Fine-grained permissions for GraphQL API

  • Tier: Free, Premium, Ultimate
  • Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

A fine-grained personal access token can access only the resources and permissions you grant it. To use one with the GraphQL API, create a token and define its scope. For more information, see fine-grained personal access tokens.

Available fine-grained permissions

Fine-grained personal access tokens can access the following GraphQL types, mutations, and fields:

Application Security resources

Dependency

Grants the ability to read dependencies.

Action Access Kind Name
Read Project Type DependencyLocation

Pipeline Execution Project Schedule

Grants the ability to read pipeline execution project schedules.

Action Access Kind Name
Read Project Type PipelineExecutionProjectSchedule

Secrets Manager

Grants the ability to read secrets managers.

Action Access Kind Name
Read Project Type ProjectSecretsManager
Read Group Type GroupSecretsManager
Read Group Type SecretsManagerEntitlement
Read Group Mutation SecretsManagerStartTrial

Vulnerability

Grants the ability to create, read, and update vulnerabilities.

Action Access Kind Name
Create Project Mutation VulnerabilityCreate
Read Project Type CountableVulnerability
Read Project Type Vulnerability
Read Project Type VulnerabilityScanner
Read Project Field MergeRequest.findingReportsComparer
Update Project Mutation VulnerabilityAutoRemediation
Update Project Mutation VulnerabilityConfirm
Update Project Mutation VulnerabilityDismiss
Update Project Mutation VulnerabilityResolve
Update Project Mutation VulnerabilityRevertToDetected

CI/CD resources

Catalog Resource

Grants the ability to create and delete CI catalog resources.

Action Access Kind Name
Create Project Mutation CatalogResourcesCreate
Delete Project Mutation CatalogResourcesDestroy

CD Application

Grants the ability to create, read, and update continuous deployment applications.

Action Access Kind Name
Create Instance Mutation CdApplicationCreate
Read Instance Type CdApplication
Update Instance Mutation CdApplicationUpdate

CD Application Flow Definition

Grants the ability to create and read continuous deployment application flow definitions.

Action Access Kind Name
Create Instance Mutation CdApplicationFlowDefinitionCreate
Read Instance Type CdApplicationFlowDefinition

Grants the ability to create and read continuous deployment application links.

Action Access Kind Name
Create Instance Mutation CdApplicationLinkCreate
Read Instance Type CdApplicationLink

CD Artifact Source

Grants the ability to create and read continuous deployment artifact sources.

Action Access Kind Name
Create Instance Mutation CdArtifactSourceCreate
Read Instance Type CdArtifactSource
Read Instance Type CdVersion

CD Environment

Grants the ability to create, read, and update continuous deployment environments.

Action Access Kind Name
Create Instance Mutation CdEnvironmentCreate
Read Instance Type CdEnvironment
Read Instance Type CdEnvironmentDriverBinding
Update Instance Mutation CdEnvironmentUpdate

CD Rollout

Grants the ability to create and read CD rollouts.

Action Access Kind Name
Create Instance Mutation CdRolloutCreate
Read Instance Type CdDeployment
Read Instance Type CdDeploymentTransition
Read Instance Type CdRollout
Read Instance Type CdRolloutEnvironment
Read Instance Type CdRolloutTransition

CD Rollout Gate

Grants the ability to resolve CD rollout gates.

Action Access Kind Name
Resolve Instance Mutation CdRolloutGateResolve

CD Service

Grants the ability to create, read, and update continuous deployment services.

Action Access Kind Name
Create Instance Mutation CdServiceCreate
Read Instance Type CdService
Read Instance Type CdServiceEnvironmentHealth
Update Instance Mutation CdServiceUpdate

CD Version Set

Grants the ability to create and read continuous deployment version sets.

Action Access Kind Name
Create Instance Mutation CdVersionSetCreate
Read Instance Type CdVersionSet
Read Instance Type CdVersionSetEntry

CI Config

Grants the ability to read and validate CI/CD configuration.

Action Access Kind Name
Validate Project Mutation CiLint

CI/CD Setting

Grants the ability to update CI/CD settings.

Action Access Kind Name
Update Project Mutation ProjectCiCdSettingsUpdate
Update Group Mutation SafeDisablePipelineVariables

Cluster Agent

Grants the ability to create, delete, and read cluster agents.

Action Access Kind Name
Create Project Mutation CreateClusterAgent
Delete Project Mutation ClusterAgentDelete
Read Project Type ClusterAgent

Cluster Agent Token

Grants the ability to create, read, and revoke cluster agent tokens.

Action Access Kind Name
Create Project Mutation ClusterAgentTokenCreate

Cluster Agent URL Configuration

Grants the ability to create, delete, and read cluster agent URL configurations.

Action Access Kind Name
Create Project Mutation ClusterAgentUrlConfigurationCreate
Delete Project Mutation ClusterAgentUrlConfigurationDelete

Deployment

Grants the ability to approve, create, delete, read, and update deployments.

Action Access Kind Name
Approve Project Mutation ApproveDeployment

Environment

Grants the ability to create, delete, read, stop, and update environments.

Action Access Kind Name
Create Project Mutation EnvironmentCreate
Delete Project Mutation EnvironmentDelete
Read Project Type Environment
Stop Project Mutation EnvironmentStop
Update Project Mutation EnvironmentUpdate

Freeze Period

Grants the ability to create, delete, read, and update freeze periods.

Action Access Kind Name
Read Project Type CiFreezePeriod

Job

Grants the ability to delete, read, run, and update jobs.

Action Access Kind Name
Read Project Type CiJob
Run Project Mutation JobPlay
Run Project Mutation JobRetry
Update Project Mutation JobCancel
Update Project Mutation JobUnschedule

Job Artifact

Grants the ability to delete, read, and update job artifacts.

Action Access Kind Name
Delete Project Mutation ArtifactDestroy
Delete Project Mutation BulkDestroyJobArtifacts
Delete Project Mutation JobArtifactsDestroy
Read Project Type CiJobArtifact

Pipeline

Grants the ability to create, delete, read, and update pipelines.

Action Access Kind Name
Create Project Mutation PipelineCreate
Delete Project Mutation PipelineDestroy
Read Project Type CiStage
Read Project Type Pipeline
Update Project Mutation PipelineCancel
Update Project Mutation PipelineRetry

Pipeline Schedule

Grants the ability to create, delete, read, and update pipeline schedules.

Action Access Kind Name
Create Project Mutation PipelineScheduleCreate
Delete Project Mutation PipelineScheduleDelete
Read Project Type PipelineSchedule
Update Project Mutation PipelineSchedulePlay
Update Project Mutation PipelineScheduleTakeOwnership
Update Project Mutation PipelineScheduleUpdate

Runner

Grants the ability to assign, create, delete, read, and update runners.

Action Access Kind Name
Assign Project Mutation RunnerAssignToProject
Assign Project Mutation RunnerUnassignFromProject
Create Project Mutation RunnerCreate
Create Group Mutation RunnerCreate
Create Instance Mutation RunnerCreate
Delete Project Mutation RunnerDelete
Delete Group Mutation RunnerDelete
Delete Instance Mutation RunnerDelete
Read Project Type CiRunner
Read Group Type CiRunner
Read Instance Type CiRunner
Update Project Mutation RunnerCacheClear
Update Project Mutation RunnerUpdate
Update Group Mutation RunnerUpdate
Update Instance Mutation RunnerUpdate

Terraform State

Grants the ability to create, delete, lock, read, and update Terraform state.

Action Access Kind Name
Delete Project Mutation TerraformStateDelete
Lock Project Mutation TerraformStateLock
Lock Project Mutation TerraformStateUnlock
Read Project Type TerraformState
Read Project Type TerraformStateProtectionRule
Read Project Type TerraformStateVersion
Update Project Mutation UpdateTerraformStateProtectionRule

Terraform State Protection Rule

Grants the ability to create, delete, and update Terraform state protection rules.

Action Access Kind Name
Create Project Mutation CreateTerraformStateProtectionRule
Delete Project Mutation DeleteTerraformStateProtectionRule

Trigger

Grants the ability to create, delete, read, and update triggers.

Action Access Kind Name
Create Project Mutation PipelineTriggerCreate
Delete Project Mutation PipelineTriggerDelete
Read Project Type PipelineTrigger
Update Project Mutation PipelineTriggerUpdate

Duo resources

AI catalog item

Grants the ability to restore AI catalog items.

Action Access Kind Name
Restore Project Mutation AiCatalogItemVersionRestore

AI tool rule

Grants the ability to read and update AI tool rules, which control per-tool approval (Allow, Ask, Deny) for the Duo Agent Platform.

Action Access Kind Name
Read Group Field Query.aiToolRules
Update Group Mutation BulkUpdateAiToolRules
Update Group Mutation UpdateAiToolRule

Duo Workflow

Grants the ability to create, read, resume, and update duo workflows.

Action Access Kind Name
Read User Type DuoWorkflowWorkItemLink
Update User Mutation UpdateDuoWorkflowAgentPrivileges

Flows Metadata

Grants the ability to read flows metadata.

Action Access Kind Name
Read Project Type AiFlowsMetadata
Read Group Type AiFlowsMetadata
Read Instance Type AiFlowsMetadata

Model Selection Allowlist

Grants the ability to read and update model selection allowlists.

Action Access Kind Name
Read Group Type AiModelSelectionAllowList
Read Group Type AiModelSelectionAllowListModel
Read Instance Type AiModelSelectionAllowList
Read Instance Type AiModelSelectionAllowListModel
Update Group Mutation AiModelSelectionNamespaceModelAllowlistUpdate
Update Instance Mutation AiFeatureSettingModelAllowlistUpdate

Groups resources

Admin Member Role

Grants the ability to create, delete, read, and update admin member roles.

Action Access Kind Name
Create Instance Mutation MemberRoleAdminCreate
Delete Instance Mutation MemberRoleAdminDelete
Read Instance Type AdminMemberRole
Update Instance Mutation MemberRoleAdminUpdate

Group

Grants the ability to archive, create, delete, read, share, transfer, and update groups.

Action Access Kind Name
Read Group Type Group
Update Group Mutation GroupUpdate

Grants the ability to create, delete, and read LDAP admin role links

Action Access Kind Name
Create Instance Mutation AdminRolesLdapSync
Create Instance Mutation LdapAdminRoleLinkCreate
Delete Instance Mutation LdapAdminRoleLinkDestroy
Read Instance Type LdapAdminRoleLink

Member Role

Grants the ability to create, delete, and read member roles.

Action Access Kind Name
Create Group Mutation MemberRoleCreate
Create Instance Mutation MemberRoleCreate

Preference

Grants the ability to read and update preferences.

Action Access Kind Name
Read User Type UserPreferences
Update User Mutation UserPreferencesUpdate

Topic

Grants the ability to create, delete, merge, read, and update topics.

Action Access Kind Name
Read Instance Type Topic

Monitoring resources

Escalation Policy

Grants the ability to read escalation policies.

Action Access Kind Name
Read Project Type EscalationPolicyType

Notifications resources

Todo

Grants the ability to create, delete, read, and update todos.

Action Access Kind Name
Create Project Mutation TodoCreate
Create Group Mutation TodoCreate
Delete User Mutation TodoDeleteAllDone
Delete User Mutation TodoDeleteMany
Read User Type Todo
Update User Mutation TodoMarkDone
Update User Mutation TodoResolveMany
Update User Mutation TodoRestore
Update User Mutation TodoRestoreMany
Update User Mutation TodoSnooze
Update User Mutation TodoSnoozeMany
Update User Mutation TodoUnSnooze
Update User Mutation TodoUnsnoozeMany
Update User Mutation TodosMarkAllDone

Organizations resources

Organization

Grants the ability to create, delete, read, and update organizations.

Action Access Kind Name
Create Instance Mutation OrganizationCreate
Delete Instance Mutation OrganizationDelete
Read Instance Type Organization
Read Instance Type OrganizationUser
Update Instance Mutation OrganizationConfirm
Update Instance Mutation OrganizationUpdate
Update Instance Mutation OrganizationUserUpdate

Packages and Registry resources

Container Registry Protection Tag Rule

Grants the ability to create, delete, read, and update container registry protection tag rules.

Action Access Kind Name
Create Project Mutation createContainerProtectionTagRule
Delete Project Mutation DeleteContainerProtectionTagRule
Update Project Mutation UpdateContainerProtectionTagRule

Container Repository

Grants the ability to delete and read container repositories.

Action Access Kind Name
Delete Project Mutation DestroyContainerRepository
Delete Project Mutation DestroyContainerRepositoryTags

Container Repository Protection Rule

Grants the ability to create, delete, read, and update container repository protection rules.

Action Access Kind Name
Create Project Mutation CreateContainerProtectionRepositoryRule
Delete Project Mutation DeleteContainerProtectionRepositoryRule
Update Project Mutation UpdateContainerProtectionRepositoryRule

Dependency Proxy

Grants the ability to read and update dependency proxies.

Action Access Kind Name
Update Group Mutation UpdateDependencyProxyImageTtlGroupPolicy
Update Group Mutation UpdateDependencyProxySettings

Package

Grants the ability to create, delete, read, and update packages.

Action Access Kind Name
Create Project Mutation CreatePackagesProtectionRule
Delete Project Mutation DeletePackagesProtectionRule
Delete Project Mutation DestroyPackage
Delete Project Mutation DestroyPackageFile
Delete Project Mutation DestroyPackageFiles
Update Project Mutation UpdatePackagesCleanupPolicy
Update Project Mutation UpdatePackagesProtectionRule

Project Features resources

Badge

Grants the ability to create, delete, read, and update badges.

Action Access Kind Name
Read Instance Type OrganizationUserBadge

Cycle Analytics

Grants the ability to read cycle analytics.

Action Access Kind Name
Read Project Field Analytics.mergeRequests
Read Group Field Analytics.mergeRequests

Release

Grants the ability to create, delete, read, and update releases.

Action Access Kind Name
Create Project Mutation ReleaseAssetLinkCreate
Create Project Mutation ReleaseCreate
Delete Project Mutation ReleaseDelete
Update Project Mutation ReleaseUpdate

Snippet

Grants the ability to create, delete, read, and update snippets.

Action Access Kind Name
Create Project Mutation CreateSnippet
Create User Mutation CreateSnippet
Delete Project Mutation DestroySnippet
Delete User Mutation DestroySnippet
Update Project Mutation UpdateSnippet
Update User Mutation UpdateSnippet

Project Model Registry and Experiments resources

Model Version

Grants the ability to create, delete, read, and update model versions.

Action Access Kind Name
Create Project Mutation MlModelVersionCreate
Delete Project Mutation MlModelVersionDelete
Update Project Mutation MlModelVersionEdit

Project Planning resources

Custom Attribute

Grants the ability to delete, read, and update custom attributes.

Action Access Kind Name
Delete Project Mutation DeleteProjectCustomAttribute
Delete Group Mutation DeleteGroupCustomAttribute
Update Project Mutation ProjectCustomAttributeSet
Update Group Mutation SetGroupCustomAttribute

Label

Grants the ability to create, delete, promote, read, subscribe, and update labels.

Action Access Kind Name
Create Project Mutation LabelCreate
Create Group Mutation LabelCreate
Read Project Type Label
Read Group Type Label
Update Project Mutation LabelUpdate
Update Group Mutation LabelUpdate

Work Item

Grants the ability to create, delete, read, and update work items such as epics and issues.

Action Access Kind Name
Create Project Mutation CreateDiffNote
Create Project Mutation CreateDiscussion
Create Project Mutation CreateImageDiffNote
Create Project Mutation CreateIssue
Create Project Mutation CreateLatestDiffNote
Create Project Mutation CreateNote
Create Project Mutation WorkItemCreate
Create Project Field EpicIssue.createNoteEmail
Create Project Field Issue.createNoteEmail
Create Project Field WorkItem.createNoteEmail
Create Group Mutation CreateDiffNote
Create Group Mutation CreateDiscussion
Create Group Mutation CreateImageDiffNote
Create Group Mutation CreateLatestDiffNote
Create Group Mutation CreateNote
Create Group Mutation IterationCadenceCreate
Create Group Mutation WorkItemCreate
Delete Project Mutation DestroyNote
Delete Project Mutation WorkItemDelete
Delete Group Mutation DestroyNote
Delete Group Mutation IterationCadenceDestroy
Delete Group Mutation IterationDelete
Delete Group Mutation WorkItemDelete
Read Project Type Board
Read Project Type EpicIssue
Read Project Type Issue
Read Project Type Milestone
Read Project Type Note
Read Project Type WorkItem
Read Group Type Board
Read Group Type BoardEpic
Read Group Type Epic
Read Group Type Iteration
Read Group Type IterationCadence
Read Group Type Milestone
Read Group Type Note
Read Group Type WorkItemMoveTarget
Update Project Mutation IssueLinkAlerts
Update Project Mutation IssueMove
Update Project Mutation IssueSetAssignees
Update Project Mutation IssueSetConfidential
Update Project Mutation IssueSetCrmContacts
Update Project Mutation IssueSetDueDate
Update Project Mutation IssueSetEpic
Update Project Mutation IssueSetEscalationPolicy
Update Project Mutation IssueSetEscalationStatus
Update Project Mutation IssueSetIteration
Update Project Mutation IssueSetLocked
Update Project Mutation IssueSetSeverity
Update Project Mutation IssueSetWeight
Update Project Mutation IssueUnlinkAlert
Update Project Mutation UpdateImageDiffNote
Update Project Mutation UpdateIssue
Update Project Mutation UpdateNote
Update Project Mutation WorkItemAddClosingMergeRequest
Update Project Mutation WorkItemConvert
Update Project Mutation WorkItemCreateFromTask
Update Project Mutation WorkItemUpdate
Update Project Mutation workItemsReorder
Update Group Mutation IterationCadenceUpdate
Update Group Mutation UpdateImageDiffNote
Update Group Mutation UpdateIteration
Update Group Mutation UpdateNote
Update Group Mutation WorkItemAddClosingMergeRequest
Update Group Mutation WorkItemConvert
Update Group Mutation WorkItemUpdate
Update Group Mutation workItemsReorder

Projects resources

Markdown Upload

Grants the ability to create, delete, and read Markdown uploads.

Action Access Kind Name
Create Project Mutation UploadCreate
Create Group Mutation UploadCreate
Delete Project Mutation UploadDelete
Delete Group Mutation UploadDelete

Page

Grants the ability to delete, read, and update pages.

Action Access Kind Name
Delete Project Mutation DeletePagesDeployment
Delete Project Mutation RestorePagesDeployment
Read Project Type PagesDeployment
Update Project Mutation PagesMarkOnboardingComplete
Update Project Mutation SetPagesForceHttps
Update Project Mutation SetPagesUseUniqueDomain

Project

Grants the ability to archive, create, delete, fork, read, share, transfer, and update projects.

Action Access Kind Name
Read Project Type Project
Read Project Type RepositoryLanguage
Update Project Mutation ProjectSettingsUpdate
Update Project Mutation StarProject

Repository resources

Approval Rule

Grants the ability to create, delete, read, and update approval rules.

Action Access Kind Name
Create Project Mutation branchRuleApprovalProjectRuleCreate
Delete Project Mutation approvalProjectRuleDelete
Read Project Type ApprovalProjectRule
Read Project Type ApprovalRule
Update Project Mutation MergeRequestUpdateApprovalRule
Update Project Mutation approvalProjectRuleUpdate

Branch

Grants the ability to create, delete, protect, and read branches.

Action Access Kind Name
Create Project Mutation CreateBranch
Delete Project Mutation BranchDelete
Read Project Type Branch

Branch Rule

Grants the ability to create and update branch rules.

Action Access Kind Name
Create Project Mutation BranchRuleCreate
Update Project Mutation BranchRuleUpdate

Code

Grants the ability to download, push, and read code via Git.

Action Access Kind Name
Push Project Mutation CommitCreate
Push Project Mutation ProjectSyncFork
Read Project Type Commit
Read Project Type Repository

Merge Request

Grants the ability to approve, create, delete, merge, read, subscribe, and update merge requests.

Action Access Kind Name
Create Project Mutation MergeRequestCreate
Merge Project Mutation MergeRequestAccept
Read Project Type MergeRequest
Read Project Type MergeRequestApprovalState
Read Project Type MergeRequestWorkItemRelation
Update Project Mutation DismissPolicyViolations
Update Project Mutation MergeRequestBypassSecurityPolicy
Update Project Mutation MergeRequestCreateWorkItemRelations
Update Project Mutation MergeRequestDestroyRequestedChanges
Update Project Mutation MergeRequestDestroyWorkItemRelations
Update Project Mutation MergeRequestRequestChanges
Update Project Mutation MergeRequestSetAssignees
Update Project Mutation MergeRequestSetBlockingMergeRequests
Update Project Mutation MergeRequestSetDraft
Update Project Mutation MergeRequestSetLabels
Update Project Mutation MergeRequestSetLocked
Update Project Mutation MergeRequestSetMilestone
Update Project Mutation MergeRequestSetReviewers
Update Project Mutation MergeRequestUpdate

Push Rule

Grants the ability to create, delete, read, and update push rules.

Action Access Kind Name
Read Project Type PushRules

Repository

Grants the ability to create, delete, read, and update repositories.

Action Access Kind Name
Read Project Type Blob
Read Project Type RepositoryBlob
Read Project Type Tree

Repository Tag

Grants the ability to create, delete, and read repository tags.

Action Access Kind Name
Create Project Mutation TagCreate
Delete Project Mutation TagDelete
Read Project Type Tag

System Access resources

Email

Grants the ability to create, delete, and read emails.

Action Access Kind Name
Read User Type Email

Job Token Scope

Grants the ability to read and update job token scopes.

Action Access Kind Name
Update Project Mutation CiJobTokenScopeUpdatePolicies

Job Token Scope Allowlist

Grants the ability to create, delete, and read job token scope allowlists.

Action Access Kind Name
Create Project Mutation CiJobTokenScopeAddGroupOrProject
Create Project Mutation CiJobTokenScopeAddProject
Delete Project Mutation CiJobTokenScopeRemoveGroup
Delete Project Mutation CiJobTokenScopeRemoveProject

Member

Grants the ability to create, delete, read, and update members.

Action Access Kind Name
Read Project Type ProjectMember
Read Group Type GroupMember
Update Project Mutation ProjectMemberBulkUpdate
Update Group Mutation GroupMemberBulkUpdate

Metadata

Grants the ability to read instance metadata.

Action Access Kind Name
Read Instance Type GitlabInstanceFeatureFlag
Read Instance Type Kas
Read Instance Type Metadata

Personal Access Token

Grants the ability to create, read, revoke, and rotate personal access tokens.

Action Access Kind Name
Create User Mutation PersonalAccessTokenCreate
Revoke User Mutation PersonalAccessTokenRevoke
Rotate User Mutation PersonalAccessTokenRotate

User

Grants the ability to activate, approve, ban, block, create, deactivate, delete, disable two factor, follow, read, reject, unban, unblock, unfollow, and update users.

Action Access Kind Name
Read User Type AddOnUser
Read User Type AutocompletedUser
Read User Type CurrentUser
Read User Type MergeRequestAssignee
Read User Type MergeRequestAuthor
Read User Type MergeRequestParticipant
Read User Type MergeRequestReviewer
Read User Type UserCore