdate
Update	Group	Mutation	ValueStreamUpdate

Wiki resources

Wiki

Grants the ability to create, delete, read, subscribe, and update wikis.

Action	Access	Kind	Name
Subscribe	Project	Mutation	WikiPageSubscribe

Workspace resources

Cluster Agent Mapping

Grants the ability to create and delete cluster agent mappings.

Action	Access	Kind	Name
Create	Group	Mutation	NamespaceCreateRemoteDevelopmentClusterAgentMapping
Create	Instance	Mutation	OrganizationCreateClusterAgentMapping
Delete	Group	Mutation	NamespaceDeleteRemoteDevelopmentClusterAgentMapping
Delete	Instance	Mutation	OrganizationDeleteClusterAgentMapping

Workspace

Grants the ability to create and update workspaces.

Action	Access	Kind	Name
Create	Project	Mutation	WorkspaceCreate
Update	Project	Mutation	WorkspaceUpdate