Fine-grained permissions for GraphQL API

Tier: Free, Premium, Ultimate
Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

A fine-grained personal access token can access only the resources and permissions you grant it. To use one with the GraphQL API, create a token and define its scope. For more information, see fine-grained personal access tokens.

Available fine-grained permissions

Fine-grained personal access tokens can access the following GraphQL types, mutations, and fields:

Application Security resources

Ascp

Grants the ability to create ascps.

Action	Access	Kind	Name
Create	Project	Mutation	`AscpComponentCreate`
Create	Project	Mutation	`AscpScanCreate`
Create	Project	Mutation	`AscpSecurityContextCreate`

Coverage Fuzzing Corpus

Grants the ability to create coverage fuzzing corpus.

Action	Access	Kind	Name
Create	Project	Mutation	`CorpusCreate`

Dependency

Grants the ability to read dependencies.

Action	Access	Kind	Name
Read	Project	Type	`DependencyLocation`
Read	Project	Type	`DependencyTrackedRef`

Finding Token Status

Grants the ability to update finding token statuses.

Action	Access	Kind	Name
Update	Project	Mutation	`RefreshFindingTokenStatus`
Update	Project	Mutation	`RefreshVulnerabilityFindingTokenStatus`

On-Demand DAST Scan

Grants the ability to create, delete, and update on-demand DAST scans, including their site profiles, scanner profiles, site tokens, and site validations.

Action	Access	Kind	Name
Create	Project	Mutation	`DastOnDemandScanCreate`
Create	Project	Mutation	`DastProfileCreate`
Create	Project	Mutation	`DastProfileRun`
Create	Project	Mutation	`DastScannerProfileCreate`
Create	Project	Mutation	`DastSiteProfileCreate`
Create	Project	Mutation	`DastSiteTokenCreate`
Create	Project	Mutation	`DastSiteValidationCreate`
Delete	Project	Mutation	`DastProfileDelete`
Delete	Project	Mutation	`DastScannerProfileDelete`
Delete	Project	Mutation	`DastSiteProfileDelete`
Delete	Project	Mutation	`DastSiteValidationRevoke`
Update	Project	Mutation	`DastProfileUpdate`
Update	Project	Mutation	`DastScannerProfileUpdate`
Update	Project	Mutation	`DastSiteProfileUpdate`

Pipeline Execution Project Schedule

Grants the ability to read pipeline execution project schedules.

Action	Access	Kind	Name
Read	Project	Type	`PipelineExecutionProjectSchedule`

Policy Store Policy

Grants the ability to create, delete, read, and update policies in the policy store.

Action	Access	Kind	Name
Create	Instance	Mutation	`GovernPolicyCreate`
Delete	Instance	Mutation	`GovernPolicyDelete`
Read	Instance	Type	`GovernPolicy`
Read	Instance	Type	`GovernPolicyEvaluation`
Update	Instance	Mutation	`GovernPolicyUpdate`

Secret

Grants the ability to create, delete, and update secrets.

Action	Access	Kind	Name
Create	Project	Mutation	`ProjectSecretCreate`
Create	Group	Mutation	`GroupSecretCreate`
Delete	Project	Mutation	`ProjectSecretDelete`
Delete	Group	Mutation	`GroupSecretDelete`
Update	Project	Mutation	`ProjectSecretUpdate`
Update	Group	Mutation	`GroupSecretUpdate`

Secrets Manager

Grants the ability to deprovision, provision, and read secrets managers.

Action	Access	Kind	Name
Deprovision	Project	Mutation	`ProjectSecretsManagerDeprovision`
Deprovision	Group	Mutation	`GroupSecretsManagerDeprovision`
Deprovision	Group	Mutation	`NamespaceSecretsManagerUnenroll`
Deprovision	Instance	Mutation	`InstanceSecretsManagerUnenroll`
Provision	Project	Mutation	`ProjectSecretsManagerInitialize`
Provision	Group	Mutation	`GroupSecretsManagerInitialize`
Provision	Group	Mutation	`NamespaceSecretsManagerEnroll`
Provision	Instance	Mutation	`InstanceSecretsManagerEnroll`
Read	Project	Type	`ProjectSecretsManager`
Read	Group	Type	`GroupSecretsManager`
Read	Group	Type	`SecretsManagerEntitlement`
Read	Instance	Type	`SecretsManagerEntitlement`

Secrets Permission

Grants the ability to delete and update secrets permissions.

Action	Access	Kind	Name
Delete	Project	Mutation	`ProjectSecretsPermissionDelete`
Delete	Project	Mutation	`SecretPermissionDelete`
Delete	Group	Mutation	`GroupSecretsPermissionDelete`
Update	Project	Mutation	`ProjectSecretsPermissionUpdate`
Update	Project	Mutation	`SecretPermissionUpdate`
Update	Group	Mutation	`GroupSecretsPermissionUpdate`

Security Attribute

Grants the ability to create, delete, and update security attributes.

Action	Access	Kind	Name
Create	Group	Mutation	`SecurityAttributeCreate`
Create	Group	Mutation	`SecurityCategoryCreate`
Delete	Group	Mutation	`SecurityAttributeDestroy`
Delete	Group	Mutation	`SecurityCategoryDestroy`
Update	Project	Mutation	`SecurityAttributeProjectUpdate`
Update	Group	Mutation	`SecurityAttributeUpdate`
Update	Group	Mutation	`SecurityCategoryUpdate`

Security Dashboard

Grants the ability to update security dashboards.

Action	Access	Kind	Name
Update	Project	Mutation	`AddProjectToSecurityDashboard`
Update	Project	Mutation	`RemoveProjectFromSecurityDashboard`

Security Policy

Grants the ability to update security policies.

Action	Access	Kind	Name
Update	Project	Mutation	`PipelineExecutionSchedulePolicyTestRun`
Update	Project	Mutation	`ResyncSecurityPolicies`
Update	Project	Mutation	`ScanExecutionPolicyCommit`
Update	Project	Mutation	`SecurityPolicyProjectAssign`
Update	Project	Mutation	`SecurityPolicyProjectCreate`
Update	Project	Mutation	`SecurityPolicyProjectCreateAsync`
Update	Project	Mutation	`SecurityPolicyProjectUnassign`
Update	Group	Mutation	`ResyncSecurityPolicies`
Update	Group	Mutation	`ScanExecutionPolicyCommit`
Update	Group	Mutation	`SecurityPolicyProjectAssign`
Update	Group	Mutation	`SecurityPolicyProjectCreate`
Update	Group	Mutation	`SecurityPolicyProjectCreateAsync`
Update	Group	Mutation	`SecurityPolicyProjectUnassign`

Security Project Tracked Ref

Grants the ability to create security project tracked refs.

Action	Access	Kind	Name
Create	Project	Mutation	`SecurityRefsTrack`

Security Scan Profiles

Grants the ability to create, delete, and update security scan profiles.

Action	Access	Kind	Name
Create	Group	Mutation	`SecurityScanProfileCreate`
Delete	Group	Mutation	`SecurityScanProfileDelete`
Update	Group	Mutation	`SecurityScanProfileUpdate`

Security Setting

Grants the ability to read and update security settings.

Action	Access	Kind	Name
Update	Project	Mutation	`ProjectSecurityExclusionCreate`
Update	Project	Mutation	`ProjectSecurityExclusionDelete`
Update	Project	Mutation	`ProjectSecurityExclusionUpdate`
Update	Project	Mutation	`ProjectSetContinuousVulnerabilityScanning`
Update	Project	Mutation	`SecurityTrainingUpdate`
Update	Project	Mutation	`SetContainerScanningForRegistry`
Update	Project	Mutation	`SetCvsForContainerScanning`
Update	Project	Mutation	`SetCvsForDependencyScanning`
Update	Project	Mutation	`SetLicenseConfigurationSource`
Update	Project	Mutation	`SetLicenseScanningForCyclonedx`
Update	Project	Mutation	`SetPreReceiveSecretDetection`
Update	Project	Mutation	`SetSecretPushProtection`
Update	Project	Mutation	`SetValidityChecks`
Update	Group	Mutation	`SetGroupSecretPushProtection`
Update	Group	Mutation	`SetGroupValidityChecks`

Vulnerability

Grants the ability to archive, create, read, and update vulnerabilities.

Action	Access	Kind	Name
Archive	Project	Mutation	`VulnerabilitiesArchive`
Create	Project	Mutation	`VulnerabilityCreate`
Read	Project	Type	`CountableVulnerability`
Read	Project	Type	`Vulnerability`
Read	Project	Type	`VulnerabilityScanner`
Read	Project	Field	`MergeRequest.findingReportsComparer`
Read	Project	Field	`Project.vulnerabilityWorkflowExecution`
Update	Project	Mutation	`BulkSetVulnerabilityFindingsDueDates`
Update	Project	Mutation	`VulnerabilityAutoRemediation`
Update	Project	Mutation	`VulnerabilityConfirm`
Update	Project	Mutation	`VulnerabilityDismiss`
Update	Project	Mutation	`VulnerabilityResolve`
Update	Project	Mutation	`VulnerabilityRevertToDetected`

Vulnerability Duo Workflow

Grants the ability to execute vulnerability duo workflows.

Action	Access	Kind	Name
Execute	Project	Mutation	`CancelVulnerabilityWorkflow`
Execute	Project	Mutation	`StartVulnerabilityWorkflow`

Vulnerability Flag

Grants the ability to update vulnerability flags.

Action	Access	Kind	Name
Update	Project	Mutation	`VulnerabilityDismissFalsePositiveFlag`

Vulnerability Issue Link

Grants the ability to create, delete, and read vulnerability issue links.

Action	Access	Kind	Name
Create	Project	Mutation	`SecurityFindingCreateIssue`
Create	Project	Mutation	`SecurityFindingExternalIssueLinkCreate`
Create	Project	Mutation	`SecurityFindingJiraIssueFormUrlCreate`
Create	Project	Mutation	`VulnerabilitiesCreateIssue`
Create	Project	Mutation	`VulnerabilityExternalIssueLinkCreate`
Create	Project	Mutation	`VulnerabilityIssueLinkCreate`
Delete	Project	Mutation	`VulnerabilityExternalIssueLinkDestroy`

Vulnerability Merge Request Link

Grants the ability to create and delete vulnerability merge request links.

Action	Access	Kind	Name
Create	Project	Mutation	`VulnerabilityLinkMergeRequest`
Delete	Project	Mutation	`VulnerabilityUnlinkMergeRequest`

CI/CD resources

Catalog Bundled Resource

Grants the ability to read bundled CI catalog resources.

Action	Access	Kind	Name
Read	Instance	Type	`CiCatalogBundledResource`

Catalog Resource

Grants the ability to create and delete CI catalog resources.

Action	Access	Kind	Name
Create	Project	Mutation	`CatalogResourcesCreate`
Delete	Project	Mutation	`CatalogResourcesDestroy`

CD Application

Grants the ability to create, read, and update continuous deployment applications.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdApplicationCreate`
Read	Instance	Type	`CdApplication`
Update	Instance	Mutation	`CdApplicationUpdate`

CD Application Flow Definition

Grants the ability to create and read continuous deployment application flow definitions.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdApplicationFlowDefinitionCreate`
Read	Instance	Type	`CdApplicationFlowDefinition`
Read	Instance	Type	`CdDefinitionStep`

CD Application Link

Grants the ability to create, delete, read, and update continuous deployment application links.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdApplicationLinkCreate`
Delete	Instance	Mutation	`CdApplicationLinkDelete`
Read	Instance	Type	`CdApplicationLink`
Update	Instance	Mutation	`CdApplicationLinkUpdate`

CD Artifact Source

Grants the ability to create and read continuous deployment artifact sources.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdArtifactSourceCreate`
Create	Instance	Mutation	`CdVersionCreate`
Read	Instance	Type	`CdArtifactSource`
Read	Instance	Type	`CdVersion`

CD Environment

Grants the ability to create, read, and update continuous deployment environments.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdEnvironmentCreate`
Read	Instance	Type	`CdEnvironment`
Read	Instance	Type	`CdEnvironmentApplication`
Read	Instance	Type	`CdEnvironmentDriverBinding`
Update	Instance	Mutation	`CdEnvironmentDriverBindingCreate`
Update	Instance	Mutation	`CdEnvironmentUpdate`

CD Rollout

Grants the ability to create and read CD rollouts.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdRolloutCreate`
Read	Instance	Type	`CdDeployment`
Read	Instance	Type	`CdDeploymentTransition`
Read	Instance	Type	`CdRollout`
Read	Instance	Type	`CdRolloutEnvironment`
Read	Instance	Type	`CdRolloutGate`
Read	Instance	Type	`CdRolloutStep`
Read	Instance	Type	`CdRolloutTransition`

CD Rollout Gate

Grants the ability to resolve CD rollout gates.

Action	Access	Kind	Name
Resolve	Instance	Mutation	`CdRolloutGateResolve`

CD Service

Grants the ability to create, read, and update continuous deployment services.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdServiceCreate`
Read	Instance	Type	`CdService`
Read	Instance	Type	`CdServiceEnvironmentHealth`
Update	Instance	Mutation	`CdServiceUpdate`

CD Version Set

Grants the ability to create and read continuous deployment version sets.

Action	Access	Kind	Name
Create	Instance	Mutation	`CdVersionSetCreate`
Read	Instance	Type	`CdVersionSet`
Read	Instance	Type	`CdVersionSetEntry`

CI Config

Grants the ability to read and validate CI/CD configuration.

Action	Access	Kind	Name
Validate	Project	Mutation	`CiLint`

CI Namespace Settings

Grants the ability to update CI namespace settings.

Action	Access	Kind	Name
Update	Group	Mutation	`NamespaceCiCdSettingsUpdate`
Update	Group	Mutation	`NamespaceSettingsUpdate`

CI/CD Setting

Grants the ability to update CI/CD settings.

Action	Access	Kind	Name
Update	Project	Mutation	`ProjectCiCdSettingsUpdate`
Update	Group	Mutation	`SafeDisablePipelineVariables`

Cluster Agent

Grants the ability to create, delete, and read cluster agents.

Action	Access	Kind	Name
Create	Project	Mutation	`CreateClusterAgent`
Delete	Project	Mutation	`ClusterAgentDelete`
Read	Project	Type	`ClusterAgent`

Cluster Agent Token

Grants the ability to create, read, and revoke cluster agent tokens.

Action	Access	Kind	Name
Create	Project	Mutation	`ClusterAgentTokenCreate`

Cluster Agent URL Configuration

Grants the ability to create, delete, and read cluster agent URL configurations.

Action	Access	Kind	Name
Create	Project	Mutation	`ClusterAgentUrlConfigurationCreate`
Delete	Project	Mutation	`ClusterAgentUrlConfigurationDelete`

Deployment

Grants the ability to approve, create, delete, read, and update deployments.

Action	Access	Kind	Name
Approve	Project	Mutation	`ApproveDeployment`

Environment

Grants the ability to create, delete, read, stop, and update environments.

Action	Access	Kind	Name
Create	Project	Mutation	`EnvironmentCreate`
Delete	Project	Mutation	`EnvironmentDelete`
Read	Project	Type	`Environment`
Stop	Project	Mutation	`EnvironmentStop`
Update	Project	Mutation	`EnvironmentUpdate`
Update	Project	Mutation	`EnvironmentsCanaryIngressUpdate`

Freeze Period

Grants the ability to create, delete, read, and update freeze periods.

Action	Access	Kind	Name
Read	Project	Type	`CiFreezePeriod`

Job

Grants the ability to delete, read, run, and update jobs.

Action	Access	Kind	Name
Read	Project	Type	`CiJob`
Run	Project	Mutation	`JobPlay`
Run	Project	Mutation	`JobRetry`
Update	Project	Mutation	`JobCancel`
Update	Project	Mutation	`JobUnschedule`

Job Artifact

Grants the ability to delete, read, and update job artifacts.

Action	Access	Kind	Name
Delete	Project	Mutation	`ArtifactDestroy`
Delete	Project	Mutation	`BulkDestroyJobArtifacts`
Delete	Project	Mutation	`JobArtifactsDestroy`
Read	Project	Type	`CiJobArtifact`

Merge Train Car

Grants the ability to delete merge train cars.

Action	Access	Kind	Name
Delete	Project	Mutation	`MergeTrainsDeleteCar`

Pipeline

Grants the ability to create, delete, read, and update pipelines.

Action	Access	Kind	Name
Create	Project	Mutation	`PipelineCreate`
Delete	Project	Mutation	`PipelineDestroy`
Read	Project	Type	`CiStage`
Read	Project	Type	`Pipeline`
Update	Project	Mutation	`PipelineCancel`
Update	Project	Mutation	`PipelineRetry`

Pipeline Schedule

Grants the ability to create, delete, read, and update pipeline schedules.

Action	Access	Kind	Name
Create	Project	Mutation	`PipelineScheduleCreate`
Delete	Project	Mutation	`PipelineScheduleDelete`
Read	Project	Type	`PipelineSchedule`
Update	Project	Mutation	`PipelineSchedulePlay`
Update	Project	Mutation	`PipelineScheduleTakeOwnership`
Update	Project	Mutation	`PipelineScheduleUpdate`

Pipeline Subscription

Grants the ability to create and delete pipeline subscriptions.

Action	Access	Kind	Name
Create	Project	Mutation	`ProjectSubscriptionCreate`
Delete	Project	Mutation	`ProjectSubscriptionDelete`

Runner

Grants the ability to assign, create, delete, read, and update runners.

Action	Access	Kind	Name
Assign	Project	Mutation	`RunnerAssignToProject`
Assign	Project	Mutation	`RunnerUnassignFromProject`
Create	Project	Mutation	`RunnerCreate`
Create	Group	Mutation	`RunnerCreate`
Create	Instance	Mutation	`RunnerCreate`
Delete	Project	Mutation	`RunnerDelete`
Delete	Group	Mutation	`RunnerDelete`
Delete	Instance	Mutation	`RunnerDelete`
Read	Project	Type	`CiRunner`
Read	Group	Type	`CiRunner`
Read	Instance	Type	`CiRunner`
Update	Project	Mutation	`RunnerCacheClear`
Update	Project	Mutation	`RunnerUpdate`
Update	Group	Mutation	`RunnerUpdate`
Update	Instance	Mutation	`RunnerUpdate`

Runner Usage

Grants the ability to read runner usage data.

Action	Access	Kind	Name
Read	Project	Mutation	`RunnersExportUsage`
Read	Group	Mutation	`RunnersExportUsage`
Read	Instance	Mutation	`RunnersExportUsage`

Terraform State

Grants the ability to create, delete, lock, and read Terraform state.

Action	Access	Kind	Name
Delete	Project	Mutation	`TerraformStateDelete`
Lock	Project	Mutation	`TerraformStateLock`
Lock	Project	Mutation	`TerraformStateUnlock`
Read	Project	Type	`TerraformState`
Read	Project	Type	`TerraformStateProtectionRule`
Read	Project	Type	`TerraformStateVersion`

Terraform State Protection Rule

Grants the ability to create, delete, and update Terraform state protection rules.

Action	Access	Kind	Name
Create	Project	Mutation	`CreateTerraformStateProtectionRule`
Delete	Project	Mutation	`DeleteTerraformStateProtectionRule`
Update	Project	Mutation	`UpdateTerraformStateProtectionRule`

Trigger

Grants the ability to create, delete, read, and update triggers.

Action	Access	Kind	Name
Create	Project	Mutation	`PipelineTriggerCreate`
Delete	Project	Mutation	`PipelineTriggerDelete`
Read	Project	Type	`PipelineTrigger`
Update	Project	Mutation	`PipelineTriggerUpdate`

Verified Namespace

Grants the ability to create verified namespaces.

Action	Access	Kind	Name
Create	Instance	Mutation	`VerifiedNamespaceCreate`

Compliance resources

Audit Event Streaming Destination

Grants the ability to create, delete, and update audit event streaming destinations.

Action	Access	Kind	Name
Create	Group	Mutation	`AuditEventsAmazonS3ConfigurationCreate`
Create	Group	Mutation	`ExternalAuditEventDestinationCreate`
Create	Group	Mutation	`GoogleCloudLoggingConfigurationCreate`
Create	Group	Mutation	`GroupAuditEventStreamingDestinationsCreate`
Create	Instance	Mutation	`AuditEventsInstanceAmazonS3ConfigurationCreate`
Create	Instance	Mutation	`InstanceAuditEventStreamingDestinationsCreate`
Create	Instance	Mutation	`InstanceExternalAuditEventDestinationCreate`
Create	Instance	Mutation	`InstanceGoogleCloudLoggingConfigurationCreate`
Delete	Group	Mutation	`AuditEventsAmazonS3ConfigurationDelete`
Delete	Group	Mutation	`ExternalAuditEventDestinationDestroy`
Delete	Group	Mutation	`GoogleCloudLoggingConfigurationDestroy`
Delete	Group	Mutation	`GroupAuditEventStreamingDestinationsDelete`
Delete	Instance	Mutation	`AuditEventsInstanceAmazonS3ConfigurationDelete`
Delete	Instance	Mutation	`InstanceAuditEventStreamingDestinationsDelete`
Delete	Instance	Mutation	`InstanceExternalAuditEventDestinationDestroy`
Delete	Instance	Mutation	`InstanceGoogleCloudLoggingConfigurationDestroy`
Update	Group	Mutation	`AuditEventsAmazonS3ConfigurationUpdate`
Update	Group	Mutation	`AuditEventsGroupDestinationDenylistEventsAdd`
Update	Group	Mutation	`AuditEventsGroupDestinationDenylistEventsDelete`
Update	Group	Mutation	`AuditEventsGroupDestinationEventsAdd`
Update	Group	Mutation	`AuditEventsGroupDestinationEventsDelete`
Update	Group	Mutation	`AuditEventsGroupDestinationNamespaceFilterCreate`
Update	Group	Mutation	`AuditEventsGroupDestinationNamespaceFilterDelete`
Update	Group	Mutation	`AuditEventsStreamingDestinationEventsAdd`
Update	Group	Mutation	`AuditEventsStreamingDestinationEventsRemove`
Update	Group	Mutation	`AuditEventsStreamingHTTPNamespaceFiltersAdd`
Update	Group	Mutation	`AuditEventsStreamingHTTPNamespaceFiltersDelete`
Update	Group	Mutation	`AuditEventsStreamingHeadersCreate`
Update	Group	Mutation	`AuditEventsStreamingHeadersDestroy`
Update	Group	Mutation	`AuditEventsStreamingHeadersUpdate`
Update	Group	Mutation	`ExternalAuditEventDestinationUpdate`
Update	Group	Mutation	`GoogleCloudLoggingConfigurationUpdate`
Update	Group	Mutation	`GroupAuditEventStreamingDestinationsUpdate`
Update	Instance	Mutation	`AuditEventsInstanceAmazonS3ConfigurationUpdate`
Update	Instance	Mutation	`AuditEventsInstanceDestinationEventsAdd`
Update	Instance	Mutation	`AuditEventsInstanceDestinationEventsDelete`
Update	Instance	Mutation	`AuditEventsInstanceDestinationNamespaceFilterCreate`
Update	Instance	Mutation	`AuditEventsInstanceDestinationNamespaceFilterDelete`
Update	Instance	Mutation	`AuditEventsStreamingDestinationInstanceEventsAdd`
Update	Instance	Mutation	`AuditEventsStreamingDestinationInstanceEventsRemove`
Update	Instance	Mutation	`AuditEventsStreamingInstanceHeadersCreate`
Update	Instance	Mutation	`AuditEventsStreamingInstanceHeadersDestroy`
Update	Instance	Mutation	`AuditEventsStreamingInstanceHeadersUpdate`
Update	Instance	Mutation	`InstanceAuditEventStreamingDestinationsUpdate`
Update	Instance	Mutation	`InstanceExternalAuditEventDestinationUpdate`
Update	Instance	Mutation	`InstanceGoogleCloudLoggingConfigurationUpdate`

Compliance Dashboard

Grants the ability to read compliance dashboards.

Action	Access	Kind	Name
Read	Group	Mutation	`RefreshStandardsAdherenceChecks`

Compliance Framework

Grants the ability to create, delete, and update compliance frameworks.

Action	Access	Kind	Name
Create	Group	Mutation	`CreateComplianceFramework`
Create	Group	Mutation	`CreateComplianceFrameworkFromTemplate`
Create	Group	Mutation	`CreateComplianceRequirement`
Create	Group	Mutation	`CreateComplianceRequirementsControl`
Delete	Group	Mutation	`DestroyComplianceFramework`
Delete	Group	Mutation	`DestroyComplianceRequirement`
Delete	Group	Mutation	`DestroyComplianceRequirementsControl`
Update	Project	Mutation	`ProjectSetComplianceFramework`
Update	Project	Mutation	`ProjectUpdateComplianceFrameworks`
Update	Group	Mutation	`UpdateComplianceFramework`
Update	Group	Mutation	`UpdateComplianceRequirement`
Update	Group	Mutation	`UpdateComplianceRequirementsControl`

Compliance Violations Report

Grants the ability to update compliance violations reports.

Action	Access	Kind	Name
Update	Project	Mutation	`LinkProjectComplianceViolationIssue`
Update	Project	Mutation	`UnlinkProjectComplianceViolationIssue`
Update	Project	Mutation	`UpdateProjectComplianceViolation`

External Status Check

Grants the ability to create, delete, read, retry, and update external status checks.

Action	Access	Kind	Name
Create	Project	Mutation	`BranchRuleExternalStatusCheckCreate`
Delete	Project	Mutation	`BranchRuleExternalStatusCheckDestroy`
Update	Project	Mutation	`BranchRuleExternalStatusCheckUpdate`

Duo resources

AI Catalog External Agent

Grants the ability to create, delete, and update AI catalog external agents.

Action	Access	Kind	Name
Create	Project	Mutation	`AiCatalogThirdPartyFlowCreate`
Delete	Project	Mutation	`AiCatalogThirdPartyFlowDelete`
Update	Project	Mutation	`AiCatalogThirdPartyFlowUpdate`

AI catalog item

Grants the ability to create, delete, read, report, restore, and update AI catalog items.

Action	Access	Kind	Name
Create	Project	Mutation	`AiCatalogAgentCreate`
Create	Project	Mutation	`AiCatalogFlowCreate`
Delete	Project	Mutation	`AiCatalogAgentDelete`
Delete	Project	Mutation	`AiCatalogFlowDelete`
Read	Project	Mutation	`AiCatalogItemStar`
Read	User	Mutation	`AiCatalogItemStar`
Read	User	Field	`Query.aiCatalogBuiltInTools`
Report	Project	Mutation	`AiCatalogItemReport`
Restore	Project	Mutation	`AiCatalogItemVersionRestore`
Update	Project	Mutation	`AiCatalogAgentUpdate`
Update	Project	Mutation	`AiCatalogFlowUpdate`

AI catalog item consumer

Grants the ability to delete and update AI catalog item consumers.

Action	Access	Kind	Name
Delete	Project	Mutation	`AiCatalogItemConsumerDelete`
Delete	Group	Mutation	`AiCatalogItemConsumerDelete`
Update	Project	Mutation	`AiCatalogItemConsumerUpdate`
Update	Group	Mutation	`AiCatalogItemConsumerUpdate`

AI catalog MCP server

Grants the ability to block, create, and update AI catalog MCP servers.

Action	Access	Kind	Name
Block	Project	Mutation	`AiCatalogMcpServerSetBlock`
Block	Group	Mutation	`AiCatalogMcpServerSetBlock`
Create	Instance	Mutation	`AiCatalogMcpServerCreate`
Update	Instance	Mutation	`AiCatalogMcpServerUpdate`

AI Domain Settings

Grants the ability to update AI domain settings.

Action	Access	Kind	Name
Update	Group	Mutation	`AiDomainSettingsNamespaceUpdate`
Update	Instance	Mutation	`AiDomainSettingsInstanceUpdate`

Ai Flow Schedule

Grants the ability to create, delete, and update ai flow schedules.

Action	Access	Kind	Name
Create	Project	Mutation	`AiFlowScheduleCreate`
Delete	Project	Mutation	`AiFlowScheduleDelete`
Update	Project	Mutation	`AiFlowScheduleUpdate`

AI Flow Trigger

Grants the ability to create, delete, and update AI flow triggers.

Action	Access	Kind	Name
Create	Project	Mutation	`AiFlowTriggerCreate`
Delete	Project	Mutation	`AiFlowTriggerDelete`
Update	Project	Mutation	`AiFlowTriggerUpdate`

AI Self-Hosted Model

Grants the ability to create, delete, and update AI self-hosted models.

Action	Access	Kind	Name
Create	Instance	Mutation	`AiSelfHostedModelCreate`
Delete	Instance	Mutation	`AiSelfHostedModelDelete`
Update	Instance	Mutation	`AiSelfHostedModelConnectionCheck`
Update	Instance	Mutation	`AiSelfHostedModelUpdate`

AI tool rule

Grants the ability to read and update AI tool rules, which control per-tool approval (Allow, Ask, Deny) for the Duo Agent Platform.

Action	Access	Kind	Name
Read	Group	Field	`Query.aiToolRules`
Update	Project	Mutation	`BulkUpdateAiToolRules`
Update	Project	Mutation	`UpdateAiToolRule`
Update	Group	Mutation	`BulkUpdateAiToolRules`
Update	Group	Mutation	`UpdateAiToolRule`

AI usage metric

Grants the ability to read per-user GitLab Duo usage metrics.

Action	Access	Kind	Name
Read	Project	Field	`Project.aiUserMetrics`
Read	Group	Field	`Group.aiUserMetrics`

Conversation Thread

Grants the ability to delete conversation threads.

Action	Access	Kind	Name
Delete	User	Mutation	`DeleteConversationThread`

Duo Setting

Grants the ability to update duo settings.

Action	Access	Kind	Name
Update	Group	Mutation	`AiModelSelectionNamespaceUpdate`
Update	Instance	Mutation	`AiFeatureSettingUpdate`
Update	Instance	Mutation	`DuoSettingsUpdate`

Duo user feedback

Grants the ability to create user feedback on Duo AI messages.

Action	Access	Kind	Name
Create	User	Mutation	`DuoUserFeedback`

Duo Workflow

Grants the ability to create, delete, read, resume, and update duo workflows.

Action	Access	Kind	Name
Create	Project	Mutation	`AiDuoWorkflowCreate`
Create	Group	Mutation	`AiDuoWorkflowCreate`
Create	User	Mutation	`AiDuoWorkflowCreate`
Delete	User	Mutation	`DeleteDuoWorkflowsWorkflow`
Read	User	Type	`DuoWorkflowMergeRequestLink`
Read	User	Type	`DuoWorkflowNoteLink`
Read	User	Type	`DuoWorkflowPipelineLink`
Read	User	Type	`DuoWorkflowWorkItemLink`
Read	User	Field	`Note.duoCreatedSession`
Read	User	Field	`Note.duoTriggeredSession`
Read	User	Field	`Query.duoWorkflowBranches`
Update	User	Mutation	`UpdateDuoWorkflowAgentPrivileges`
Update	User	Mutation	`UpdateDuoWorkflowToolCallApprovals`
Update	User	Mutation	`UpdateDuoWorkflowWebSearch`

Flows Metadata

Grants the ability to read flows metadata.

Action	Access	Kind	Name
Read	Project	Type	`AiFlowsMetadata`
Read	Group	Type	`AiFlowsMetadata`
Read	Instance	Type	`AiFlowsMetadata`

Model Selection Allowlist

Grants the ability to read and update model selection allowlists.

Action	Access	Kind	Name
Read	Group	Type	`AiModelSelectionAllowList`
Read	Group	Type	`AiModelSelectionAllowListModel`
Read	Instance	Type	`AiModelSelectionAllowList`
Read	Instance	Type	`AiModelSelectionAllowListModel`
Update	Group	Mutation	`AiModelSelectionNamespaceModelAllowlistUpdate`
Update	Instance	Mutation	`AiFeatureSettingModelAllowlistUpdate`

Namespace Duo Feature

Grants the ability to lock namespace duo features.

Action	Access	Kind	Name
Lock	Group	Mutation	`AdminClearDuoAvailability`
Lock	Group	Mutation	`AdminSetDuoAvailability`

Geo resources

Geo Registry

Grants the ability to update Geo registries.

Action	Access	Kind	Name
Update	Instance	Mutation	`GeoRegistriesBulkUpdate`
Update	Instance	Mutation	`GeoRegistriesUpdate`

GitLab Orbit resources

Knowledge Graph Setting

Grants the ability to update knowledge graph settings.

Action	Access	Kind	Name
Update	Group	Mutation	`OrbitUpdate`

Groups resources

Achievement

Grants the ability to award, create, delete, revoke, and update achievements.

Action	Access	Kind	Name
Award	Group	Mutation	`AchievementsAward`
Create	Group	Mutation	`AchievementsCreate`
Delete	Group	Mutation	`AchievementsDelete`
Delete	Group	Mutation	`UserAchievementsDelete`
Revoke	Group	Mutation	`AchievementsRevoke`
Update	Group	Mutation	`AchievementsUpdate`
Update	User	Mutation	`UserAchievementPrioritiesUpdate`
Update	User	Mutation	`UserAchievementsUpdate`

Admin Member Role

Grants the ability to create, delete, read, and update admin member roles.

Action	Access	Kind	Name
Create	Instance	Mutation	`MemberRoleAdminCreate`
Delete	Instance	Mutation	`MemberRoleAdminDelete`
Read	Instance	Type	`AdminMemberRole`
Update	Instance	Mutation	`MemberRoleAdminUpdate`

Commit Email

Grants the ability to update commit emails.

Action	Access	Kind	Name
Update	User	Mutation	`UserSetNamespaceCommitEmail`

Custom Emoji

Grants the ability to create and delete custom emojis.

Action	Access	Kind	Name
Create	Group	Mutation	`CreateCustomEmoji`
Delete	Group	Mutation	`DestroyCustomEmoji`

Group

Grants the ability to archive, create, delete, read, share, transfer, and update groups.

Action	Access	Kind	Name
Read	Group	Type	`Group`
Transfer	Group	Mutation	`GroupTransfer`
Update	Group	Mutation	`GroupUpdate`

LDAP Admin Role Link

Grants the ability to create, delete, and read LDAP admin role links

Action	Access	Kind	Name
Create	Instance	Mutation	`AdminRolesLdapSync`
Create	Instance	Mutation	`LdapAdminRoleLinkCreate`
Delete	Instance	Mutation	`LdapAdminRoleLinkDestroy`
Read	Instance	Type	`LdapAdminRoleLink`

Member Role

Grants the ability to assign, create, delete, read, and update member roles.

Action	Access	Kind	Name
Assign	Instance	Mutation	`MemberRoleToUserAssign`
Create	Group	Mutation	`MemberRoleCreate`
Create	Instance	Mutation	`MemberRoleCreate`
Delete	Group	Mutation	`MemberRoleDelete`
Delete	Instance	Mutation	`MemberRoleDelete`
Update	Group	Mutation	`MemberRoleUpdate`
Update	Instance	Mutation	`MemberRoleUpdate`

Namespace

Grants the ability to read and update namespaces.

Action	Access	Kind	Name
Read	Project	Mutation	`NamespacesRegenerateNewWorkItemEmailAddress`

Namespace Ban

Grants the ability to delete namespace bans.

Action	Access	Kind	Name
Delete	Group	Mutation	`NamespaceBanDestroy`

Preference

Grants the ability to read and update preferences.

Action	Access	Kind	Name
Read	User	Type	`UserPreferences`
Update	User	Mutation	`UserPreferencesUpdate`

Topic

Grants the ability to create, delete, merge, read, and update topics.

Action	Access	Kind	Name
Read	Instance	Type	`Topic`

UI Notification

Grants the ability to dismiss UI notifications.

Action	Access	Kind	Name
Dismiss	Group	Mutation	`UserGroupCalloutCreate`
Dismiss	User	Mutation	`UserCalloutCreate`

Integrations resources

Integration Exclusion

Grants the ability to create and delete integration exclusions.

Action	Access	Kind	Name
Create	Instance	Mutation	`IntegrationExclusionCreate`
Delete	Instance	Mutation	`IntegrationExclusionDelete`

Jira Import

Grants the ability to create Jira imports.

Action	Access	Kind	Name
Create	Project	Mutation	`JiraImportStart`
Create	Project	Mutation	`JiraImportUsers`

Monitoring resources

Alert

Grants the ability to update alerts.

Action	Access	Kind	Name
Update	Project	Mutation	`AlertSetAssignees`
Update	Project	Mutation	`UpdateAlertStatus`

Escalation Policy

Grants the ability to create, delete, read, and update escalation policies.

Action	Access	Kind	Name
Create	Project	Mutation	`EscalationPolicyCreate`
Delete	Project	Mutation	`EscalationPolicyDestroy`
Read	Project	Type	`EscalationPolicyType`
Update	Project	Mutation	`EscalationPolicyUpdate`

HTTP Integration

Grants the ability to create, delete, and update HTTP integrations.

Action	Access	Kind	Name
Create	Project	Mutation	`HttpIntegrationCreate`
Create	Project	Mutation	`PrometheusIntegrationCreate`
Delete	Project	Mutation	`HttpIntegrationDestroy`
Update	Project	Mutation	`HttpIntegrationResetToken`
Update	Project	Mutation	`HttpIntegrationUpdate`
Update	Project	Mutation	`PrometheusIntegrationResetToken`
Update	Project	Mutation	`PrometheusIntegrationUpdate`

Issuable Resource Link

Grants the ability to create and delete issuable resource links.

Action	Access	Kind	Name
Create	Project	Mutation	`IssuableResourceLinkCreate`
Delete	Project	Mutation	`IssuableResourceLinkDestroy`

On-call Schedule

Grants the ability to create, delete, and update on-call schedules.

Action	Access	Kind	Name
Create	Project	Mutation	`OncallRotationCreate`
Create	Project	Mutation	`OncallScheduleCreate`
Delete	Project	Mutation	`OncallRotationDestroy`
Delete	Project	Mutation	`OncallScheduleDestroy`
Update	Project	Mutation	`OncallRotationUpdate`
Update	Project	Mutation	`OncallScheduleUpdate`

Sidekiq Job

Grants the ability to drop Sidekiq jobs.

Action	Access	Kind	Name
Drop	Instance	Mutation	`AdminSidekiqQueuesDeleteJobs`

Timeline Event

Grants the ability to create, delete, and update timeline events.

Action	Access	Kind	Name
Create	Project	Mutation	`TimelineEventCreate`
Create	Project	Mutation	`TimelineEventPromoteFromNote`
Create	Project	Mutation	`TimelineEventTagCreate`
Delete	Project	Mutation	`TimelineEventDestroy`
Update	Project	Mutation	`TimelineEventUpdate`

Note resources

Saved Reply

Grants the ability to create, delete, and update saved replies.

Action	Access	Kind	Name
Create	Project	Mutation	`ProjectSavedReplyCreate`
Create	Group	Mutation	`GroupSavedReplyCreate`
Create	User	Mutation	`SavedReplyCreate`
Delete	Project	Mutation	`ProjectSavedReplyDestroy`
Delete	Group	Mutation	`GroupSavedReplyDestroy`
Delete	User	Mutation	`SavedReplyDestroy`
Update	Project	Mutation	`ProjectSavedReplyUpdate`
Update	Group	Mutation	`GroupSavedReplyUpdate`
Update	User	Mutation	`SavedReplyUpdate`

Notifications resources

Todo

Grants the ability to create, delete, read, and update todos.

Action	Access	Kind	Name
Create	Project	Mutation	`AlertTodoCreate`
Create	Project	Mutation	`TodoCreate`
Create	Group	Mutation	`TodoCreate`
Delete	User	Mutation	`TodoDeleteAllDone`
Delete	User	Mutation	`TodoDeleteMany`
Read	User	Type	`Todo`
Update	User	Mutation	`TodoMarkDone`
Update	User	Mutation	`TodoResolveMany`
Update	User	Mutation	`TodoRestore`
Update	User	Mutation	`TodoRestoreMany`
Update	User	Mutation	`TodoSnooze`
Update	User	Mutation	`TodoSnoozeMany`
Update	User	Mutation	`TodoUnSnooze`
Update	User	Mutation	`TodoUnsnoozeMany`
Update	User	Mutation	`TodosMarkAllDone`

Organizations resources

Organization

Grants the ability to create, delete, read, restore, and update organizations.

Action	Access	Kind	Name
Create	Instance	Mutation	`OrganizationCreate`
Delete	Instance	Mutation	`OrganizationDelete`
Read	Instance	Type	`Organization`
Read	Instance	Type	`OrganizationUser`
Restore	Instance	Mutation	`OrganizationRestore`
Update	Instance	Mutation	`OrganizationConfirm`
Update	Instance	Mutation	`OrganizationUpdate`

Organization User

Grants the ability to create, delete, and update organization users.

Action	Access	Kind	Name
Create	Instance	Mutation	`OrganizationUserCreate`
Delete	Instance	Mutation	`OrganizationUserDelete`
Update	Instance	Mutation	`OrganizationUserUpdate`

Packages and Registry resources

Container Expiration Policy

Grants the ability to update container expiration policies.

Action	Access	Kind	Name
Update	Project	Mutation	`UpdateContainerExpirationPolicy`

Container Registry Protection Tag Rule

Grants the ability to create, delete, read, and update container registry protection tag rules.

Action	Access	Kind	Name
Create	Project	Mutation	`createContainerProtectionTagRule`
Delete	Project	Mutation	`DeleteContainerProtectionTagRule`
Update	Project	Mutation	`UpdateContainerProtectionTagRule`

Container Repository

Grants the ability to delete and read container repositories.

Action	Access	Kind	Name
Delete	Project	Mutation	`DestroyContainerRepository`
Delete	Project	Mutation	`DestroyContainerRepositoryTags`

Container Repository Protection Rule

Grants the ability to create, delete, read, and update container repository protection rules.

Action	Access	Kind	Name
Create	Project	Mutation	`CreateContainerProtectionRepositoryRule`
Delete	Project	Mutation	`DeleteContainerProtectionRepositoryRule`
Update	Project	Mutation	`UpdateContainerProtectionRepositoryRule`

Dependency Proxy

Grants the ability to read and update dependency proxies.

Action	Access	Kind	Name
Update	Group	Mutation	`UpdateDependencyProxyImageTtlGroupPolicy`
Update	Group	Mutation	`UpdateDependencyProxySettings`

Dependency Proxy Packages Setting

Grants the ability to update dependency proxy packages settings.

Action	Access	Kind	Name
Update	Project	Mutation	`UpdateDependencyProxyPackagesSettings`

Package

Grants the ability to create, delete, read, and update packages.

Action	Access	Kind	Name
Create	Project	Mutation	`CreatePackagesProtectionRule`
Delete	Project	Mutation	`DeletePackagesProtectionRule`
Delete	Project	Mutation	`DestroyPackage`
Delete	Project	Mutation	`DestroyPackageFile`
Delete	Project	Mutation	`DestroyPackageFiles`
Update	Project	Mutation	`UpdatePackagesCleanupPolicy`
Update	Project	Mutation	`UpdatePackagesProtectionRule`

Package Setting

Grants the ability to update package settings.

Action	Access	Kind	Name
Update	Project	Mutation	`UpdateNamespacePackageSettings`
Update	Group	Mutation	`UpdateNamespacePackageSettings`
Update	User	Mutation	`UpdateNamespacePackageSettings`

Virtual Registry

Grants the ability to create, delete, read, and update virtual registries.

Action	Access	Kind	Name
Create	Group	Mutation	`ContainerUpstreamCreate`
Create	Group	Mutation	`ContainerVirtualRegistryCreate`
Create	Group	Mutation	`ContainerVirtualRegistryUpstreamCreate`
Create	Group	Mutation	`MavenUpstreamCreate`
Create	Group	Mutation	`MavenVirtualRegistryCreate`
Delete	Group	Mutation	`ContainerUpstreamCacheDelete`
Delete	Group	Mutation	`ContainerUpstreamDelete`
Delete	Group	Mutation	`ContainerVirtualRegistryCacheDelete`
Delete	Group	Mutation	`ContainerVirtualRegistryDelete`
Delete	Group	Mutation	`ContainerVirtualRegistryUpstreamDelete`
Delete	Group	Mutation	`MavenUpstreamCacheDelete`
Delete	Group	Mutation	`MavenUpstreamDelete`
Delete	Group	Mutation	`MavenVirtualRegistryCacheDelete`
Delete	Group	Mutation	`MavenVirtualRegistryDelete`
Delete	Group	Mutation	`MavenVirtualRegistryUpstreamDelete`
Update	Group	Mutation	`ContainerUpstreamTest`
Update	Group	Mutation	`ContainerUpstreamUpdate`
Update	Group	Mutation	`ContainerVirtualRegistryUpdate`
Update	Group	Mutation	`ContainerVirtualRegistryUpstreamUpdate`
Update	Group	Mutation	`MavenUpstreamUpdate`
Update	Group	Mutation	`MavenVirtualRegistryUpdate`
Update	Group	Mutation	`MavenVirtualRegistryUpstreamUpdate`
Update	Group	Mutation	`UpdateVirtualRegistriesSetting`

Virtual Registry Cleanup Policy

Grants the ability to create, delete, read, and update virtual registry cleanup policies.

Action	Access	Kind	Name
Update	Group	Mutation	`VirtualRegistriesCleanupPolicyUpsert`

Product Analytics resources

Custom Dashboard

Grants the ability to create, delete, and update custom dashboards.

Action	Access	Kind	Name
Create	Instance	Mutation	`CreateCustomDashboard`
Delete	Instance	Mutation	`DeleteCustomDashboard`
Update	Instance	Mutation	`UpdateCustomDashboard`

DevOps Adoption

Grants the ability to enable DevOps adoption for namespaces.

Action	Access	Kind	Name
Enable	Group	Mutation	`EnableDevopsAdoptionNamespace`

Project Features resources

Badge

Grants the ability to create, delete, read, and update badges.

Action	Access	Kind	Name
Read	Instance	Type	`OrganizationUserBadge`

Cycle Analytics

Grants the ability to read cycle analytics.

Action	Access	Kind	Name
Read	Project	Field	`Analytics.mergeRequests`
Read	Group	Field	`Analytics.mergeRequests`

Release

Grants the ability to create, delete, read, and update releases.

Action	Access	Kind	Name
Create	Project	Mutation	`ReleaseAssetLinkCreate`
Create	Project	Mutation	`ReleaseCreate`
Delete	Project	Mutation	`ReleaseDelete`
Update	Project	Mutation	`ReleaseUpdate`

Release Link

Grants the ability to create, delete, read, and update release links.

Action	Access	Kind	Name
Delete	Project	Mutation	`ReleaseAssetLinkDelete`
Update	Project	Mutation	`ReleaseAssetLinkUpdate`

Snippet

Grants the ability to create, delete, read, and update snippets.

Action	Access	Kind	Name
Create	Project	Mutation	`CreateSnippet`
Create	User	Mutation	`CreateSnippet`
Delete	Project	Mutation	`DestroySnippet`
Delete	User	Mutation	`DestroySnippet`
Update	Project	Mutation	`UpdateSnippet`
Update	User	Mutation	`UpdateSnippet`

Project Model Registry and Experiments resources

ML Experiment

Grants the ability to create, delete, read, and update ML experiments.

Action	Access	Kind	Name
Read	Project	Type	`MlExperiment`

ML Model

Grants the ability to create, delete, read, and update ML models.

Action	Access	Kind	Name
Create	Project	Mutation	`MlModelCreate`
Delete	Project	Mutation	`MlModelDelete`
Delete	Project	Mutation	`MlModelDestroy`
Read	Project	Type	`MlModel`
Update	Project	Mutation	`MlModelEdit`

MLflow Run

Grants the ability to create, delete, log, read, and update MLflow runs.

Action	Access	Kind	Name
Read	Project	Type	`MlCandidate`

Model Version

Grants the ability to create, delete, read, and update model versions.

Action	Access	Kind	Name
Create	Project	Mutation	`MlModelVersionCreate`
Delete	Project	Mutation	`MlModelVersionDelete`
Read	Project	Type	`MlModelVersion`
Update	Project	Mutation	`MlModelVersionEdit`

Project Planning resources

Award Emoji

Grants the ability to create and delete award emojis.

Action	Access	Kind	Name
Create	Project	Mutation	`AwardEmojiAdd`
Create ¹	Project	Mutation	`AwardEmojiToggle`
Create	Group	Mutation	`AwardEmojiAdd`
Create ¹	Group	Mutation	`AwardEmojiToggle`
Delete	Project	Mutation	`AwardEmojiRemove`
Delete	Group	Mutation	`AwardEmojiRemove`

¹ Also requires the Delete Award Emoji permission.

CRM Contact

Grants the ability to create and update CRM contacts.

Action	Access	Kind	Name
Create	Group	Mutation	`CustomerRelationsContactCreate`
Update	Group	Mutation	`CustomerRelationsContactUpdate`

CRM Organization

Grants the ability to create and update CRM organizations.

Action	Access	Kind	Name
Create	Group	Mutation	`CustomerRelationsOrganizationCreate`
Update	Group	Mutation	`CustomerRelationsOrganizationUpdate`

Custom Attribute

Grants the ability to delete, read, and update custom attributes.

Action	Access	Kind	Name
Delete	Project	Mutation	`DeleteProjectCustomAttribute`
Delete	Group	Mutation	`DeleteGroupCustomAttribute`
Delete	Instance	Mutation	`DeleteUserCustomAttribute`
Update	Project	Mutation	`ProjectCustomAttributeSet`
Update	Group	Mutation	`SetGroupCustomAttribute`
Update	Instance	Mutation	`UserCustomAttributeSet`

Custom Field

Grants the ability to archive custom fields.

Action	Access	Kind	Name
Archive	Group	Mutation	`CustomFieldArchive`
Archive	Group	Mutation	`CustomFieldUnarchive`

Design

Grants the ability to create, delete, and update designs.

Action	Access	Kind	Name
Create	Project	Mutation	`DesignManagementUpload`
Delete	Project	Mutation	`DesignManagementDelete`
Update	Project	Mutation	`DesignManagementMove`
Update	Project	Mutation	`DesignManagementUpdate`

Label

Grants the ability to create, delete, promote, read, subscribe, and update labels.

Action	Access	Kind	Name
Create	Project	Mutation	`LabelCreate`
Create	Group	Mutation	`LabelCreate`
Read	Project	Type	`Label`
Read	Group	Type	`Label`
Update	Project	Mutation	`LabelUpdate`
Update	Group	Mutation	`LabelUpdate`

Timelog

Grants the ability to create and delete timelogs.

Action	Access	Kind	Name
Create	Project	Mutation	`TimelogCreate`
Create	Group	Mutation	`TimelogCreate`
Delete	Project	Mutation	`TimelogDelete`

Work Item

Grants the ability to create, delete, read, subscribe, and update work items such as epics and issues.

Action	Access	Kind	Name
Create ¹	Project	Mutation	`CreateAlertIssue`
Create	Project	Mutation	`CreateDiffNote`
Create	Project	Mutation	`CreateDiscussion`
Create	Project	Mutation	`CreateImageDiffNote`
Create	Project	Mutation	`CreateIssue`
Create	Project	Mutation	`CreateLatestDiffNote`
Create	Project	Mutation	`CreateNote`
Create	Project	Mutation	`CreateRequirement`
Create	Project	Mutation	`CreateTestCase`
Create	Project	Mutation	`WorkItemBulkMove`
Create	Project	Mutation	`WorkItemCreate`
Create	Project	Mutation	`WorkItemsCsvImport`
Create	Project	Field	`EpicIssue.createNoteEmail`
Create	Project	Field	`Issue.createNoteEmail`
Create	Project	Field	`WorkItem.createNoteEmail`
Create	Group	Mutation	`CreateDiffNote`
Create	Group	Mutation	`CreateDiscussion`
Create	Group	Mutation	`CreateImageDiffNote`
Create	Group	Mutation	`CreateIteration`
Create	Group	Mutation	`CreateLatestDiffNote`
Create	Group	Mutation	`CreateNote`
Create	Group	Mutation	`CustomFieldCreate`
Create	Group	Mutation	`IterationCadenceCreate`
Create	Group	Mutation	`LifecycleCreate`
Create	Group	Mutation	`WorkItemBulkMove`
Create	Group	Mutation	`WorkItemCreate`
Create	Group	Mutation	`WorkItemTypeCreate`
Create	Group	Mutation	`iterationCreate`
Delete	Project	Mutation	`DestroyNote`
Delete	Project	Mutation	`WorkItemDelete`
Delete	Group	Mutation	`DestroyNote`
Delete	Group	Mutation	`IterationCadenceDestroy`
Delete	Group	Mutation	`IterationDelete`
Delete	Group	Mutation	`LifecycleDelete`
Delete	Group	Mutation	`WorkItemDelete`
Read	Project	Type	`Board`
Read	Project	Type	`EpicIssue`
Read	Project	Type	`Issue`
Read	Project	Type	`Milestone`
Read	Project	Type	`Note`
Read	Project	Type	`WorkItem`
Read	Project	Mutation	`ExportRequirements`
Read	Project	Mutation	`WorkItemExport`
Read	Project	Mutation	`WorkItemsCsvExport`
Read	Group	Type	`Board`
Read	Group	Type	`BoardEpic`
Read	Group	Type	`Epic`
Read	Group	Type	`Iteration`
Read	Group	Type	`IterationCadence`
Read	Group	Type	`Milestone`
Read	Group	Type	`Note`
Read	Group	Type	`WorkItemMoveTarget`
Subscribe	Project	Mutation	`WorkItemSubscribe`
Subscribe	Group	Mutation	`WorkItemSubscribe`
Update	Project	Mutation	`DiscussionToggleResolve`
Update	Project	Mutation	`IssueLinkAlerts`
Update	Project	Mutation	`IssueMove`
Update	Project	Mutation	`IssueSetAssignees`
Update	Project	Mutation	`IssueSetConfidential`
Update	Project	Mutation	`IssueSetCrmContacts`
Update	Project	Mutation	`IssueSetDueDate`
Update	Project	Mutation	`IssueSetEpic`
Update	Project	Mutation	`IssueSetEscalationPolicy`
Update	Project	Mutation	`IssueSetEscalationStatus`
Update	Project	Mutation	`IssueSetIteration`
Update	Project	Mutation	`IssueSetLocked`
Update	Project	Mutation	`IssueSetSeverity`
Update	Project	Mutation	`IssueSetWeight`
Update	Project	Mutation	`IssueUnlinkAlert`
Update	Project	Mutation	`NoteConvertToThread`
Update	Project	Mutation	`RepositionImageDiffNote`
Update	Project	Mutation	`UpdateImageDiffNote`
Update	Project	Mutation	`UpdateIssue`
Update	Project	Mutation	`UpdateNote`
Update	Project	Mutation	`UpdateRequirement`
Update	Project	Mutation	`WorkItemAddClosingMergeRequest`
Update	Project	Mutation	`WorkItemAddLinkedItems`
Update	Project	Mutation	`WorkItemAvailabilityToggle`
Update	Project	Mutation	`WorkItemBulkMove`
Update	Project	Mutation	`WorkItemBulkUpdate`
Update	Project	Mutation	`WorkItemConvert`
Update	Project	Mutation	`WorkItemCreateFromTask`
Update	Project	Mutation	`WorkItemDecisionCreate`
Update	Project	Mutation	`WorkItemDecisionResolve`
Update	Project	Mutation	`WorkItemDecisionUpdate`
Update	Project	Mutation	`WorkItemEnableAiPlanning`
Update	Project	Mutation	`WorkItemGenerateReadinessScore`
Update	Project	Mutation	`WorkItemGenerateWorkplan`
Update	Project	Mutation	`WorkItemRemoveLinkedItems`
Update	Project	Mutation	`WorkItemResumeWorkplan`
Update	Project	Mutation	`WorkItemUpdate`
Update	Project	Mutation	`WorkItemUserPreferenceUpdate`
Update	Project	Mutation	`workItemsHierarchyReorder`
Update	Project	Mutation	`workItemsReorder`
Update	Group	Mutation	`CustomFieldUpdate`
Update	Group	Mutation	`IterationCadenceUpdate`
Update	Group	Mutation	`LifecycleAttachWorkItemType`
Update	Group	Mutation	`LifecycleUpdate`
Update	Group	Mutation	`UpdateImageDiffNote`
Update	Group	Mutation	`UpdateIteration`
Update	Group	Mutation	`UpdateNote`
Update	Group	Mutation	`WorkItemAddClosingMergeRequest`
Update	Group	Mutation	`WorkItemAddLinkedItems`
Update	Group	Mutation	`WorkItemAvailabilityToggle`
Update	Group	Mutation	`WorkItemBulkMove`
Update	Group	Mutation	`WorkItemBulkUpdate`
Update	Group	Mutation	`WorkItemConvert`
Update	Group	Mutation	`WorkItemDecisionCreate`
Update	Group	Mutation	`WorkItemDecisionResolve`
Update	Group	Mutation	`WorkItemDecisionUpdate`
Update	Group	Mutation	`WorkItemEnableAiPlanning`
Update	Group	Mutation	`WorkItemRemoveLinkedItems`
Update	Group	Mutation	`WorkItemSettingsUpdate`
Update	Group	Mutation	`WorkItemTypeUpdate`
Update	Group	Mutation	`WorkItemUpdate`
Update	Group	Mutation	`WorkItemUserPreferenceUpdate`
Update	Group	Mutation	`workItemsHierarchyReorder`
Update	Group	Mutation	`workItemsReorder`

¹ Also requires the Update Alert permission.

Work Item Saved View

Grants the ability to create, delete, subscribe, and update work item saved views.

Action	Access	Kind	Name
Create	Project	Mutation	`WorkItemSavedViewCreate`
Create	Group	Mutation	`WorkItemSavedViewCreate`
Delete	Project	Mutation	`WorkItemSavedViewDelete`
Delete	Group	Mutation	`WorkItemSavedViewDelete`
Subscribe	Project	Mutation	`WorkItemSavedViewReorder`
Subscribe	Project	Mutation	`WorkItemSavedViewSubscribe`
Subscribe	Project	Mutation	`WorkItemSavedViewUnsubscribe`
Subscribe	Group	Mutation	`WorkItemSavedViewReorder`
Subscribe	Group	Mutation	`WorkItemSavedViewSubscribe`
Subscribe	Group	Mutation	`WorkItemSavedViewUnsubscribe`
Update	Project	Mutation	`WorkItemSavedViewUpdate`
Update	Group	Mutation	`WorkItemSavedViewUpdate`

Projects resources

Markdown Upload

Grants the ability to create, delete, and read Markdown uploads.

Action	Access	Kind	Name
Create	Project	Mutation	`UploadCreate`
Create	Group	Mutation	`UploadCreate`
Delete	Project	Mutation	`UploadDelete`
Delete	Group	Mutation	`UploadDelete`

Page

Grants the ability to delete, read, and update pages.

Action	Access	Kind	Name
Delete	Project	Mutation	`DeletePagesDeployment`
Delete	Project	Mutation	`RestorePagesDeployment`
Read	Project	Type	`PagesDeployment`
Update	Project	Mutation	`PagesMarkOnboardingComplete`
Update	Project	Mutation	`SetPagesForceHttps`
Update	Project	Mutation	`SetPagesUseUniqueDomain`

Project

Grants the ability to archive, create, delete, fork, read, share, transfer, and update projects.

Action	Access	Kind	Name
Read	Project	Type	`Project`
Read	Project	Type	`RepositoryLanguage`
Transfer	Project	Mutation	`ProjectTransfer`
Update	Project	Mutation	`ProjectSettingsUpdate`
Update	Project	Mutation	`StarProject`

Repository resources

Approval Rule

Grants the ability to create, delete, read, and update approval rules.

Action	Access	Kind	Name
Create	Project	Mutation	`branchRuleApprovalProjectRuleCreate`
Delete	Project	Mutation	`approvalProjectRuleDelete`
Read	Project	Type	`ApprovalProjectRule`
Read	Project	Type	`ApprovalRule`
Update	Project	Mutation	`MergeRequestUpdateApprovalRule`
Update	Project	Mutation	`approvalProjectRuleUpdate`

Branch

Grants the ability to create, delete, protect, and read branches.

Action	Access	Kind	Name
Create	Project	Mutation	`CreateBranch`
Delete	Project	Mutation	`BranchDelete`
Read	Project	Type	`Branch`

Branch Rule

Grants the ability to create, delete, and update branch rules.

Action	Access	Kind	Name
Create	Project	Mutation	`BranchRuleCreate`
Delete	Project	Mutation	`BranchRuleDelete`
Delete	Project	Mutation	`BranchRuleSquashOptionDelete`
Update	Project	Mutation	`BranchRuleSquashOptionUpdate`
Update	Project	Mutation	`BranchRuleUpdate`

Code

Grants the ability to download, push, and read code via Git.

Action	Access	Kind	Name
Push	Project	Mutation	`CommitCreate`
Push ¹	Project	Mutation	`ConfigureContainerScanning`
Push ¹	Project	Mutation	`ConfigureDependencyScanning`
Push ¹	Project	Mutation	`ConfigureSast`
Push ¹	Project	Mutation	`ConfigureSastIac`
Push ¹	Project	Mutation	`ConfigureSecretDetection`
Push	Project	Mutation	`ProjectSyncFork`
Read	Project	Type	`Commit`
Read	Project	Type	`Repository`

¹ Also requires the Create Branch permission.

Merge Request

Grants the ability to approve, create, delete, merge, read, subscribe, and update merge requests.

Action	Access	Kind	Name
Create	Project	Mutation	`MergeRequestCreate`
Merge	Project	Mutation	`MergeRequestAccept`
Read	Project	Type	`AiSuggestedReviewer`
Read	Project	Type	`MergeRequest`
Read	Project	Type	`MergeRequestApprovalState`
Read	Project	Type	`MergeRequestWorkItemRelation`
Subscribe	Project	Mutation	`MergeRequestSetSubscription`
Update	Project	Mutation	`DismissPolicyViolations`
Update	Project	Mutation	`MergeRequestBypassSecurityPolicy`
Update	Project	Mutation	`MergeRequestCreateWorkItemRelations`
Update	Project	Mutation	`MergeRequestDestroyRequestedChanges`
Update	Project	Mutation	`MergeRequestDestroyWorkItemRelations`
Update	Project	Mutation	`MergeRequestRequestChanges`
Update	Project	Mutation	`MergeRequestResyncSecurityPolicies`
Update	Project	Mutation	`MergeRequestReviewerRereview`
Update	Project	Mutation	`MergeRequestSetAssignees`
Update	Project	Mutation	`MergeRequestSetBlockingMergeRequests`
Update	Project	Mutation	`MergeRequestSetDraft`
Update	Project	Mutation	`MergeRequestSetLabels`
Update	Project	Mutation	`MergeRequestSetLocked`
Update	Project	Mutation	`MergeRequestSetMilestone`
Update	Project	Mutation	`MergeRequestSetReviewers`
Update	Project	Mutation	`MergeRequestUpdate`

Merge Request Saved View

Grants the ability to create, delete, read, and update merge request saved views.

Action	Access	Kind	Name
Create	User	Mutation	`MergeRequestSavedViewCreate`
Delete	User	Mutation	`MergeRequestSavedViewDelete`
Read	User	Type	`MergeRequestSavedView`
Update	User	Mutation	`MergeRequestSavedViewUpdate`

Path Lock

Grants the ability to create path locks.

Action	Access	Kind	Name
Create	Project	Mutation	`ProjectSetLocked`

Push Rule

Grants the ability to create, delete, read, and update push rules.

Action	Access	Kind	Name
Read	Project	Type	`PushRules`

Repository

Grants the ability to create, delete, read, and update repositories.

Action	Access	Kind	Name
Read	Project	Type	`Blob`
Read	Project	Type	`RepositoryBlob`
Read	Project	Type	`Tree`

Repository History

Grants the ability to rewrite repository histories.

Action	Access	Kind	Name
Rewrite	Project	Mutation	`projectBlobsRemove`
Rewrite	Project	Mutation	`projectTextReplace`

Repository Tag

Grants the ability to create, delete, and read repository tags.

Action	Access	Kind	Name
Create	Project	Mutation	`TagCreate`
Delete	Project	Mutation	`TagDelete`
Read	Project	Type	`Tag`

Target Branch Rule

Grants the ability to create and delete target branch rules.

Action	Access	Kind	Name
Create	Project	Mutation	`ProjectTargetBranchRuleCreate`
Delete	Project	Mutation	`ProjectTargetBranchRuleDestroy`

Secrets Management resources

Secrets Manager Add-on

Grants the ability to enable the paid Secrets Manager add-on for a top-level group or for the whole instance.

Action	Access	Kind	Name
Enable ¹	Group	Mutation	`SecretsManagerEnableAddOn`
Enable ¹	Instance	Mutation	`SecretsManagerInstanceEnableAddOn`

¹ Also requires the Read Secrets Manager permission.

Secrets Manager Enrollment

Grants the ability to read secrets manager enrollments.

Action	Access	Kind	Name
Read	Instance	Type	`SecretsManagerInstanceEnrollment`

Secrets Manager Trial

Grants the ability to start a Secrets Manager trial for a top-level group or for the whole instance.

Action	Access	Kind	Name
Start ¹	Group	Mutation	`SecretsManagerStartTrial`
Start ¹	Instance	Mutation	`SecretsManagerInstanceStartTrial`

¹ Also requires the Read Secrets Manager permission.

Subscription and Licensing resources

Add On Assignment

Grants the ability to create and delete add on assignments.

Action	Access	Kind	Name
Create	Group	Mutation	`UserAddOnAssignmentBulkCreate`
Create	Group	Mutation	`UserAddOnAssignmentCreate`
Create	Instance	Mutation	`UserAddOnAssignmentBulkCreate`
Create	Instance	Mutation	`UserAddOnAssignmentCreate`
Delete	Group	Mutation	`UserAddOnAssignmentBulkRemove`
Delete	Group	Mutation	`UserAddOnAssignmentRemove`
Delete	Instance	Mutation	`UserAddOnAssignmentBulkRemove`
Delete	Instance	Mutation	`UserAddOnAssignmentRemove`

GitLab Subscription

Grants the ability to create, read, and update GitLab subscriptions.

Action	Access	Kind	Name
Update	Instance	Mutation	`GitlabSubscriptionActivate`

Member Approval

Grants the ability to update member approvals.

Action	Access	Kind	Name
Update	Instance	Mutation	`ProcessUserBillablePromotionRequest`

Subscription Usage Cap

Grants the ability to update subscription usage caps.

Action	Access	Kind	Name
Update	Group	Mutation	`UpsertFlatUserCap`
Update	Group	Mutation	`UpsertUserBudgetCapOverrides`
Update	Instance	Mutation	`UpsertFlatUserCap`
Update	Instance	Mutation	`UpsertUserBudgetCapOverrides`

System Access resources

Email

Grants the ability to create, delete, and read emails.

Action	Access	Kind	Name
Read	User	Type	`Email`

Job Token Scope

Grants the ability to read and update job token scopes.

Action	Access	Kind	Name
Update	Project	Mutation	`CiJobTokenScopeUpdatePolicies`

Job Token Scope Allowlist

Grants the ability to create, delete, and read job token scope allowlists.

Action	Access	Kind	Name
Create	Project	Mutation	`CiJobTokenScopeAddGroupOrProject`
Create	Project	Mutation	`CiJobTokenScopeAddProject`
Delete	Project	Mutation	`CiJobTokenScopeRemoveGroup`
Delete	Project	Mutation	`CiJobTokenScopeRemoveProject`

Member

Grants the ability to create, delete, read, and update members.

Action	Access	Kind	Name
Read	Project	Type	`ProjectMember`
Read	Group	Type	`GroupMember`
Read	Group	Mutation	`GroupMembersExport`
Update	Project	Mutation	`ProjectMemberBulkUpdate`
Update	Group	Mutation	`GroupMemberBulkUpdate`

Metadata

Grants the ability to read instance metadata.

Action	Access	Kind	Name
Read	Instance	Type	`GitlabInstanceFeatureFlag`
Read	Instance	Type	`Kas`
Read	Instance	Type	`Metadata`

Personal Access Token

Grants the ability to create, read, revoke, and rotate personal access tokens.

Action	Access	Kind	Name
Create	User	Mutation	`PersonalAccessTokenCreate`
Revoke	User	Mutation	`PersonalAccessTokenRevoke`
Rotate	User	Mutation	`PersonalAccessTokenRotate`

User

Grants the ability to activate, approve, ban, block, create, deactivate, delete, disable two factor, follow, read, reject, unban, unblock, unfollow, and update users.

Action	Access	Kind	Name
Read	User	Type	`AddOnUser`
Read	User	Type	`AutocompletedUser`
Read	User	Type	`CurrentUser`
Read	User	Type	`MergeRequestAssignee`
Read	User	Type	`MergeRequestAuthor`
Read	User	Type	`MergeRequestParticipant`
Read	User	Type	`MergeRequestReviewer`
Read	User	Type	`UserCore`

System Migration resources

Placeholder Reassignment

Grants the ability to create, read, and update placeholder reassignments.

Action	Access	Kind	Name
Update	Group	Mutation	`ImportSourceUserCancelReassignment`
Update	Group	Mutation	`ImportSourceUserKeepAllAsPlaceholder`
Update	Group	Mutation	`ImportSourceUserKeepAsPlaceholder`
Update	Group	Mutation	`ImportSourceUserResendNotification`
Update	Group	Mutation	`ImportSourceUserRetryFailedReassignment`
Update	Group	Mutation	`ImportSourceUserUndoKeepAsPlaceholder`

Value Stream resources

Value Stream

Grants the ability to create, delete, and update value streams.

Action	Access	Kind	Name
Create	Project	Mutation	`ValueStreamCreate`
Create	Group	Mutation	`ValueStreamCreate`
Delete	Project	Mutation	`ValueStreamDestroy`
Delete	Group	Mutation	`ValueStreamDestroy`
Update	Project	Mutation	`ValueStreamUpdate`
Update	Group	Mutation	`ValueStreamUpdate`

Wiki resources

Wiki

Grants the ability to create, delete, read, subscribe, and update wikis.

Action	Access	Kind	Name
Subscribe	Project	Mutation	`WikiPageSubscribe`

Workspace resources

Cluster Agent Mapping

Grants the ability to create and delete cluster agent mappings.

Action	Access	Kind	Name
Create	Group	Mutation	`NamespaceCreateRemoteDevelopmentClusterAgentMapping`
Create	Instance	Mutation	`OrganizationCreateClusterAgentMapping`
Delete	Group	Mutation	`NamespaceDeleteRemoteDevelopmentClusterAgentMapping`
Delete	Instance	Mutation	`OrganizationDeleteClusterAgentMapping`

Workspace

Grants the ability to create and update workspaces.

Action	Access	Kind	Name
Create	Project	Mutation	`WorkspaceCreate`
Update	Project	Mutation	`WorkspaceUpdate`