Permission Policy Actions and Resources

This reference catalogs every action and resource ARN that can appear in an API7 Gateway permission policy. Use it as the authoritative source when authoring policies — every action listed here is enforced by the Control Plane, and every resource ARN follows the exact format the policy engine accepts.

Permissions are organized into three namespaces:

Namespace	Purpose
gateway:	Data plane configuration — gateway groups, services, routes, consumers, plugins, certificates, alerts
iam:	Identity and organization — users, roles, permission policies, license, audit logs, login options, SMTP, contact points
portal:	Developer Portal — portals, API products, developers, DCR providers, portal tokens

Wildcards are expressed as * (literal wildcard in the resource path) or <regex> (regular expression enclosed in angle brackets, applied at match time). For example, arn:api7:gateway:gatewaygroup/<.*> matches every gateway group, while arn:api7:gateway:gatewaygroup/* is used in creation statements where there is no specific target yet.

gateway: namespace

Gateway Group

Action	Resource
gateway:GetGatewayGroup	arn:api7:gateway:gatewaygroup/%s
gateway:CreateGatewayGroup	arn:api7:gateway:gatewaygroup/*
gateway:UpdateGatewayGroup	arn:api7:gateway:gatewaygroup/%s
gateway:DeleteGatewayGroup	arn:api7:gateway:gatewaygroup/%s
gateway:GetAdminKey	arn:api7:gateway:gatewaygroup/%s

Gateway Instance

Action	Resource
gateway:GetGatewayInstance	arn:api7:gateway:gatewaygroup/%s
gateway:GetGatewayInstanceCore	arn:api7:gateway:gatewaygroup/*
gateway:CreateGatewayInstance	arn:api7:gateway:gatewaygroup/%s
gateway:DeleteGatewayInstance	arn:api7:gateway:gatewaygroup/%s

Consumer

Action	Resource
gateway:GetConsumer	arn:api7:gateway:gatewaygroup/%s/consumer/%s
gateway:CreateConsumer	arn:api7:gateway:gatewaygroup/%s/consumer/*
gateway:UpdateConsumer	arn:api7:gateway:gatewaygroup/%s/consumer/%s
gateway:DeleteConsumer	arn:api7:gateway:gatewaygroup/%s/consumer/%s

Consumer Credential

Action	Resource
gateway:GetConsumerCredential	arn:api7:gateway:gatewaygroup/%s/consumer/%s
gateway:CreateConsumerCredential	arn:api7:gateway:gatewaygroup/%s/consumer/%s
gateway:UpdateConsumerCredential	arn:api7:gateway:gatewaygroup/%s/consumer/%s
gateway:DeleteConsumerCredential	arn:api7:gateway:gatewaygroup/%s/consumer/%s

SSL Certificate

Action	Resource
gateway:GetSSLCertificate	arn:api7:gateway:gatewaygroup/%s
gateway:CreateSSLCertificate	arn:api7:gateway:gatewaygroup/%s
gateway:UpdateSSLCertificate	arn:api7:gateway:gatewaygroup/%s
gateway:DeleteSSLCertificate	arn:api7:gateway:gatewaygroup/%s

Certificate

Action	Resource
gateway:GetCertificate	arn:api7:gateway:gatewaygroup/%s
gateway:CreateCertificate	arn:api7:gateway:gatewaygroup/%s
gateway:UpdateCertificate	arn:api7:gateway:gatewaygroup/%s
gateway:DeleteCertificate	arn:api7:gateway:gatewaygroup/%s

CA Certificate

Action	Resource
gateway:GetCACertificate	arn:api7:gateway:gatewaygroup/%s
gateway:CreateCACertificate	arn:api7:gateway:gatewaygroup/%s
gateway:UpdateCACertificate	arn:api7:gateway:gatewaygroup/%s
gateway:DeleteCACertificate	arn:api7:gateway:gatewaygroup/%s

SNI

Action	Resource
gateway:GetSNI	arn:api7:gateway:gatewaygroup/%s
gateway:CreateSNI	arn:api7:gateway:gatewaygroup/%s
gateway:UpdateSNI	arn:api7:gateway:gatewaygroup/%s
gateway:DeleteSNI	arn:api7:gateway:gatewaygroup/%s

Global Plugin Rule

Action	Resource
gateway:GetGlobalPluginRule	arn:api7:gateway:gatewaygroup/%s
gateway:CreateGlobalPluginRule	arn:api7:gateway:gatewaygroup/%s
gateway:UpdateGlobalPluginRule	arn:api7:gateway:gatewaygroup/%s
gateway:DeleteGlobalPluginRule	arn:api7:gateway:gatewaygroup/%s

Plugin Metadata

Action	Resource
gateway:GetPluginMetadata	arn:api7:gateway:gatewaygroup/%s
gateway:UpdatePluginMetadata	arn:api7:gateway:gatewaygroup/%s
gateway:DeletePluginMetadata	arn:api7:gateway:gatewaygroup/%s

Service Registry

Action	Resource
gateway:GetServiceRegistry	arn:api7:gateway:gatewaygroup/%s
gateway:ConnectServiceRegistry	arn:api7:gateway:gatewaygroup/%s
gateway:UpdateServiceRegistry	arn:api7:gateway:gatewaygroup/%s
gateway:DisconnectServiceRegistry	arn:api7:gateway:gatewaygroup/%s

Secret Provider

Action	Resource
gateway:GetSecretProvider	arn:api7:gateway:gatewaygroup/%s/secret_provider/%s
gateway:PutSecretProvider	arn:api7:gateway:gatewaygroup/%s/secret_provider/%s
gateway:DeleteSecretProvider	arn:api7:gateway:gatewaygroup/%s/secret_provider/%s

Proto

For gRPC service definitions used by the grpc-transcode and proto plugins.

Action	Resource
gateway:GetProto	arn:api7:gateway:gatewaygroup/%s
gateway:CreateProto	arn:api7:gateway:gatewaygroup/%s
gateway:UpdateProto	arn:api7:gateway:gatewaygroup/%s
gateway:DeleteProto	arn:api7:gateway:gatewaygroup/%s

Debug Session

For online request debugging and trace capture.

Action	Resource
gateway:GetDebugSession	arn:api7:gateway:gatewaygroup/%s
gateway:CreateDebugSession	arn:api7:gateway:gatewaygroup/%s
gateway:StopDebugSession	arn:api7:gateway:gatewaygroup/%s
gateway:DeleteDebugSession	arn:api7:gateway:gatewaygroup/%s
gateway:ExportDebugSession	arn:api7:gateway:gatewaygroup/%s

Service

Services are scoped to gateway groups. The same four actions cover a service's routes and stream routes.

Action	Resource
gateway:GetPublishedService	arn:api7:gateway:gatewaygroup/%s/service/%s
gateway:CreatePublishedService	arn:api7:gateway:gatewaygroup/%s/service/*
gateway:UpdatePublishedService	arn:api7:gateway:gatewaygroup/%s/service/%s
gateway:DeletePublishedService	arn:api7:gateway:gatewaygroup/%s/service/%s

Deployment Settings

System-wide gateway deployment settings.

Action	Resource
gateway:UpdateDeploymentSetting	arn:api7:gateway:gatewaysetting/*

Custom Plugin

Custom plugins belong to a gateway group, so a policy can name the gateway groups a subject may upload plugins to. Uploading is one action whether the plugin is new or already there, since the upload replaces whatever the gateway group is running under that name.

Action	Resource
gateway:GetCustomPlugin	arn:api7:gateway:gatewaygroup/%s
gateway:UpdateCustomPlugin	arn:api7:gateway:gatewaygroup/%s
gateway:DeleteCustomPlugin	arn:api7:gateway:gatewaygroup/%s

Available in API7 Enterprise from version 3.10.6. Before that, the custom plugin actions applied to arn:api7:gateway:gatewaysetting/*, and one of them was gateway:CreateCustomPlugin, which no endpoint uses now. Upgrading rewrites those grants onto arn:api7:gateway:gatewaygroup/*, so they keep working on every gateway group. Narrow them to the gateway groups that need them.

Reading a custom plugin also requires a permission now. Before 3.10.6 any signed-in user could read one, so the upgrade adds gateway:GetCustomPlugin to the grants it carries over. A role that never had custom plugin permissions needs it added to see the plugins of a gateway group.

Alert Policy

Action	Resource
gateway:GetAlertPolicy	arn:api7:gateway:alert/%s
gateway:CreateAlertPolicy	arn:api7:gateway:alert/*
gateway:UpdateAlertPolicy	arn:api7:gateway:alert/%s
gateway:DeleteAlertPolicy	arn:api7:gateway:alert/%s

Webhook Template

Reusable webhook payload templates used by alert contact points.

Action	Resource
gateway:GetWebhookTemplate	arn:api7:gateway:gatewaysetting/*
gateway:CreateWebhookTemplate	arn:api7:gateway:gatewaysetting/*
gateway:UpdateWebhookTemplate	arn:api7:gateway:gatewaysetting/*
gateway:DeleteWebhookTemplate	arn:api7:gateway:gatewaysetting/*

iam: namespace

User

Action	Resource
iam:GetUser	arn:api7:iam:user/%s
iam:InviteUser	arn:api7:iam:user/*
iam:UpdateUser	arn:api7:iam:user/%s
iam:DeleteUser	arn:api7:iam:user/%s
iam:UpdateUserRole	arn:api7:iam:user/%s
iam:ResetPassword	arn:api7:iam:user/%s
iam:UpdateUserBoundary	arn:api7:iam:user/%s

Role

Action	Resource
iam:GetRole	arn:api7:iam:role/%s
iam:CreateRole	arn:api7:iam:role/*
iam:UpdateRole	arn:api7:iam:role/%s
iam:DeleteRole	arn:api7:iam:role/%s

Permission Policy

Action	Resource
iam:GetPermissionPolicy	arn:api7:iam:permissionpolicy/%s
iam:CreatePermissionPolicy	arn:api7:iam:permissionpolicy/*
iam:UpdatePermissionPolicy	arn:api7:iam:permissionpolicy/%s
iam:DeletePermissionPolicy	arn:api7:iam:permissionpolicy/%s

License

Action	Resource
iam:UpdateLicense	arn:api7:iam:organization/*

Audit Log

Action	Resource
iam:GetAudit	arn:api7:iam:organization/*
iam:ExportAudits	arn:api7:iam:organization/*

Login Option

Login options configure authentication methods for the Dashboard (OIDC, SAML, LDAP, CAS).

Action	Resource
iam:GetLoginOption	arn:api7:iam:organization/*
iam:CreateLoginOption	arn:api7:iam:organization/*
iam:UpdateLoginOption	arn:api7:iam:organization/*
iam:DeleteLoginOption	arn:api7:iam:organization/*

SCIM Provisioning

Action	Resource
iam:GetSCIMProvisioning	arn:api7:iam:organization/*
iam:UpdateSCIMProvisioning	arn:api7:iam:organization/*

SMTP Server

Used for outbound email notifications and user invitations.

Action	Resource
iam:GetSMTPServer	arn:api7:iam:organization/*
iam:UpdateSMTPServer	arn:api7:iam:organization/*

Contact Point

Contact points are alert notification targets (email, webhook, etc.) referenced by alert policies.

Action	Resource
iam:GetContactPoint	arn:api7:iam:contactpoint/%s
iam:CreateContactPoint	arn:api7:iam:contactpoint/*
iam:UpdateContactPoint	arn:api7:iam:contactpoint/%s
iam:DeleteContactPoint	arn:api7:iam:contactpoint/%s

portal: namespace

Portal

Action	Resource
portal:GetPortal	arn:api7:portal:portal/%s
portal:CreatePortal	arn:api7:portal:portal/*
portal:UpdatePortal	arn:api7:portal:portal/%s
portal:DeletePortal	arn:api7:portal:portal/%s

Portal Token

Action	Resource
portal:GetPortalToken	arn:api7:portal:portal/%s/token/*
portal:CreatePortalToken	arn:api7:portal:portal/%s/token/*
portal:UpdatePortalToken	arn:api7:portal:portal/%s/token/*
portal:DeletePortalToken	arn:api7:portal:portal/%s/token/*

API Product

Action	Resource
portal:GetAPIProduct	arn:api7:portal:portal/%s/apiproduct/%s
portal:CreateAPIProduct	arn:api7:portal:portal/%s/apiproduct/*
portal:UpdateAPIProduct	arn:api7:portal:portal/%s/apiproduct/%s
portal:DeleteAPIProduct	arn:api7:portal:portal/%s/apiproduct/%s

Developer

Action	Resource
portal:GetDeveloper	arn:api7:portal:portal/%s/developer/%s
portal:InviteDeveloper	arn:api7:portal:portal/%s/developer/*
portal:DeleteDeveloper	arn:api7:portal:portal/%s/developer/%s

DCR Provider

Dynamic Client Registration providers used by the Developer Portal.

Action	Resource
portal:GetDCRProvider	arn:api7:portal:dcrprovider/*
portal:CreateDCRProvider	arn:api7:portal:dcrprovider/*
portal:UpdateDCRProvider	arn:api7:portal:dcrprovider/*
portal:DeleteDCRProvider	arn:api7:portal:dcrprovider/*

Developer Login Option

Configures authentication methods that developers can use to sign in to a Developer Portal.

Action	Resource
portal:GetDeveloperLoginOption	arn:api7:portal:portal/%s/loginsetting/*
portal:CreateDeveloperLoginOption	arn:api7:portal:portal/%s/loginsetting/*
portal:UpdateDeveloperLoginOption	arn:api7:portal:portal/%s/loginsetting/*
portal:DeleteDeveloperLoginOption	arn:api7:portal:portal/%s/loginsetting/*

Developer SCIM Provisioning

Action	Resource
portal:GetDeveloperSCIMProvisioning	arn:api7:portal:portal/%s/loginsetting/*
portal:UpdateDeveloperSCIMProvisioning	arn:api7:portal:portal/%s/loginsetting/*

Developer Portal Public Access

Controls whether a Developer Portal is publicly accessible without login.

Action	Resource
portal:GetDeveloperPortalPublicAccess	arn:api7:portal:portal/%s/loginsetting/*
portal:UpdateDeveloperPortalPublicAccess	arn:api7:portal:portal/%s/loginsetting/*

Approvals

Approve pending API product subscriptions or new developer sign-ups.

Action	Resource
portal:ApproveAPIProductSubscription	arn:api7:portal:portal/%s/apiproduct/%s
portal:ApproveDeveloperSignUp	arn:api7:portal:portal/%s/developer/*

Next steps

• Permission Policies and Boundaries — learn the full JSON syntax.
• Permission Policy Examples — ready-to-adapt example policies for common scenarios.
• Role-Based Access Control — how roles, users, and policies fit together.