Permission Policy Actions and Resources
This reference catalogs every action and resource ARN that can appear in an API7 Gateway permission policy. Use it as the authoritative source when authoring policies — every action listed here is enforced by the Control Plane, and every resource ARN follows the exact format the policy engine accepts.
Permissions are organized into three namespaces:
| Namespace | Purpose |
|---|
gateway: | Data plane configuration — gateway groups, services, routes, consumers, plugins, certificates, alerts |
iam: | Identity and organization — users, roles, permission policies, license, audit logs, login options, SMTP, contact points |
portal: | Developer Portal — portals, API products, developers, DCR providers, portal tokens |
Wildcards are expressed as * (literal wildcard in the resource path) or <regex> (regular expression enclosed in angle brackets, applied at match time). For example, arn:api7:gateway:gatewaygroup/<.*> matches every gateway group, while arn:api7:gateway:gatewaygroup/* is used in creation statements where there is no specific target yet.
gateway: namespace
Gateway Group
| Action | Resource |
|---|
gateway:GetGatewayGroup | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateGatewayGroup | arn:api7:gateway:gatewaygroup/* |
gateway:UpdateGatewayGroup | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteGatewayGroup | arn:api7:gateway:gatewaygroup/%s |
gateway:GetAdminKey | arn:api7:gateway:gatewaygroup/%s |
Gateway Instance
| Action | Resource |
|---|
gateway:GetGatewayInstance | arn:api7:gateway:gatewaygroup/%s |
gateway:GetGatewayInstanceCore | arn:api7:gateway:gatewaygroup/* |
gateway:CreateGatewayInstance | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteGatewayInstance | arn:api7:gateway:gatewaygroup/%s |
Consumer
| Action | Resource |
|---|
gateway:GetConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:CreateConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/* |
gateway:UpdateConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:DeleteConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
Consumer Credential
| Action | Resource |
|---|
gateway:GetConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:CreateConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:UpdateConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:DeleteConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
SSL Certificate
| Action | Resource |
|---|
gateway:GetSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
Certificate
| Action | Resource |
|---|
gateway:GetCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteCertificate | arn:api7:gateway:gatewaygroup/%s |
CA Certificate
| Action | Resource |
|---|
gateway:GetCACertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateCACertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateCACertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteCACertificate | arn:api7:gateway:gatewaygroup/%s |
SNI
| Action | Resource |
|---|
gateway:GetSNI | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateSNI | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateSNI | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteSNI | arn:api7:gateway:gatewaygroup/%s |
Global Plugin Rule
| Action | Resource |
|---|
gateway:GetGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
| Action | Resource |
|---|
gateway:GetPluginMetadata | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdatePluginMetadata | arn:api7:gateway:gatewaygroup/%s |
gateway:DeletePluginMetadata | arn:api7:gateway:gatewaygroup/%s |
Service Registry
| Action | Resource |
|---|
gateway:GetServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
gateway:ConnectServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
gateway:DisconnectServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
Secret Provider
| Action | Resource |
|---|
gateway:GetSecretProvider | arn:api7:gateway:gatewaygroup/%s/secret_provider/%s |
gateway:PutSecretProvider | arn:api7:gateway:gatewaygroup/%s/secret_provider/%s |
gateway:DeleteSecretProvider | arn:api7:gateway:gatewaygroup/%s/secret_provider/%s |
Proto
For gRPC service definitions used by the grpc-transcode and proto plugins.
| Action | Resource |
|---|
gateway:GetProto | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateProto | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateProto | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteProto | arn:api7:gateway:gatewaygroup/%s |
Debug Session
For online request debugging and trace capture.
| Action | Resource |
|---|
gateway:GetDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:StopDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:ExportDebugSession | arn:api7:gateway:gatewaygroup/%s |
Service Template
Service templates define reusable service configurations, including their routes and stream routes. See Services and Routes for the difference between ServiceTemplateID and ServiceID.
| Action | Resource |
|---|
gateway:GetServiceTemplate | arn:api7:gateway:servicetemplate/%s |
gateway:CreateServiceTemplate | arn:api7:gateway:servicetemplate/* |
gateway:UpdateServiceTemplate | arn:api7:gateway:servicetemplate/%s |
gateway:DeleteServiceTemplate | arn:api7:gateway:servicetemplate/%s |
Published Service
A published service is a service template that has been deployed to a specific gateway group. The same four actions cover the service's routes and stream routes.
| Action | Resource |
|---|
gateway:GetPublishedService | arn:api7:gateway:gatewaygroup/%s/publishedservice/%s |
gateway:CreatePublishedService | arn:api7:gateway:gatewaygroup/%s/publishedservice/* |
gateway:UpdatePublishedService | arn:api7:gateway:gatewaygroup/%s/publishedservice/%s |
gateway:DeletePublishedService | arn:api7:gateway:gatewaygroup/%s/publishedservice/%s |
gateway:PublishServices | arn:api7:gateway:gatewaygroup/%s/publishedservice/* |
Deployment Settings
System-wide gateway deployment settings.
| Action | Resource |
|---|
gateway:UpdateDeploymentSetting | arn:api7:gateway:gatewaysetting/* |
Custom Plugin
| Action | Resource |
|---|
gateway:CreateCustomPlugin | arn:api7:gateway:gatewaysetting/* |
gateway:UpdateCustomPlugin | arn:api7:gateway:gatewaysetting/* |
gateway:DeleteCustomPlugin | arn:api7:gateway:gatewaysetting/* |
Alert Policy
| Action | Resource |
|---|
gateway:GetAlertPolicy | arn:api7:gateway:alert/%s |
gateway:CreateAlertPolicy | arn:api7:gateway:alert/* |
gateway:UpdateAlertPolicy | arn:api7:gateway:alert/%s |
gateway:DeleteAlertPolicy | arn:api7:gateway:alert/%s |
Webhook Template
Reusable webhook payload templates used by alert contact points.
| Action | Resource |
|---|
gateway:GetWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
gateway:CreateWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
gateway:UpdateWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
gateway:DeleteWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
iam: namespace
User
| Action | Resource |
|---|
iam:GetUser | arn:api7:iam:user/%s |
iam:InviteUser | arn:api7:iam:user/* |
iam:UpdateUser | arn:api7:iam:user/%s |
iam:DeleteUser | arn:api7:iam:user/%s |
iam:UpdateUserRole | arn:api7:iam:user/%s |
iam:ResetPassword | arn:api7:iam:user/%s |
iam:UpdateUserBoundary | arn:api7:iam:user/%s |
Role
| Action | Resource |
|---|
iam:GetRole | arn:api7:iam:role/%s |
iam:CreateRole | arn:api7:iam:role/* |
iam:UpdateRole | arn:api7:iam:role/%s |
iam:DeleteRole | arn:api7:iam:role/%s |
Permission Policy
| Action | Resource |
|---|
iam:GetPermissionPolicy | arn:api7:iam:permissionpolicy/%s |
iam:CreatePermissionPolicy | arn:api7:iam:permissionpolicy/* |
iam:UpdatePermissionPolicy | arn:api7:iam:permissionpolicy/%s |
iam:DeletePermissionPolicy | arn:api7:iam:permissionpolicy/%s |
License
| Action | Resource |
|---|
iam:UpdateLicense | arn:api7:iam:organization/* |
Audit Log
| Action | Resource |
|---|
iam:GetAudit | arn:api7:iam:organization/* |
iam:ExportAudits | arn:api7:iam:organization/* |
Login Option
Login options configure authentication methods for the Dashboard (OIDC, SAML, LDAP, CAS).
| Action | Resource |
|---|
iam:GetLoginOption | arn:api7:iam:organization/* |
iam:CreateLoginOption | arn:api7:iam:organization/* |
iam:UpdateLoginOption | arn:api7:iam:organization/* |
iam:DeleteLoginOption | arn:api7:iam:organization/* |
SCIM Provisioning
| Action | Resource |
|---|
iam:GetSCIMProvisioning | arn:api7:iam:organization/* |
iam:UpdateSCIMProvisioning | arn:api7:iam:organization/* |
SMTP Server
Used for outbound email notifications and user invitations.
| Action | Resource |
|---|
iam:GetSMTPServer | arn:api7:iam:organization/* |
iam:UpdateSMTPServer | arn:api7:iam:organization/* |
Contact points are alert notification targets (email, webhook, etc.) referenced by alert policies.
| Action | Resource |
|---|
iam:GetContactPoint | arn:api7:iam:contactpoint/%s |
iam:CreateContactPoint | arn:api7:iam:contactpoint/* |
iam:UpdateContactPoint | arn:api7:iam:contactpoint/%s |
iam:DeleteContactPoint | arn:api7:iam:contactpoint/%s |
portal: namespace
Portal
| Action | Resource |
|---|
portal:GetPortal | arn:api7:portal:portal/%s |
portal:CreatePortal | arn:api7:portal:portal/* |
portal:UpdatePortal | arn:api7:portal:portal/%s |
portal:DeletePortal | arn:api7:portal:portal/%s |
Portal Token
| Action | Resource |
|---|
portal:GetPortalToken | arn:api7:portal:portal/%s/token/* |
portal:CreatePortalToken | arn:api7:portal:portal/%s/token/* |
portal:UpdatePortalToken | arn:api7:portal:portal/%s/token/* |
portal:DeletePortalToken | arn:api7:portal:portal/%s/token/* |
API Product
| Action | Resource |
|---|
portal:GetAPIProduct | arn:api7:portal:portal/%s/apiproduct/%s |
portal:CreateAPIProduct | arn:api7:portal:portal/%s/apiproduct/* |
portal:UpdateAPIProduct | arn:api7:portal:portal/%s/apiproduct/%s |
portal:DeleteAPIProduct | arn:api7:portal:portal/%s/apiproduct/%s |
Developer
| Action | Resource |
|---|
portal:GetDeveloper | arn:api7:portal:portal/%s/developer/%s |
portal:InviteDeveloper | arn:api7:portal:portal/%s/developer/* |
portal:DeleteDeveloper | arn:api7:portal:portal/%s/developer/%s |
DCR Provider
Dynamic Client Registration providers used by the Developer Portal.
| Action | Resource |
|---|
portal:GetDCRProvider | arn:api7:portal:dcrprovider/* |
portal:CreateDCRProvider | arn:api7:portal:dcrprovider/* |
portal:UpdateDCRProvider | arn:api7:portal:dcrprovider/* |
portal:DeleteDCRProvider | arn:api7:portal:dcrprovider/* |
Developer Login Option
Configures authentication methods that developers can use to sign in to a Developer Portal.
| Action | Resource |
|---|
portal:GetDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
portal:CreateDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
portal:UpdateDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
portal:DeleteDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
Developer SCIM Provisioning
| Action | Resource |
|---|
portal:GetDeveloperSCIMProvisioning | arn:api7:portal:portal/%s/loginsetting/* |
portal:UpdateDeveloperSCIMProvisioning | arn:api7:portal:portal/%s/loginsetting/* |
Developer Portal Public Access
Controls whether a Developer Portal is publicly accessible without login.
| Action | Resource |
|---|
portal:GetDeveloperPortalPublicAccess | arn:api7:portal:portal/%s/loginsetting/* |
portal:UpdateDeveloperPortalPublicAccess | arn:api7:portal:portal/%s/loginsetting/* |
Approvals
Approve pending API product subscriptions or new developer sign-ups.
| Action | Resource |
|---|
portal:ApproveAPIProductSubscription | arn:api7:portal:portal/%s/apiproduct/%s |
portal:ApproveDeveloperSignUp | arn:api7:portal:portal/%s/developer/* |
Next steps