# Permission Policy Actions and Resources

This reference catalogs every action and resource ARN that can appear in an API7 Gateway [permission policy](https://docs.api7.ai/api7-gateway/security-and-compliance/permission-policies-and-boundaries.md). Use it as the authoritative source when authoring policies — every action listed here is enforced by the Control Plane, and every resource ARN follows the exact format the policy engine accepts.

Permissions are organized into three namespaces:

| Namespace  | Purpose                                                                                                                                                     |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `gateway:` | Data plane configuration — gateway groups, services, routes, consumers, plugins, certificates, alerts                                                       |
| `iam:`     | Identity and organization — users, roles, permission policies, license, audit logs, login options, password policy, two-factor policy, SMTP, contact points |
| `portal:`  | Developer Portal — portals, API products, developers, DCR providers, portal tokens                                                                          |

Wildcards are expressed as `*` (literal wildcard in the resource path) or `<regex>` (regular expression enclosed in angle brackets, applied at match time). For example, `arn:api7:gateway:gatewaygroup/<.*>` matches every gateway group, while `arn:api7:gateway:gatewaygroup/*` is used in creation statements where there is no specific target yet.

## `gateway:` namespace[​](#gateway-namespace "Direct link to gateway-namespace")

### Gateway Group[​](#gateway-group "Direct link to Gateway Group")

| Action                       | Resource                           |
| ---------------------------- | ---------------------------------- |
| `gateway:GetGatewayGroup`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:CreateGatewayGroup` | `arn:api7:gateway:gatewaygroup/*`  |
| `gateway:UpdateGatewayGroup` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeleteGatewayGroup` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:GetAdminKey`        | `arn:api7:gateway:gatewaygroup/%s` |

### Gateway Instance[​](#gateway-instance "Direct link to Gateway Instance")

| Action                           | Resource                           |
| -------------------------------- | ---------------------------------- |
| `gateway:GetGatewayInstance`     | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:GetGatewayInstanceCore` | `arn:api7:gateway:gatewaygroup/*`  |
| `gateway:CreateGatewayInstance`  | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeleteGatewayInstance`  | `arn:api7:gateway:gatewaygroup/%s` |

### Consumer[​](#consumer "Direct link to Consumer")

| Action                   | Resource                                       |
| ------------------------ | ---------------------------------------------- |
| `gateway:GetConsumer`    | `arn:api7:gateway:gatewaygroup/%s/consumer/%s` |
| `gateway:CreateConsumer` | `arn:api7:gateway:gatewaygroup/%s/consumer/*`  |
| `gateway:UpdateConsumer` | `arn:api7:gateway:gatewaygroup/%s/consumer/%s` |
| `gateway:DeleteConsumer` | `arn:api7:gateway:gatewaygroup/%s/consumer/%s` |

### Consumer Credential[​](#consumer-credential "Direct link to Consumer Credential")

| Action                             | Resource                                       |
| ---------------------------------- | ---------------------------------------------- |
| `gateway:GetConsumerCredential`    | `arn:api7:gateway:gatewaygroup/%s/consumer/%s` |
| `gateway:CreateConsumerCredential` | `arn:api7:gateway:gatewaygroup/%s/consumer/%s` |
| `gateway:UpdateConsumerCredential` | `arn:api7:gateway:gatewaygroup/%s/consumer/%s` |
| `gateway:DeleteConsumerCredential` | `arn:api7:gateway:gatewaygroup/%s/consumer/%s` |

### SSL Certificate[​](#ssl-certificate "Direct link to SSL Certificate")

| Action                         | Resource                           |
| ------------------------------ | ---------------------------------- |
| `gateway:GetSSLCertificate`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:CreateSSLCertificate` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:UpdateSSLCertificate` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeleteSSLCertificate` | `arn:api7:gateway:gatewaygroup/%s` |

### Certificate[​](#certificate "Direct link to Certificate")

| Action                      | Resource                           |
| --------------------------- | ---------------------------------- |
| `gateway:GetCertificate`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:CreateCertificate` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:UpdateCertificate` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeleteCertificate` | `arn:api7:gateway:gatewaygroup/%s` |

### CA Certificate[​](#ca-certificate "Direct link to CA Certificate")

| Action                        | Resource                           |
| ----------------------------- | ---------------------------------- |
| `gateway:GetCACertificate`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:CreateCACertificate` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:UpdateCACertificate` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeleteCACertificate` | `arn:api7:gateway:gatewaygroup/%s` |

### SNI[​](#sni "Direct link to SNI")

| Action              | Resource                           |
| ------------------- | ---------------------------------- |
| `gateway:GetSNI`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:CreateSNI` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:UpdateSNI` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeleteSNI` | `arn:api7:gateway:gatewaygroup/%s` |

### Global Plugin Rule[​](#global-plugin-rule "Direct link to Global Plugin Rule")

| Action                           | Resource                           |
| -------------------------------- | ---------------------------------- |
| `gateway:GetGlobalPluginRule`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:CreateGlobalPluginRule` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:UpdateGlobalPluginRule` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeleteGlobalPluginRule` | `arn:api7:gateway:gatewaygroup/%s` |

### Plugin Metadata[​](#plugin-metadata "Direct link to Plugin Metadata")

| Action                         | Resource                           |
| ------------------------------ | ---------------------------------- |
| `gateway:GetPluginMetadata`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:UpdatePluginMetadata` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeletePluginMetadata` | `arn:api7:gateway:gatewaygroup/%s` |

### Service Registry[​](#service-registry "Direct link to Service Registry")

| Action                              | Resource                           |
| ----------------------------------- | ---------------------------------- |
| `gateway:GetServiceRegistry`        | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:ConnectServiceRegistry`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:UpdateServiceRegistry`     | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DisconnectServiceRegistry` | `arn:api7:gateway:gatewaygroup/%s` |

### Secret Provider[​](#secret-provider "Direct link to Secret Provider")

| Action                         | Resource                                              |
| ------------------------------ | ----------------------------------------------------- |
| `gateway:GetSecretProvider`    | `arn:api7:gateway:gatewaygroup/%s/secret_provider/%s` |
| `gateway:PutSecretProvider`    | `arn:api7:gateway:gatewaygroup/%s/secret_provider/%s` |
| `gateway:DeleteSecretProvider` | `arn:api7:gateway:gatewaygroup/%s/secret_provider/%s` |

### Proto[​](#proto "Direct link to Proto")

For gRPC service definitions used by the `grpc-transcode` and `proto` plugins.

| Action                | Resource                           |
| --------------------- | ---------------------------------- |
| `gateway:GetProto`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:CreateProto` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:UpdateProto` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeleteProto` | `arn:api7:gateway:gatewaygroup/%s` |

### Debug Session[​](#debug-session "Direct link to Debug Session")

For online request debugging and trace capture.

| Action                       | Resource                           |
| ---------------------------- | ---------------------------------- |
| `gateway:GetDebugSession`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:CreateDebugSession` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:StopDebugSession`   | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeleteDebugSession` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:ExportDebugSession` | `arn:api7:gateway:gatewaygroup/%s` |

### Diagnostic Agent[​](#diagnostic-agent "Direct link to Diagnostic Agent")

Diagnostic agents are cluster-level resources because one agent can inspect all NGINX processes on its host, regardless of gateway group.

| Action                              | Resource                              |
| ----------------------------------- | ------------------------------------- |
| `gateway:GetDiagnosticAgent`        | `arn:api7:gateway:diagnosticagent/%s` |
| `gateway:DeployDiagnosticAgent`     | `arn:api7:gateway:diagnosticagent/*`  |
| `gateway:ListDiagnosticAgents`      | `arn:api7:gateway:diagnosticagent/*`  |
| `gateway:UseDiagnosticAgentConsole` | `arn:api7:gateway:diagnosticagent/%s` |

Use `gateway:ListDiagnosticAgents` and `gateway:GetDiagnosticAgent` to read agent metadata, and `gateway:DeployDiagnosticAgent` to create deployment material. `gateway:UseDiagnosticAgentConsole` is a write-capable permission: it is required even to open or read the diagnostic console because the same console can start profiling captures.

Available in API7 Enterprise from version 3.10.7.

### Service[​](#service "Direct link to Service")

Services are scoped to gateway groups. The same four actions cover a service's routes and stream routes.

| Action                           | Resource                                      |
| -------------------------------- | --------------------------------------------- |
| `gateway:GetPublishedService`    | `arn:api7:gateway:gatewaygroup/%s/service/%s` |
| `gateway:CreatePublishedService` | `arn:api7:gateway:gatewaygroup/%s/service/*`  |
| `gateway:UpdatePublishedService` | `arn:api7:gateway:gatewaygroup/%s/service/%s` |
| `gateway:DeletePublishedService` | `arn:api7:gateway:gatewaygroup/%s/service/%s` |

### Deployment Settings[​](#deployment-settings "Direct link to Deployment Settings")

System-wide gateway deployment settings.

| Action                            | Resource                            |
| --------------------------------- | ----------------------------------- |
| `gateway:UpdateDeploymentSetting` | `arn:api7:gateway:gatewaysetting/*` |

### Custom Plugin[​](#custom-plugin "Direct link to Custom Plugin")

Custom plugins belong to a gateway group, so a policy can name the gateway groups a subject may upload plugins to. Uploading is one action whether the plugin is new or already there, since the upload replaces whatever the gateway group is running under that name.

| Action                       | Resource                           |
| ---------------------------- | ---------------------------------- |
| `gateway:GetCustomPlugin`    | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:UpdateCustomPlugin` | `arn:api7:gateway:gatewaygroup/%s` |
| `gateway:DeleteCustomPlugin` | `arn:api7:gateway:gatewaygroup/%s` |

Available in API7 Enterprise from version 3.10.6. Before that, the custom plugin actions applied to `arn:api7:gateway:gatewaysetting/*`, and one of them was `gateway:CreateCustomPlugin`, which no endpoint uses now. Upgrading rewrites those grants onto `arn:api7:gateway:gatewaygroup/*`, so they keep working on every gateway group. Narrow them to the gateway groups that need them.

Reading a custom plugin also requires a permission now. Before 3.10.6 any signed-in user could read one, so the upgrade adds `gateway:GetCustomPlugin` to the grants it carries over. A role that never had custom plugin permissions needs it added to see the plugins of a gateway group.

### Alert Policy[​](#alert-policy "Direct link to Alert Policy")

| Action                      | Resource                    |
| --------------------------- | --------------------------- |
| `gateway:GetAlertPolicy`    | `arn:api7:gateway:alert/%s` |
| `gateway:CreateAlertPolicy` | `arn:api7:gateway:alert/*`  |
| `gateway:UpdateAlertPolicy` | `arn:api7:gateway:alert/%s` |
| `gateway:DeleteAlertPolicy` | `arn:api7:gateway:alert/%s` |

### Webhook Template[​](#webhook-template "Direct link to Webhook Template")

Reusable webhook payload templates used by alert contact points.

| Action                          | Resource                            |
| ------------------------------- | ----------------------------------- |
| `gateway:GetWebhookTemplate`    | `arn:api7:gateway:gatewaysetting/*` |
| `gateway:CreateWebhookTemplate` | `arn:api7:gateway:gatewaysetting/*` |
| `gateway:UpdateWebhookTemplate` | `arn:api7:gateway:gatewaysetting/*` |
| `gateway:DeleteWebhookTemplate` | `arn:api7:gateway:gatewaysetting/*` |

## `iam:` namespace[​](#iam-namespace "Direct link to iam-namespace")

### User[​](#user "Direct link to User")

| Action                   | Resource               |
| ------------------------ | ---------------------- |
| `iam:GetUser`            | `arn:api7:iam:user/%s` |
| `iam:InviteUser`         | `arn:api7:iam:user/*`  |
| `iam:UpdateUser`         | `arn:api7:iam:user/%s` |
| `iam:DeleteUser`         | `arn:api7:iam:user/%s` |
| `iam:UpdateUserRole`     | `arn:api7:iam:user/%s` |
| `iam:ResetPassword`      | `arn:api7:iam:user/%s` |
| `iam:ResetTwoFactor`     | `arn:api7:iam:user/%s` |
| `iam:UpdateUserBoundary` | `arn:api7:iam:user/%s` |

### Role[​](#role "Direct link to Role")

| Action           | Resource               |
| ---------------- | ---------------------- |
| `iam:GetRole`    | `arn:api7:iam:role/%s` |
| `iam:CreateRole` | `arn:api7:iam:role/*`  |
| `iam:UpdateRole` | `arn:api7:iam:role/%s` |
| `iam:DeleteRole` | `arn:api7:iam:role/%s` |

### Permission Policy[​](#permission-policy "Direct link to Permission Policy")

| Action                       | Resource                           |
| ---------------------------- | ---------------------------------- |
| `iam:GetPermissionPolicy`    | `arn:api7:iam:permissionpolicy/%s` |
| `iam:CreatePermissionPolicy` | `arn:api7:iam:permissionpolicy/*`  |
| `iam:UpdatePermissionPolicy` | `arn:api7:iam:permissionpolicy/%s` |
| `iam:DeletePermissionPolicy` | `arn:api7:iam:permissionpolicy/%s` |

### License[​](#license "Direct link to License")

| Action              | Resource                      |
| ------------------- | ----------------------------- |
| `iam:UpdateLicense` | `arn:api7:iam:organization/*` |

### Audit Log[​](#audit-log "Direct link to Audit Log")

| Action             | Resource                      |
| ------------------ | ----------------------------- |
| `iam:GetAudit`     | `arn:api7:iam:organization/*` |
| `iam:ExportAudits` | `arn:api7:iam:organization/*` |

### Login Option[​](#login-option "Direct link to Login Option")

Login options configure authentication methods for the Dashboard (OIDC, SAML, LDAP, CAS).

| Action                  | Resource                      |
| ----------------------- | ----------------------------- |
| `iam:GetLoginOption`    | `arn:api7:iam:organization/*` |
| `iam:CreateLoginOption` | `arn:api7:iam:organization/*` |
| `iam:UpdateLoginOption` | `arn:api7:iam:organization/*` |
| `iam:DeleteLoginOption` | `arn:api7:iam:organization/*` |

### Password Policy[​](#password-policy "Direct link to Password Policy")

| Action                     | Resource                      |
| -------------------------- | ----------------------------- |
| `iam:GetPasswordPolicy`    | `arn:api7:iam:organization/*` |
| `iam:UpdatePasswordPolicy` | `arn:api7:iam:organization/*` |

Available in API7 Enterprise from version 3.10.10.

### Two-Factor Policy[​](#two-factor-policy "Direct link to Two-Factor Policy")

| Action                      | Resource                      |
| --------------------------- | ----------------------------- |
| `iam:GetTwoFactorPolicy`    | `arn:api7:iam:organization/*` |
| `iam:UpdateTwoFactorPolicy` | `arn:api7:iam:organization/*` |

Available in API7 Enterprise from version 3.10.10.

### SCIM Provisioning[​](#scim-provisioning "Direct link to SCIM Provisioning")

| Action                       | Resource                      |
| ---------------------------- | ----------------------------- |
| `iam:GetSCIMProvisioning`    | `arn:api7:iam:organization/*` |
| `iam:UpdateSCIMProvisioning` | `arn:api7:iam:organization/*` |

### SMTP Server[​](#smtp-server "Direct link to SMTP Server")

Used for outbound email notifications and user invitations.

| Action                 | Resource                      |
| ---------------------- | ----------------------------- |
| `iam:GetSMTPServer`    | `arn:api7:iam:organization/*` |
| `iam:UpdateSMTPServer` | `arn:api7:iam:organization/*` |

### Contact Point[​](#contact-point "Direct link to Contact Point")

Contact points are alert notification targets (email, webhook, etc.) referenced by alert policies.

| Action                   | Resource                       |
| ------------------------ | ------------------------------ |
| `iam:GetContactPoint`    | `arn:api7:iam:contactpoint/%s` |
| `iam:CreateContactPoint` | `arn:api7:iam:contactpoint/*`  |
| `iam:UpdateContactPoint` | `arn:api7:iam:contactpoint/%s` |
| `iam:DeleteContactPoint` | `arn:api7:iam:contactpoint/%s` |

## `portal:` namespace[​](#portal-namespace "Direct link to portal-namespace")

### Portal[​](#portal "Direct link to Portal")

| Action                | Resource                    |
| --------------------- | --------------------------- |
| `portal:GetPortal`    | `arn:api7:portal:portal/%s` |
| `portal:CreatePortal` | `arn:api7:portal:portal/*`  |
| `portal:UpdatePortal` | `arn:api7:portal:portal/%s` |
| `portal:DeletePortal` | `arn:api7:portal:portal/%s` |

### Portal Token[​](#portal-token "Direct link to Portal Token")

| Action                     | Resource                            |
| -------------------------- | ----------------------------------- |
| `portal:GetPortalToken`    | `arn:api7:portal:portal/%s/token/*` |
| `portal:CreatePortalToken` | `arn:api7:portal:portal/%s/token/*` |
| `portal:UpdatePortalToken` | `arn:api7:portal:portal/%s/token/*` |
| `portal:DeletePortalToken` | `arn:api7:portal:portal/%s/token/*` |

### API Product[​](#api-product "Direct link to API Product")

| Action                    | Resource                                  |
| ------------------------- | ----------------------------------------- |
| `portal:GetAPIProduct`    | `arn:api7:portal:portal/%s/apiproduct/%s` |
| `portal:CreateAPIProduct` | `arn:api7:portal:portal/%s/apiproduct/*`  |
| `portal:UpdateAPIProduct` | `arn:api7:portal:portal/%s/apiproduct/%s` |
| `portal:DeleteAPIProduct` | `arn:api7:portal:portal/%s/apiproduct/%s` |

### Developer[​](#developer "Direct link to Developer")

| Action                   | Resource                                 |
| ------------------------ | ---------------------------------------- |
| `portal:GetDeveloper`    | `arn:api7:portal:portal/%s/developer/%s` |
| `portal:InviteDeveloper` | `arn:api7:portal:portal/%s/developer/*`  |
| `portal:DeleteDeveloper` | `arn:api7:portal:portal/%s/developer/%s` |

### DCR Provider[​](#dcr-provider "Direct link to DCR Provider")

Dynamic Client Registration providers used by the Developer Portal.

| Action                     | Resource                        |
| -------------------------- | ------------------------------- |
| `portal:GetDCRProvider`    | `arn:api7:portal:dcrprovider/*` |
| `portal:CreateDCRProvider` | `arn:api7:portal:dcrprovider/*` |
| `portal:UpdateDCRProvider` | `arn:api7:portal:dcrprovider/*` |
| `portal:DeleteDCRProvider` | `arn:api7:portal:dcrprovider/*` |

### Developer Login Option[​](#developer-login-option "Direct link to Developer Login Option")

Configures authentication methods that developers can use to sign in to a Developer Portal.

| Action                              | Resource                                   |
| ----------------------------------- | ------------------------------------------ |
| `portal:GetDeveloperLoginOption`    | `arn:api7:portal:portal/%s/loginsetting/*` |
| `portal:CreateDeveloperLoginOption` | `arn:api7:portal:portal/%s/loginsetting/*` |
| `portal:UpdateDeveloperLoginOption` | `arn:api7:portal:portal/%s/loginsetting/*` |
| `portal:DeleteDeveloperLoginOption` | `arn:api7:portal:portal/%s/loginsetting/*` |

### Developer SCIM Provisioning[​](#developer-scim-provisioning "Direct link to Developer SCIM Provisioning")

| Action                                   | Resource                                   |
| ---------------------------------------- | ------------------------------------------ |
| `portal:GetDeveloperSCIMProvisioning`    | `arn:api7:portal:portal/%s/loginsetting/*` |
| `portal:UpdateDeveloperSCIMProvisioning` | `arn:api7:portal:portal/%s/loginsetting/*` |

### Developer Portal Public Access[​](#developer-portal-public-access "Direct link to Developer Portal Public Access")

Controls whether a Developer Portal is publicly accessible without login.

| Action                                     | Resource                                   |
| ------------------------------------------ | ------------------------------------------ |
| `portal:GetDeveloperPortalPublicAccess`    | `arn:api7:portal:portal/%s/loginsetting/*` |
| `portal:UpdateDeveloperPortalPublicAccess` | `arn:api7:portal:portal/%s/loginsetting/*` |

### Approvals[​](#approvals "Direct link to Approvals")

Approve pending API product subscriptions or new developer sign-ups.

| Action                                 | Resource                                  |
| -------------------------------------- | ----------------------------------------- |
| `portal:ApproveAPIProductSubscription` | `arn:api7:portal:portal/%s/apiproduct/%s` |
| `portal:ApproveDeveloperSignUp`        | `arn:api7:portal:portal/%s/developer/*`   |

## Next Steps[​](#next-steps "Direct link to Next Steps")

* [Permission Policies and Boundaries](https://docs.api7.ai/api7-gateway/security-and-compliance/permission-policies-and-boundaries.md) — learn the full JSON syntax.
* [Permission Policy Examples](https://docs.api7.ai/api7-gateway/reference/permission-policy-examples.md) — ready-to-adapt example policies for common scenarios.
* [Role-Based Access Control](https://docs.api7.ai/api7-gateway/security-and-compliance/role-based-access-control.md) — how roles, users, and policies fit together.