Fine-grained permissions for GraphQL API

  • Tier: Free, Premium, Ultimate
  • Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

A fine-grained personal access token can access only the resources and permissions you grant it. To use one with the GraphQL API, create a token and define its scope. For more information, see fine-grained personal access tokens.

Available fine-grained permissions

Fine-grained personal access tokens can access the following GraphQL types, mutations, and fields:

Application Security resources

Dependency

Grants the ability to read dependencies.

Action Access Kind Name
Read Project Type DependencyLocation
Read Project Type DependencyTrackedRef

Finding Token Status

Grants the ability to update finding token statuses.

Action Access Kind Name
Update Project Mutation RefreshFindingTokenStatus
Update Project Mutation RefreshVulnerabilityFindingTokenStatus

Pipeline Execution Project Schedule

Grants the ability to read pipeline execution project schedules.

Action Access Kind Name
Read Project Type PipelineExecutionProjectSchedule

Secrets Manager

Grants the ability to read secrets managers.

Action Access Kind Name
Read Project Type ProjectSecretsManager
Read Group Type GroupSecretsManager
Read Group Type SecretsManagerEntitlement
Read Group Mutation SecretsManagerStartTrial

Security Attribute

Grants the ability to create, delete, and update security attributes.

Action Access Kind Name
Create Group Mutation SecurityAttributeCreate
Create Group Mutation SecurityCategoryCreate
Delete Group Mutation SecurityAttributeDestroy
Delete Group Mutation SecurityCategoryDestroy
Update Project Mutation SecurityAttributeProjectUpdate
Update Group Mutation SecurityAttributeUpdate
Update Group Mutation SecurityCategoryUpdate

Security Dashboard

Grants the ability to update security dashboards.

Action Access Kind Name
Update Project Mutation AddProjectToSecurityDashboard
Update Project Mutation RemoveProjectFromSecurityDashboard

Security Scan Profiles

Grants the ability to create, delete, and update security scan profiles.

Action Access Kind Name
Create Group Mutation SecurityScanProfileCreate
Delete Group Mutation SecurityScanProfileDelete
Update Group Mutation SecurityScanProfileUpdate

Vulnerability

Grants the ability to archive, create, read, and update vulnerabilities.

Action Access Kind Name
Archive Project Mutation VulnerabilitiesArchive
Create Project Mutation VulnerabilityCreate
Read Project Type CountableVulnerability
Read Project Type Vulnerability
Read Project Type VulnerabilityScanner
Read Project Field MergeRequest.findingReportsComparer
Read Project Field Project.vulnerabilityWorkflowExecution
Update Project Mutation BulkSetVulnerabilityFindingsDueDates
Update Project Mutation VulnerabilityAutoRemediation
Update Project Mutation VulnerabilityConfirm
Update Project Mutation VulnerabilityDismiss
Update Project Mutation VulnerabilityResolve
Update Project Mutation VulnerabilityRevertToDetected

Vulnerability Duo Workflow

Grants the ability to execute vulnerability duo workflows.

Action Access Kind Name
Execute Project Mutation CancelVulnerabilityWorkflow
Execute Project Mutation StartVulnerabilityWorkflow

Vulnerability Flag

Grants the ability to update vulnerability flags.

Action Access Kind Name
Update Project Mutation VulnerabilityDismissFalsePositiveFlag

Grants the ability to create, delete, and read vulnerability issue links.

Action Access Kind Name
Create Project Mutation SecurityFindingCreateIssue
Create Project Mutation SecurityFindingExternalIssueLinkCreate
Create Project Mutation SecurityFindingJiraIssueFormUrlCreate
Create Project Mutation VulnerabilitiesCreateIssue
Create Project Mutation VulnerabilityExternalIssueLinkCreate
Create Project Mutation VulnerabilityIssueLinkCreate
Delete Project Mutation VulnerabilityExternalIssueLinkDestroy

Grants the ability to create and delete vulnerability merge request links.

Action Access Kind Name
Create Project Mutation VulnerabilityLinkMergeRequest
Delete Project Mutation VulnerabilityUnlinkMergeRequest

CI/CD resources

Catalog Bundled Resource

Grants the ability to read bundled CI catalog resources.

Action Access Kind Name
Read Instance Type CiCatalogBundledResource

Catalog Resource

Grants the ability to create and delete CI catalog resources.

Action Access Kind Name
Create Project Mutation CatalogResourcesCreate
Delete Project Mutation CatalogResourcesDestroy

CD Application

Grants the ability to create, read, and update continuous deployment applications.

Action Access Kind Name
Create Instance Mutation CdApplicationCreate
Read Instance Type CdApplication
Update Instance Mutation CdApplicationUpdate

CD Application Flow Definition

Grants the ability to create and read continuous deployment application flow definitions.

Action Access Kind Name
Create Instance Mutation CdApplicationFlowDefinitionCreate
Read Instance Type CdApplicationFlowDefinition

Grants the ability to create, delete, read, and update continuous deployment application links.

Action Access Kind Name
Create Instance Mutation CdApplicationLinkCreate
Delete Instance Mutation CdApplicationLinkDelete
Read Instance Type CdApplicationLink
Update Instance Mutation CdApplicationLinkUpdate

CD Artifact Source

Grants the ability to create and read continuous deployment artifact sources.

Action Access Kind Name
Create Instance Mutation CdArtifactSourceCreate
Read Instance Type CdArtifactSource
Read Instance Type CdVersion

CD Environment

Grants the ability to create, read, and update continuous deployment environments.

Action Access Kind Name
Create Instance Mutation CdEnvironmentCreate
Read Instance Type CdEnvironment
Read Instance Type CdEnvironmentApplication
Read Instance Type CdEnvironmentDriverBinding
Update Instance Mutation CdEnvironmentDriverBindingCreate
Update Instance Mutation CdEnvironmentUpdate

CD Rollout

Grants the ability to create and read CD rollouts.

Action Access Kind Name
Create Instance Mutation CdRolloutCreate
Read Instance Type CdDeployment
Read Instance Type CdDeploymentTransition
Read Instance Type CdRollout
Read Instance Type CdRolloutEnvironment
Read Instance Type CdRolloutStep
Read Instance Type CdRolloutTransition

CD Rollout Gate

Grants the ability to resolve CD rollout gates.

Action Access Kind Name
Resolve Instance Mutation CdRolloutGateResolve

CD Service

Grants the ability to create, read, and update continuous deployment services.

Action Access Kind Name
Create Instance Mutation CdServiceCreate
Read Instance Type CdService
Read Instance Type CdServiceEnvironmentHealth
Update Instance Mutation CdServiceUpdate

CD Version Set

Grants the ability to create and read continuous deployment version sets.

Action Access Kind Name
Create Instance Mutation CdVersionSetCreate
Read Instance Type CdVersionSet
Read Instance Type CdVersionSetEntry

CI Config

Grants the ability to read and validate CI/CD configuration.

Action Access Kind Name
Validate Project Mutation CiLint

CI Namespace Settings

Grants the ability to update CI namespace settings.

Action Access Kind Name
Update Group Mutation NamespaceSettingsUpdate

CI/CD Setting

Grants the ability to update CI/CD settings.

Action Access Kind Name
Update Project Mutation ProjectCiCdSettingsUpdate
Update Group Mutation SafeDisablePipelineVariables

Cluster Agent

Grants the ability to create, delete, and read cluster agents.

Action Access Kind Name
Create Project Mutation CreateClusterAgent
Delete Project Mutation ClusterAgentDelete
Read Project Type ClusterAgent

Cluster Agent Token

Grants the ability to create, read, and revoke cluster agent tokens.

Action Access Kind Name
Create Project Mutation ClusterAgentTokenCreate

Cluster Agent URL Configuration

Grants the ability to create, delete, and read cluster agent URL configurations.

Action Access Kind Name
Create Project Mutation ClusterAgentUrlConfigurationCreate
Delete Project Mutation ClusterAgentUrlConfigurationDelete

Deployment

Grants the ability to approve, create, delete, read, and update deployments.

Action Access Kind Name
Approve Project Mutation ApproveDeployment

Environment

Grants the ability to create, delete, read, stop, and update environments.

Action Access Kind Name
Create Project Mutation EnvironmentCreate
Delete Project Mutation EnvironmentDelete
Read Project Type Environment
Stop Project Mutation EnvironmentStop
Update Project Mutation EnvironmentUpdate

Freeze Period

Grants the ability to create, delete, read, and update freeze periods.

Action Access Kind Name
Read Project Type CiFreezePeriod

Job

Grants the ability to delete, read, run, and update jobs.

Action Access Kind Name
Read Project Type CiJob
Run Project Mutation JobPlay
Run Project Mutation JobRetry
Update Project Mutation JobCancel
Update Project Mutation JobUnschedule

Job Artifact

Grants the ability to delete, read, and update job artifacts.

Action Access Kind Name
Delete Project Mutation ArtifactDestroy
Delete Project Mutation BulkDestroyJobArtifacts
Delete Project Mutation JobArtifactsDestroy
Read Project Type CiJobArtifact

Merge Train Car

Grants the ability to delete merge train cars.

Action Access Kind Name
Delete Project Mutation MergeTrainsDeleteCar

Pipeline

Grants the ability to create, delete, read, and update pipelines.

Action Access Kind Name
Create Project Mutation PipelineCreate
Delete Project Mutation PipelineDestroy
Read Project Type CiStage
Read Project Type Pipeline
Update Project Mutation PipelineCancel
Update Project Mutation PipelineRetry

Pipeline Schedule

Grants the ability to create, delete, read, and update pipeline schedules.

Action Access Kind Name
Create Project Mutation PipelineScheduleCreate
Delete Project Mutation PipelineScheduleDelete
Read Project Type PipelineSchedule
Update Project Mutation PipelineSchedulePlay
Update Project Mutation PipelineScheduleTakeOwnership
Update Project Mutation PipelineScheduleUpdate

Runner

Grants the ability to assign, create, delete, read, and update runners.

Action Access Kind Name
Assign Project Mutation RunnerAssignToProject
Assign Project Mutation RunnerUnassignFromProject
Create Project Mutation RunnerCreate
Create Group Mutation RunnerCreate
Create Instance Mutation RunnerCreate
Delete Project Mutation RunnerDelete
Delete Group Mutation RunnerDelete
Delete Instance Mutation RunnerDelete
Read Project Type CiRunner
Read Group Type CiRunner
Read Instance Type CiRunner
Update Project Mutation RunnerCacheClear
Update Project Mutation RunnerUpdate
Update Group Mutation RunnerUpdate
Update Instance Mutation RunnerUpdate

Terraform State

Grants the ability to create, delete, lock, and read Terraform state.

Action Access Kind Name
Delete Project Mutation TerraformStateDelete
Lock Project Mutation TerraformStateLock
Lock Project Mutation TerraformStateUnlock
Read Project Type TerraformState
Read Project Type TerraformStateProtectionRule
Read Project Type TerraformStateVersion

Terraform State Protection Rule

Grants the ability to create, delete, and update Terraform state protection rules.

Action Access Kind Name
Create Project Mutation CreateTerraformStateProtectionRule
Delete Project Mutation DeleteTerraformStateProtectionRule
Update Project Mutation UpdateTerraformStateProtectionRule

Trigger

Grants the ability to create, delete, read, and update triggers.

Action Access Kind Name
Create Project Mutation PipelineTriggerCreate
Delete Project Mutation PipelineTriggerDelete
Read Project Type PipelineTrigger
Update Project Mutation PipelineTriggerUpdate

Verified Namespace

Grants the ability to create verified namespaces.

Action Access Kind Name
Create Instance Mutation VerifiedNamespaceCreate

Compliance resources

Audit Event Streaming Destination

Grants the ability to create, delete, and update audit event streaming destinations.

Action Access Kind Name
Create Group Mutation AuditEventsAmazonS3ConfigurationCreate
Create Group Mutation ExternalAuditEventDestinationCreate
Create Group Mutation GoogleCloudLoggingConfigurationCreate
Create Group Mutation GroupAuditEventStreamingDestinationsCreate
Create Instance Mutation AuditEventsInstanceAmazonS3ConfigurationCreate
Create Instance Mutation InstanceAuditEventStreamingDestinationsCreate
Create Instance Mutation InstanceExternalAuditEventDestinationCreate
Create Instance Mutation InstanceGoogleCloudLoggingConfigurationCreate
Delete Group Mutation AuditEventsAmazonS3ConfigurationDelete
Delete Group Mutation ExternalAuditEventDestinationDestroy
Delete Group Mutation GoogleCloudLoggingConfigurationDestroy
Delete Group Mutation GroupAuditEventStreamingDestinationsDelete
Delete Instance Mutation AuditEventsInstanceAmazonS3ConfigurationDelete
Delete Instance Mutation InstanceAuditEventStreamingDestinationsDelete
Delete Instance Mutation InstanceExternalAuditEventDestinationDestroy
Delete Instance Mutation InstanceGoogleCloudLoggingConfigurationDestroy
Update Group Mutation AuditEventsAmazonS3ConfigurationUpdate
Update Group Mutation AuditEventsGroupDestinationDenylistEventsAdd
Update Group Mutation AuditEventsGroupDestinationDenylistEventsDelete
Update Group Mutation AuditEventsGroupDestinationEventsAdd
Update Group Mutation AuditEventsGroupDestinationEventsDelete
Update Group Mutation AuditEventsGroupDestinationNamespaceFilterCreate
Update Group Mutation AuditEventsGroupDestinationNamespaceFilterDelete
Update Group Mutation AuditEventsStreamingDestinationEventsAdd
Update Group Mutation AuditEventsStreamingDestinationEventsRemove
Update Group Mutation AuditEventsStreamingHTTPNamespaceFiltersAdd
Update Group Mutation AuditEventsStreamingHTTPNamespaceFiltersDelete
Update Group Mutation AuditEventsStreamingHeadersCreate
Update Group Mutation AuditEventsStreamingHeadersDestroy
Update Group Mutation AuditEventsStreamingHeadersUpdate
Update Group Mutation ExternalAuditEventDestinationUpdate
Update Group Mutation GoogleCloudLoggingConfigurationUpdate
Update Group Mutation GroupAuditEventStreamingDestinationsUpdate
Update Instance Mutation AuditEventsInstanceAmazonS3ConfigurationUpdate
Update Instance Mutation AuditEventsInstanceDestinationEventsAdd
Update Instance Mutation AuditEventsInstanceDestinationEventsDelete
Update Instance Mutation AuditEventsInstanceDestinationNamespaceFilterCreate
Update Instance Mutation AuditEventsInstanceDestinationNamespaceFilterDelete
Update Instance Mutation AuditEventsStreamingDestinationInstanceEventsAdd
Update Instance Mutation AuditEventsStreamingDestinationInstanceEventsRemove
Update Instance Mutation AuditEventsStreamingInstanceHeadersCreate
Update Instance Mutation AuditEventsStreamingInstanceHeadersDestroy
Update Instance Mutation AuditEventsStreamingInstanceHeadersUpdate
Update Instance Mutation InstanceAuditEventStreamingDestinationsUpdate
Update Instance Mutation InstanceExternalAuditEventDestinationUpdate
Update Instance Mutation InstanceGoogleCloudLoggingConfigurationUpdate

Compliance Dashboard

Grants the ability to read compliance dashboards.

Action Access Kind Name
Read Group Mutation RefreshStandardsAdherenceChecks

Compliance Framework

Grants the ability to create, delete, and update compliance frameworks.

Action Access Kind Name
Create Group Mutation CreateComplianceFramework
Create Group Mutation CreateComplianceFrameworkFromTemplate
Create Group Mutation CreateComplianceRequirement
Create Group Mutation CreateComplianceRequirementsControl
Delete Group Mutation DestroyComplianceFramework
Delete Group Mutation DestroyComplianceRequirement
Delete Group Mutation DestroyComplianceRequirementsControl
Update Project Mutation ProjectSetComplianceFramework
Update Project Mutation ProjectUpdateComplianceFrameworks
Update Group Mutation UpdateComplianceFramework
Update Group Mutation UpdateComplianceRequirement
Update Group Mutation UpdateComplianceRequirementsControl

Compliance Violations Report

Grants the ability to update compliance violations reports.

Action Access Kind Name
Update Project Mutation LinkProjectComplianceViolationIssue
Update Project Mutation UnlinkProjectComplianceViolationIssue
Update Project Mutation UpdateProjectComplianceViolation

External Status Check

Grants the ability to create, delete, read, retry, and update external status checks.

Action Access Kind Name
Create Project Mutation BranchRuleExternalStatusCheckCreate
Delete Project Mutation BranchRuleExternalStatusCheckDestroy
Update Project Mutation BranchRuleExternalStatusCheckUpdate

Duo resources

AI catalog item

Grants the ability to restore AI catalog items.

Action Access Kind Name
Restore Project Mutation AiCatalogItemVersionRestore

AI catalog MCP server

Grants the ability to block AI catalog MCP servers.

Action Access Kind Name
Block Project Mutation AiCatalogMcpServerSetBlock
Block Group Mutation AiCatalogMcpServerSetBlock

AI tool rule

Grants the ability to read and update AI tool rules, which control per-tool approval (Allow, Ask, Deny) for the Duo Agent Platform.

Action Access Kind Name
Read Group Field Query.aiToolRules
Update Group Mutation BulkUpdateAiToolRules
Update Group Mutation UpdateAiToolRule

AI usage metric

Grants the ability to read per-user GitLab Duo usage metrics.

Action Access Kind Name
Read Project Field Project.aiUserMetrics
Read Group Field Group.aiUserMetrics

Duo Workflow

Grants the ability to create, read, resume, and update duo workflows.

Action Access Kind Name
Read User Type DuoWorkflowMergeRequestLink
Read User Type DuoWorkflowNoteLink
Read User Type DuoWorkflowWorkItemLink
Read User Field Note.duoTriggeredSession
Update User Mutation UpdateDuoWorkflowAgentPrivileges
Update User Mutation UpdateDuoWorkflowWebSearch

Flows Metadata

Grants the ability to read flows metadata.

Action Access Kind Name
Read Project Type AiFlowsMetadata
Read Group Type AiFlowsMetadata
Read Instance Type AiFlowsMetadata

Model Selection Allowlist

Grants the ability to read and update model selection allowlists.

Action Access Kind Name
Read Group Type AiModelSelectionAllowList
Read Group Type AiModelSelectionAllowListModel
Read Instance Type AiModelSelectionAllowList
Read Instance Type AiModelSelectionAllowListModel
Update Group Mutation AiModelSelectionNamespaceModelAllowlistUpdate
Update Instance Mutation AiFeatureSettingModelAllowlistUpdate

Geo resources

Geo Registry

Grants the ability to update Geo registries.

Action Access Kind Name
Update Instance Mutation GeoRegistriesBulkUpdate
Update Instance Mutation GeoRegistriesUpdate

GitLab Orbit resources

Knowledge Graph Setting

Grants the ability to update knowledge graph settings.

Action Access Kind Name
Update Group Mutation OrbitUpdate

Groups resources

Admin Member Role

Grants the ability to create, delete, read, and update admin member roles.

Action Access Kind Name
Create Instance Mutation MemberRoleAdminCreate
Delete Instance Mutation MemberRoleAdminDelete
Read Instance Type AdminMemberRole
Update Instance Mutation MemberRoleAdminUpdate

Group

Grants the ability to archive, create, delete, read, share, transfer, and update groups.

Action Access Kind Name
Read Group Type Group
Transfer Group Mutation GroupTransfer
Update Group Mutation GroupUpdate

Grants the ability to create, delete, and read LDAP admin role links

Action Access Kind Name
Create Instance Mutation AdminRolesLdapSync
Create Instance Mutation LdapAdminRoleLinkCreate
Delete Instance Mutation LdapAdminRoleLinkDestroy
Read Instance Type LdapAdminRoleLink

Member Role

Grants the ability to assign, create, delete, read, and update member roles.

Action Access Kind Name
Assign Instance Mutation MemberRoleToUserAssign
Create Group Mutation MemberRoleCreate
Create Instance Mutation MemberRoleCreate
Delete Group Mutation MemberRoleDelete
Delete Instance Mutation MemberRoleDelete
Update Group Mutation MemberRoleUpdate
Update Instance Mutation MemberRoleUpdate

Namespace

Grants the ability to read and update namespaces.

Action Access Kind Name
Read Project Mutation NamespacesRegenerateNewWorkItemEmailAddress

Namespace Ban

Grants the ability to delete namespace bans.

Action Access Kind Name
Delete Group Mutation NamespaceBanDestroy

Preference

Grants the ability to read and update preferences.

Action Access Kind Name
Read User Type UserPreferences
Update User Mutation UserPreferencesUpdate

Topic

Grants the ability to create, delete, merge, read, and update topics.

Action Access Kind Name
Read Instance Type Topic

Integrations resources

Integration Exclusion

Grants the ability to create and delete integration exclusions.

Action Access Kind Name
Create Instance Mutation IntegrationExclusionCreate
Delete Instance Mutation IntegrationExclusionDelete

Jira Import

Grants the ability to create Jira imports.

Action Access Kind Name
Create Project Mutation JiraImportStart
Create Project Mutation JiraImportUsers

Monitoring resources

Alert

Grants the ability to update alerts.

Action Access Kind Name
Update Project Mutation AlertSetAssignees
Update Project Mutation UpdateAlertStatus

Escalation Policy

Grants the ability to create, delete, read, and update escalation policies.

Action Access Kind Name
Create Project Mutation EscalationPolicyCreate
Delete Project Mutation EscalationPolicyDestroy
Read Project Type EscalationPolicyType
Update Project Mutation EscalationPolicyUpdate

HTTP Integration

Grants the ability to create, delete, and update HTTP integrations.

Action Access Kind Name
Create Project Mutation HttpIntegrationCreate
Create Project Mutation PrometheusIntegrationCreate
Delete Project Mutation HttpIntegrationDestroy
Update Project Mutation HttpIntegrationResetToken
Update Project Mutation HttpIntegrationUpdate
Update Project Mutation PrometheusIntegrationResetToken
Update Project Mutation PrometheusIntegrationUpdate

Grants the ability to create and delete issuable resource links.

Action Access Kind Name
Create Project Mutation IssuableResourceLinkCreate
Delete Project Mutation IssuableResourceLinkDestroy

On-call Schedule

Grants the ability to create, delete, and update on-call schedules.

Action Access Kind Name
Create Project Mutation OncallRotationCreate
Create Project Mutation OncallScheduleCreate
Delete Project Mutation OncallRotationDestroy
Delete Project Mutation OncallScheduleDestroy
Update Project Mutation OncallRotationUpdate
Update Project Mutation OncallScheduleUpdate

Sidekiq Job

Grants the ability to drop Sidekiq jobs.

Action Access Kind Name
Drop Instance Mutation AdminSidekiqQueuesDeleteJobs

Timeline Event

Grants the ability to create, delete, and update timeline events.

Action Access Kind Name
Create Project Mutation TimelineEventCreate
Create Project Mutation TimelineEventPromoteFromNote
Create Project Mutation TimelineEventTagCreate
Delete Project Mutation TimelineEventDestroy
Update Project Mutation TimelineEventUpdate

Notifications resources

Todo

Grants the ability to create, delete, read, and update todos.

Action Access Kind Name
Create Project Mutation AlertTodoCreate
Create Project Mutation TodoCreate
Create Group Mutation TodoCreate
Delete User Mutation TodoDeleteAllDone
Delete User Mutation TodoDeleteMany
Read User Type Todo
Update User Mutation TodoMarkDone
Update User Mutation TodoResolveMany
Update User Mutation TodoRestore
Update User Mutation TodoRestoreMany
Update User Mutation TodoSnooze
Update User Mutation TodoSnoozeMany
Update User Mutation TodoUnSnooze
Update User Mutation TodoUnsnoozeMany
Update User Mutation TodosMarkAllDone

Organizations resources

Organization

Grants the ability to create, delete, read, restore, and update organizations.

Action Access Kind Name
Create Instance Mutation OrganizationCreate
Delete Instance Mutation OrganizationDelete
Read Instance Type Organization
Read Instance Type OrganizationUser
Restore Instance Mutation OrganizationRestore
Update Instance Mutation OrganizationConfirm
Update Instance Mutation OrganizationUpdate
Update Instance Mutation OrganizationUserUpdate

Organization User

Grants the ability to delete organization users.

Action Access Kind Name
Delete Instance Mutation OrganizationUserDelete

Packages and Registry resources

Container Expiration Policy

Grants the ability to update container expiration policies.

Action Access Kind Name
Update Project Mutation UpdateContainerExpirationPolicy

Container Registry Protection Tag Rule

Grants the ability to create, delete, read, and update container registry protection tag rules.

Action Access Kind Name
Create Project Mutation createContainerProtectionTagRule
Delete Project Mutation DeleteContainerProtectionTagRule
Update Project Mutation UpdateContainerProtectionTagRule

Container Repository

Grants the ability to delete and read container repositories.

Action Access Kind Name
Delete Project Mutation DestroyContainerRepository
Delete Project Mutation DestroyContainerRepositoryTags

Container Repository Protection Rule

Grants the ability to create, delete, read, and update container repository protection rules.

Action Access Kind Name
Create Project Mutation CreateContainerProtectionRepositoryRule
Delete Project Mutation DeleteContainerProtectionRepositoryRule
Update Project Mutation UpdateContainerProtectionRepositoryRule

Dependency Proxy

Grants the ability to read and update dependency proxies.

Action Access Kind Name
Update Group Mutation UpdateDependencyProxyImageTtlGroupPolicy
Update Group Mutation UpdateDependencyProxySettings

Dependency Proxy Packages Setting

Grants the ability to update dependency proxy packages settings.

Action Access Kind Name
Update Project Mutation UpdateDependencyProxyPackagesSettings

Package

Grants the ability to create, delete, read, and update packages.

Action Access Kind Name
Create Project Mutation CreatePackagesProtectionRule
Delete Project Mutation DeletePackagesProtectionRule
Delete Project Mutation DestroyPackage
Delete Project Mutation DestroyPackageFile
Delete Project Mutation DestroyPackageFiles
Update Project Mutation UpdatePackagesCleanupPolicy
Update Project Mutation UpdatePackagesProtectionRule

Package Setting

Grants the ability to update package settings.

Action Access Kind Name
Update Project Mutation UpdateNamespacePackageSettings
Update Group Mutation UpdateNamespacePackageSettings
Update User Mutation UpdateNamespacePackageSettings

Virtual Registry

Grants the ability to create, delete, read, and update virtual registries.

Action Access Kind Name
Create Group Mutation ContainerUpstreamCreate
Create Group Mutation ContainerVirtualRegistryCreate
Create Group Mutation ContainerVirtualRegistryUpstreamCreate
Create Group Mutation MavenUpstreamCreate
Create Group Mutation MavenVirtualRegistryCreate
Delete Group Mutation ContainerUpstreamCacheDelete
Delete Group Mutation ContainerUpstreamDelete
Delete Group Mutation ContainerVirtualRegistryCacheDelete
Delete Group Mutation ContainerVirtualRegistryDelete
Delete Group Mutation ContainerVirtualRegistryUpstreamDelete
Delete Group Mutation MavenUpstreamCacheDelete
Delete Group Mutation MavenUpstreamDelete
Delete Group Mutation MavenVirtualRegistryCacheDelete
Delete Group Mutation MavenVirtualRegistryDelete
Delete Group Mutation MavenVirtualRegistryUpstreamDelete
Update Group Mutation ContainerUpstreamTest
Update Group Mutation ContainerUpstreamUpdate
Update Group Mutation ContainerVirtualRegistryUpdate
Update Group Mutation ContainerVirtualRegistryUpstreamUpdate
Update Group Mutation MavenUpstreamUpdate
Update Group Mutation MavenVirtualRegistryUpdate
Update Group Mutation MavenVirtualRegistryUpstreamUpdate
Update Group Mutation UpdateVirtualRegistriesSetting

Virtual Registry Cleanup Policy

Grants the ability to create, delete, read, and update virtual registry cleanup policies.

Action Access Kind Name
Update Group Mutation VirtualRegistriesCleanupPolicyUpsert

Product Analytics resources

Custom Dashboard

Grants the ability to create, delete, and update custom dashboards.

Action Access Kind Name
Create Instance Mutation CreateCustomDashboard
Delete Instance Mutation DeleteCustomDashboard
Update Instance Mutation UpdateCustomDashboard

DevOps Adoption

Grants the ability to enable DevOps adoption for namespaces.

Action Access Kind Name
Enable Group Mutation EnableDevopsAdoptionNamespace

Project Features resources

Badge

Grants the ability to create, delete, read, and update badges.

Action Access Kind Name
Read Instance Type OrganizationUserBadge

Cycle Analytics

Grants the ability to read cycle analytics.

Action Access Kind Name
Read Project Field Analytics.mergeRequests
Read Group Field Analytics.mergeRequests

Release

Grants the ability to create, delete, read, and update releases.

Action Access Kind Name
Create Project Mutation ReleaseAssetLinkCreate
Create Project Mutation ReleaseCreate
Delete Project Mutation ReleaseDelete
Update Project Mutation ReleaseUpdate

Grants the ability to create, delete, read, and update release links.

Action Access Kind Name
Delete Project Mutation ReleaseAssetLinkDelete
Update Project Mutation ReleaseAssetLinkUpdate

Snippet

Grants the ability to create, delete, read, and update snippets.

Action Access Kind Name
Create Project Mutation CreateSnippet
Create User Mutation CreateSnippet
Delete Project Mutation DestroySnippet
Delete User Mutation DestroySnippet
Update Project Mutation UpdateSnippet
Update User Mutation UpdateSnippet

Project Model Registry and Experiments resources

ML Model

Grants the ability to create, delete, read, and update ML models.

Action Access Kind Name
Create Project Mutation MlModelCreate
Delete Project Mutation MlModelDelete
Delete Project Mutation MlModelDestroy
Update Project Mutation MlModelEdit

Model Version

Grants the ability to create, delete, read, and update model versions.

Action Access Kind Name
Create Project Mutation MlModelVersionCreate
Delete Project Mutation MlModelVersionDelete
Update Project Mutation MlModelVersionEdit

Project Planning resources

Custom Attribute

Grants the ability to delete, read, and update custom attributes.

Action Access Kind Name
Delete Project Mutation DeleteProjectCustomAttribute
Delete Group Mutation DeleteGroupCustomAttribute
Update Project Mutation ProjectCustomAttributeSet
Update Group Mutation SetGroupCustomAttribute

Design

Grants the ability to create, delete, and update designs.

Action Access Kind Name
Create Project Mutation DesignManagementUpload
Delete Project Mutation DesignManagementDelete
Update Project Mutation DesignManagementMove
Update Project Mutation DesignManagementUpdate

Label

Grants the ability to create, delete, promote, read, subscribe, and update labels.

Action Access Kind Name
Create Project Mutation LabelCreate
Create Group Mutation LabelCreate
Read Project Type Label
Read Group Type Label
Update Project Mutation LabelUpdate
Update Group Mutation LabelUpdate

Work Item

Grants the ability to create, delete, read, and update work items such as epics and issues.

Action Access Kind Name
Create 1 Project Mutation CreateAlertIssue
Create Project Mutation CreateDiffNote
Create Project Mutation CreateDiscussion
Create Project Mutation CreateImageDiffNote
Create Project Mutation CreateIssue
Create Project Mutation CreateLatestDiffNote
Create Project Mutation CreateNote
Create Project Mutation WorkItemCreate
Create Project Field EpicIssue.createNoteEmail
Create Project Field Issue.createNoteEmail
Create Project Field WorkItem.createNoteEmail
Create Group Mutation CreateDiffNote
Create Group Mutation CreateDiscussion
Create Group Mutation CreateImageDiffNote
Create Group Mutation CreateLatestDiffNote
Create Group Mutation CreateNote
Create Group Mutation IterationCadenceCreate
Create Group Mutation WorkItemCreate
Delete Project Mutation DestroyNote
Delete Project Mutation WorkItemDelete
Delete Group Mutation DestroyNote
Delete Group Mutation IterationCadenceDestroy
Delete Group Mutation IterationDelete
Delete Group Mutation WorkItemDelete
Read Project Type Board
Read Project Type EpicIssue
Read Project Type Issue
Read Project Type Milestone
Read Project Type Note
Read Project Type WorkItem
Read Group Type Board
Read Group Type BoardEpic
Read Group Type Epic
Read Group Type Iteration
Read Group Type IterationCadence
Read Group Type Milestone
Read Group Type Note
Read Group Type WorkItemMoveTarget
Update Project Mutation DiscussionToggleResolve
Update Project Mutation IssueLinkAlerts
Update Project Mutation IssueMove
Update Project Mutation IssueSetAssignees
Update Project Mutation IssueSetConfidential
Update Project Mutation IssueSetCrmContacts
Update Project Mutation IssueSetDueDate
Update Project Mutation IssueSetEpic
Update Project Mutation IssueSetEscalationPolicy
Update Project Mutation IssueSetEscalationStatus
Update Project Mutation IssueSetIteration
Update Project Mutation IssueSetLocked
Update Project Mutation IssueSetSeverity
Update Project Mutation IssueSetWeight
Update Project Mutation IssueUnlinkAlert
Update Project Mutation NoteConvertToThread
Update Project Mutation RepositionImageDiffNote
Update Project Mutation UpdateImageDiffNote
Update Project Mutation UpdateIssue
Update Project Mutation UpdateNote
Update Project Mutation WorkItemAddClosingMergeRequest
Update Project Mutation WorkItemConvert
Update Project Mutation WorkItemCreateFromTask
Update Project Mutation WorkItemEnableAiPlanning
Update Project Mutation WorkItemUpdate
Update Project Mutation workItemsReorder
Update Group Mutation IterationCadenceUpdate
Update Group Mutation UpdateImageDiffNote
Update Group Mutation UpdateIteration
Update Group Mutation UpdateNote
Update Group Mutation WorkItemAddClosingMergeRequest
Update Group Mutation WorkItemConvert
Update Group Mutation WorkItemEnableAiPlanning
Update Group Mutation WorkItemUpdate
Update Group Mutation workItemsReorder

1 Also requires the Update Alert permission.

Projects resources

Markdown Upload

Grants the ability to create, delete, and read Markdown uploads.

Action Access Kind Name
Create Project Mutation UploadCreate
Create Group Mutation UploadCreate
Delete Project Mutation UploadDelete
Delete Group Mutation UploadDelete

Page

Grants the ability to delete, read, and update pages.

Action Access Kind Name
Delete Project Mutation DeletePagesDeployment
Delete Project Mutation RestorePagesDeployment
Read Project Type PagesDeployment
Update Project Mutation PagesMarkOnboardingComplete
Update Project Mutation SetPagesForceHttps
Update Project Mutation SetPagesUseUniqueDomain

Project

Grants the ability to archive, create, delete, fork, read, share, transfer, and update projects.

Action Access Kind Name
Read Project Type Project
Read Project Type RepositoryLanguage
Transfer Project Mutation ProjectTransfer
Update Project Mutation ProjectSettingsUpdate
Update Project Mutation StarProject

Repository resources

Approval Rule

Grants the ability to create, delete, read, and update approval rules.

Action Access Kind Name
Create Project Mutation branchRuleApprovalProjectRuleCreate
Delete Project Mutation approvalProjectRuleDelete
Read Project Type ApprovalProjectRule
Read Project Type ApprovalRule
Update Project Mutation MergeRequestUpdateApprovalRule
Update Project Mutation approvalProjectRuleUpdate

Branch

Grants the ability to create, delete, protect, and read branches.

Action Access Kind Name
Create Project Mutation CreateBranch
Delete Project Mutation BranchDelete
Read Project Type Branch

Branch Rule

Grants the ability to create, delete, and update branch rules.

Action Access Kind Name
Create Project Mutation BranchRuleCreate
Delete Project Mutation BranchRuleDelete
Delete Project Mutation BranchRuleSquashOptionDelete
Update Project Mutation BranchRuleSquashOptionUpdate
Update Project Mutation BranchRuleUpdate

Code

Grants the ability to download, push, and read code via Git.

Action Access Kind Name
Push Project Mutation CommitCreate
Push Project Mutation ProjectSyncFork
Read Project Type Commit
Read Project Type Repository

Merge Request

Grants the ability to approve, create, delete, merge, read, subscribe, and update merge requests.

Action Access Kind Name
Create Project Mutation MergeRequestCreate
Merge Project Mutation MergeRequestAccept
Read Project Type MergeRequest
Read Project Type MergeRequestApprovalState
Read Project Type MergeRequestWorkItemRelation
Subscribe Project Mutation MergeRequestSetSubscription
Update Project Mutation DismissPolicyViolations
Update Project Mutation MergeRequestBypassSecurityPolicy
Update Project Mutation MergeRequestCreateWorkItemRelations
Update Project Mutation MergeRequestDestroyRequestedChanges
Update Project Mutation MergeRequestDestroyWorkItemRelations
Update Project Mutation MergeRequestRequestChanges
Update Project Mutation MergeRequestResyncSecurityPolicies
Update Project Mutation MergeRequestReviewerRereview
Update Project Mutation MergeRequestSetAssignees
Update Project Mutation MergeRequestSetBlockingMergeRequests
Update Project Mutation MergeRequestSetDraft
Update Project Mutation MergeRequestSetLabels
Update Project Mutation MergeRequestSetLocked
Update Project Mutation MergeRequestSetMilestone
Update Project Mutation MergeRequestSetReviewers
Update Project Mutation MergeRequestUpdate

Path Lock

Grants the ability to create path locks.

Action Access Kind Name
Create Project Mutation ProjectSetLocked

Push Rule

Grants the ability to create, delete, read, and update push rules.

Action Access Kind Name
Read Project Type PushRules

Repository

Grants the ability to create, delete, read, and update repositories.

Action Access Kind Name
Read Project Type Blob
Read Project Type RepositoryBlob
Read Project Type Tree

Repository History

Grants the ability to rewrite repository histories.

Action Access Kind Name
Rewrite Project Mutation projectBlobsRemove
Rewrite Project Mutation projectTextReplace

Repository Tag

Grants the ability to create, delete, and read repository tags.

Action Access Kind Name
Create Project Mutation TagCreate
Delete Project Mutation TagDelete
Read Project Type Tag

Target Branch Rule

Grants the ability to create and delete target branch rules.

Action Access Kind Name
Create Project Mutation ProjectTargetBranchRuleCreate
Delete Project Mutation ProjectTargetBranchRuleDestroy

Secrets Management resources

Secrets Manager Enrollment

Grants the ability to read secrets manager enrollments.

Action Access Kind Name
Read Instance Type SecretsManagerInstanceEnrollment

Subscription and Licensing resources

Add On Assignment

Grants the ability to create and delete add on assignments.

Action Access Kind Name
Create Group Mutation UserAddOnAssignmentBulkCreate
Create Group Mutation UserAddOnAssignmentCreate
Create Instance Mutation UserAddOnAssignmentBulkCreate
Create Instance Mutation UserAddOnAssignmentCreate
Delete Group Mutation UserAddOnAssignmentBulkRemove
Delete Group Mutation UserAddOnAssignmentRemove
Delete Instance Mutation UserAddOnAssignmentBulkRemove
Delete Instance Mutation UserAddOnAssignmentRemove

GitLab Subscription

Grants the ability to create, read, and update GitLab subscriptions.

Action Access Kind Name
Update Instance Mutation GitlabSubscriptionActivate

Member Approval

Grants the ability to update member approvals.

Action Access Kind Name
Update Instance Mutation ProcessUserBillablePromotionRequest

Subscription Usage Cap

Grants the ability to update subscription usage caps.

Action Access Kind Name
Update Group Mutation UpsertFlatUserCap
Update Group Mutation UpsertUserBudgetCapOverrides
Update Instance Mutation UpsertFlatUserCap
Update Instance Mutation UpsertUserBudgetCapOverrides

System Access resources

Email

Grants the ability to create, delete, and read emails.

Action Access Kind Name
Read User Type Email

Job Token Scope

Grants the ability to read and update job token scopes.

Action Access Kind Name
Update Project Mutation CiJobTokenScopeUpdatePolicies

Job Token Scope Allowlist

Grants the ability to create, delete, and read job token scope allowlists.

Action Access Kind Name
Create Project Mutation CiJobTokenScopeAddGroupOrProject
Create Project Mutation CiJobTokenScopeAddProject
Delete Project Mutation CiJobTokenScopeRemoveGroup
Delete Project Mutation CiJobTokenScopeRemoveProject

Member

Grants the ability to create, delete, read, and update members.

Action Access Kind Name
Read Project Type ProjectMember
Read Group Type GroupMember
Read Group Mutation GroupMembersExport
Update Project Mutation ProjectMemberBulkUpdate
Update Group Mutation GroupMemberBulkUpdate

Metadata

Grants the ability to read instance metadata.

Action Access Kind Name
Read Instance Type GitlabInstanceFeatureFlag
Read Instance Type Kas
Read Instance Type Metadata

Personal Access Token

Grants the ability to create, read, revoke, and rotate personal access tokens.

Action Access Kind Name
Create User Mutation PersonalAccessTokenCreate
Revoke User Mutation PersonalAccessTokenRevoke
Rotate User Mutation PersonalAccessTokenRotate

User

Grants the ability to activate, approve, ban, block, create, deactivate, delete, disable two factor, follow, read, reject, unban, unblock, unfollow, and update users.

Action Access Kind Name
Read User Type AddOnUser
Read User Type AutocompletedUser
Read User Type CurrentUser
Read User Type MergeRequestAssignee
Read User Type MergeRequestAuthor
Read User Type MergeRequestParticipant
Read User Type MergeRequestReviewer
Read User Type UserCore

Value Stream resources

Value Stream

Grants the ability to create, delete, and update value streams.

Action Access Kind Name
Create Project Mutation ValueStreamCreate
Create Group Mutation ValueStreamCreate
Delete Project Mutation ValueStreamDestroy
Delete Group Mutation ValueStreamDestroy
Update Project Mutation ValueStreamUpdate
Update Group Mutation ValueStreamUpdate

Wiki resources

Wiki

Grants the ability to create, delete, read, subscribe, and update wikis.

Action Access Kind Name
Subscribe Project Mutation WikiPageSubscribe

Workspace resources

Cluster Agent Mapping

Grants the ability to create and delete cluster agent mappings.

Action Access Kind Name
Create Group Mutation NamespaceCreateRemoteDevelopmentClusterAgentMapping
Create Instance Mutation OrganizationCreateClusterAgentMapping
Delete Group Mutation NamespaceDeleteRemoteDevelopmentClusterAgentMapping
Delete Instance Mutation OrganizationDeleteClusterAgentMapping

Workspace

Grants the ability to create and update workspaces.

Action Access Kind Name
Create Project Mutation WorkspaceCreate
Update Project Mutation WorkspaceUpdate