# Role A Role groups the permissions that govern what a credential can do in a project. The same role definition is applied to **collaborators**, **SSO users**, and **API tokens** alike — design roles around what the *credential* should be allowed to do, not who is holding it. > [!PROTIP] 📘 Same role, different identities > Ask "what is the *credential* allowed to do?" — not "what is this *person* allowed to do?". For API tokens specifically, the role's permissions are further constrained by the token's API surface flags (`can_access_cda`, `can_access_cda_preview`, `can_access_cma`); see the [API token](https://www.datocms.com/docs/content-management-api/resources/access-token.md) resource for details. ## How permissions are computed Most of the granular permissions on a role come as a `positive__permissions` / `negative__permissions` pair: build triggers, search indexes, records (`item_type`), uploads. They all follow the same rule: > Effective permissions = `(inherited ∪ positive_*) − negative_*` Positive entries (and entries pulled in via `relationships.inherits_permissions_from`) grant access. Negative entries always win when they overlap. The idiomatic recipe for "almost everything" is a single `action: "all"` positive entry plus targeted negative entries to subtract — instead of enumerating each allowed action. > [!WARNING] ⚠️ Send positive_* and negative_* together > For each resource family (records, uploads, build triggers, search indexes), the matching `positive_*` and `negative_*` arrays must be **both present or both absent** in a create/update payload. On **update**, sent arrays *replace* the stored ones wholesale, so always read the role first and pass back the existing entries on the side you're not changing — sending `[]` to satisfy the constraint will erase everything that was there. (On create, `[]` is fine since there's nothing to lose.) The [Update endpoint](https://www.datocms.com/docs/content-management-api/resources/role/update.md) documents an SDK helper that handles this diff for records and uploads. The computed result is exposed on every role response under `meta.final_permissions`; the raw declared values stay on `attributes.*`. See [Effective vs declared permissions](https://www.datocms.com/docs/content-management-api/resources/role.md#effective-vs-declared-permissions) below. ## Project-level permissions These attributes gate access to project-wide capabilities. They apply uniformly across the whole project; granular control over individual records and uploads lives under [Per-environment content permissions](https://www.datocms.com/docs/content-management-api/resources/role.md#per-environment-content-permissions). - **Project-wide flags.** Boolean attributes named `can_*` (`can_edit_schema`, `can_manage_environments`, `can_manage_access_tokens`, …) cover the schema, environments, users, webhooks, and so on — see the property table for the full list. - **Environment access.** `environments_access` controls *which* environments the credential can enter at all (`all`, `primary_only`, `sandbox_only`, or `none`). Use `none` when the role is meant only to be inherited from. - **Build triggers.** The role may **manually fire** the build triggers listed in `positive_build_trigger_permissions`, minus those listed in `negative_build_trigger_permissions`. Use `build_trigger: null` on an entry to cover every trigger at once. Creating, editing, or deleting trigger definitions is gated separately by `can_manage_build_triggers`. - **Search indexes.** The role may **manually re-index** the search indexes listed in `positive_search_index_permissions`, minus those listed in `negative_search_index_permissions`. Use `search_index: null` on an entry to cover every index. Managing the index definitions themselves is gated separately by `can_manage_search_indexes`. ## Per-environment content permissions The role's access to **records** and **uploads** is governed by two positive/negative array pairs. Every entry is **scoped to a single environment** via the required `environment` field — to grant the same permission across multiple environments, repeat the entry once per environment id (or use `inherits_permissions_from` together with `environments_access`). The computation is the same `(inherited ∪ positive_*) − negative_*` rule from [How permissions are computed](https://www.datocms.com/docs/content-management-api/resources/role.md#how-permissions-are-computed), evaluated per environment. ###### Records Permission entries live in `positive_item_type_permissions` (and the `negative_*` counterpart). Each entry is a discriminated union keyed by `action`: - `all` — every action below - `read` — read records - `create` — create new records - `update` — edit existing records - `publish` — publish/unpublish records - `duplicate` — duplicate records - `delete` — destroy records - `edit_creator` — change a record's `creator` relationship - `take_over` — wrest a record from another user currently editing it - `move_to_stage` — move a record between workflow stages Per entry you can also restrict by: - `item_type` — restrict to a specific model (`null` = all models) - `workflow` — restrict to records associated with a workflow (mutually exclusive with `item_type`) - `on_creator` — `anyone`, `self` (records the credential created), or `role` (records created by anyone with this role) - `localization_scope` + `locale` — for `create`/`update`/`publish`/`all`: restrict to localized vs non-localized content, optionally pinning to one locale (on `all` the scope is forced to `"all"`) - `on_stage` / `to_stage` — for workflow-aware actions: restrict to records currently on a stage, or to moves towards a stage The shape of each entry depends on the `action` — see the property tables on each endpoint for which sub-fields are valid per branch. > [!WARNING] ⚠️ Some restrictors require an Enterprise plan > Workflow-aware permissions — the `move_to_stage` action and the `workflow` / `on_stage` / `to_stage` restrictors — require [Workflows](https://www.datocms.com/features/workflows.md), an Enterprise feature. Per-content-scope restrictions are also gated: only `localization_scope: "all"` is available on every plan, while `"localized"` (with its companion `locale`) and `"not_localized"` both require Enterprise. Setting any of these on a non-Enterprise project will return an error — check the [pricing page](https://www.datocms.com/pricing.md) before relying on them. ###### Uploads Permission entries live in `positive_upload_permissions` (and the `negative_*` counterpart). Same discriminated-union shape as records, with the upload-relevant actions (`read`, `create`, `update`, `delete`, `edit_creator`, `replace_asset`, `move`, `all`), scoped by `upload_collection` instead of `item_type`. The `move` action also accepts `move_to_upload_collection` to restrict the destination of the move. ## Inheriting from other roles `relationships.inherits_permissions_from` accepts a list of role ids whose permissions are unioned into this role's positive set before the negative set is subtracted (per [How permissions are computed](https://www.datocms.com/docs/content-management-api/resources/role.md#how-permissions-are-computed)). This is how built-in roles are typically extended without copying their full permission tree — duplicate the closest built-in role, then add a `negative_*` entry to take something away, or set `inherits_permissions_from` and add only the positive entries that differ. ## Effective vs declared permissions Two views of a role's permissions are surfaced on the response: - **`attributes.*`** — the permissions declared *on this role directly*. This is what was sent on create/update; it does not reflect anything inherited from `relationships.inherits_permissions_from`. - **`meta.final_permissions`** — the **effective** permissions after walking the inheritance chain and applying the rule from [How permissions are computed](https://www.datocms.com/docs/content-management-api/resources/role.md#how-permissions-are-computed). This is the set actually enforced when a credential bound to this role makes a request. When debugging "why can't this user do X?", read `meta.final_permissions`, not `attributes`. ## Object payload **`id`** - Type: string - Example: `"34"` ID of role **`type`** - Type: string Must be exactly `"role"`. **`name`** - Type: string - Example: `"Editor"` The name of the role **`can_edit_site`** - Type: boolean Can change project-wide settings (project name, internal subdomain, frontend preview URL, deployment settings) **`can_edit_favicon`** - Type: boolean Can edit favicon, global SEO settings and no-index policy **`can_edit_schema`** - Type: boolean Can create and edit the project schema: models, block models, fields, fieldsets, validators, and plugins **`can_manage_menu`** - Type: boolean Can customize content navigation bar **`can_manage_users`** - Type: boolean Can create and edit roles and invite/remove collaborators **`can_manage_shared_filters`** - Type: boolean Can create and edit shared filters (both for models and the media area) **`can_manage_search_indexes`** - Type: boolean Can create and edit search indexes **`can_manage_upload_collections`** - Type: boolean Can create and edit upload collections **`can_manage_environments`** - Type: boolean Can create, fork, and delete sandbox environments. Promotion to primary is gated separately by `can_promote_environments`. **`can_manage_webhooks`** - Type: boolean Can create and edit webhooks **`environments_access`** - Type: enum - Example: `"primary_only"` Specifies the environments the user can access
Show enum values **`all`** Grants access to all environments **`primary_only`** Grants access exclusively to the primary environment **`sandbox_only`** Grants access exclusively to sandbox environments **`none`** No access to any environment. This value is typically used when the role is intended to inherit access settings from other roles
**`can_manage_sso`** - Type: boolean Can manage Single Sign-On settings **`can_access_audit_log`** - Type: boolean Can access Audit Log **`can_manage_workflows`** - Type: boolean Can create and edit workflows **`can_edit_environment`** - Type: boolean Can edit per-environment settings of the environments this role has access to: locales, timezone, and UI theme. This is *not* about creating or switching environments — see `can_manage_environments` for that, and `environments_access` for which environments this role can enter at all. **`can_promote_environments`** - Type: boolean Can promote a sandbox environment to primary (atomic swap) and toggle the project's maintenance mode. Distinct from `can_manage_environments`, which covers creating/forking/deleting sandboxes. **`can_manage_build_triggers`** - Type: boolean Can create and edit build triggers **`can_manage_access_tokens`** - Type: boolean Can manage API tokens **`can_perform_site_search`** - Type: boolean Can perform Site Search API calls **`can_access_build_events_log`** - Type: boolean Can access the build events log **`can_access_search_index_events_log`** - Type: boolean Can access the search index events log **`positive_item_type_permissions`** - Type: Array\ Allowed actions on a model (or all) for a role. The shape of each entry depends on the `action` (discriminated union). Idiomatic recipes: - To grant every action, use a single `action: "all"` entry with `localization_scope: "all"`. - To grant a subset (e.g. create+read+update but not delete), prefer a single `action: "all"` entry plus `negative_item_type_permissions` entries for the actions to exclude — instead of listing each allowed action separately.
Show object format when action is "all" **`action`** - Type: enum - Example: `"all"` Permitted action
Show enum values **`all`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` For `action: "all"` this must be `"all"`.
Show enum values **`all`**
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`to_stage`** - Type: string, null Restrict to moves towards a specific workflow stage.
Show object format when action is "read" **`action`** - Type: enum - Example: `"read"` Permitted action
Show enum values **`read`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`.
Show object format when action is "create" **`action`** - Type: enum - Example: `"create"` Permitted action
Show enum values **`create`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Content under a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "update" or "publish" **`action`** - Type: enum - Example: `"update"` Permitted action
Show enum values **`update`** **`publish`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Content under a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "duplicate" **`action`** - Type: enum - Example: `"duplicate"` Permitted action
Show enum values **`duplicate`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage.
Show object format when action is "delete" or "edit_creator" or "take_over" **`action`** - Type: enum - Example: `"delete"` Permitted action
Show enum values **`delete`** **`edit_creator`** **`take_over`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage.
Show object format when action is "move_to_stage" **`action`** - Type: enum - Example: `"move_to_stage"` Permitted action
Show enum values **`move_to_stage`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`to_stage`** - Type: string, null Restrict to moves towards a specific workflow stage.
**`negative_item_type_permissions`** - Type: Array\ Prohibited actions on a model (or all) for a role. Negative permissions take precedence and are typically paired with a broader positive `action: "all"` entry to subtract specific actions (e.g. forbid `delete`).
Show object format when action is "all" **`action`** - Type: enum - Example: `"all"` Permitted action
Show enum values **`all`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` For `action: "all"` this must be `"all"`.
Show enum values **`all`**
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`to_stage`** - Type: string, null Restrict to moves towards a specific workflow stage.
Show object format when action is "read" **`action`** - Type: enum - Example: `"read"` Permitted action
Show enum values **`read`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`.
Show object format when action is "create" **`action`** - Type: enum - Example: `"create"` Permitted action
Show enum values **`create`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Content under a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "update" or "publish" **`action`** - Type: enum - Example: `"update"` Permitted action
Show enum values **`update`** **`publish`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Content under a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "duplicate" **`action`** - Type: enum - Example: `"duplicate"` Permitted action
Show enum values **`duplicate`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage.
Show object format when action is "delete" or "edit_creator" or "take_over" **`action`** - Type: enum - Example: `"delete"` Permitted action
Show enum values **`delete`** **`edit_creator`** **`take_over`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage.
Show object format when action is "move_to_stage" **`action`** - Type: enum - Example: `"move_to_stage"` Permitted action
Show enum values **`move_to_stage`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`to_stage`** - Type: string, null Restrict to moves towards a specific workflow stage.
**`positive_upload_permissions`** - Type: Array\ Allowed actions on uploads (or all) for a role. The shape of each entry depends on the `action` (discriminated union). To grant a subset, prefer a single `action: "all"` entry plus `negative_upload_permissions` entries for the actions to exclude.
Show object format when action is "all" **`action`** - Type: enum - Example: `"all"` Permitted action
Show enum values **`all`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` For `action: "all"` this must be `"all"`.
Show enum values **`all`**
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "update" **`action`** - Type: enum - Example: `"update"` Permitted action
Show enum values **`update`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Localized content in a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "create" **`action`** - Type: enum - Example: `"create"` Permitted action
Show enum values **`create`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "read" or "delete" or "edit_creator" or "replace_asset" **`action`** - Type: enum - Example: `"read"` Permitted action
Show enum values **`read`** **`delete`** **`edit_creator`** **`replace_asset`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "move" **`action`** - Type: enum - Example: `"move"` Permitted action
Show enum values **`move`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections. **`move_to_upload_collection`** - Type: string, null Restricts the destination upload collection of the move action. When `null`, any destination is allowed.
**`negative_upload_permissions`** - Type: Array\ Prohibited actions on uploads (or all) for a role. Negative permissions take precedence and are typically paired with a broader positive `action: "all"` entry to subtract specific actions.
Show object format when action is "all" **`action`** - Type: enum - Example: `"all"` Permitted action
Show enum values **`all`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` For `action: "all"` this must be `"all"`.
Show enum values **`all`**
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "update" **`action`** - Type: enum - Example: `"update"` Permitted action
Show enum values **`update`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Localized content in a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "create" **`action`** - Type: enum - Example: `"create"` Permitted action
Show enum values **`create`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "read" or "delete" or "edit_creator" or "replace_asset" **`action`** - Type: enum - Example: `"read"` Permitted action
Show enum values **`read`** **`delete`** **`edit_creator`** **`replace_asset`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "move" **`action`** - Type: enum - Example: `"move"` Permitted action
Show enum values **`move`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections. **`move_to_upload_collection`** - Type: string, null Restricts the destination upload collection of the move action. When `null`, any destination is allowed.
**`positive_build_trigger_permissions`** - Type: Array\ Build triggers this role is allowed to **manually fire**. An entry with `build_trigger: null` covers every build trigger. Note: this does not control creating/editing build triggers themselves — that is gated by `can_manage_build_triggers`.
Show objects format inside array **`build_trigger`** - Type: string, null
**`negative_build_trigger_permissions`** - Type: Array\ Build triggers this role is **forbidden** from manually firing. Negative entries take precedence over positive ones; pair with a `build_trigger: null` positive entry to allow all-but-N.
Show objects format inside array **`build_trigger`** - Type: string, null
**`positive_search_index_permissions`** - Type: Array\ Search indexes this role is allowed to **manually re-index**. An entry with `search_index: null` covers every search index. Note: this does not control creating/editing search indexes themselves — that is gated by `can_manage_search_indexes`.
Show objects format inside array **`search_index`** - Type: string, null
**`negative_search_index_permissions`** - Type: Array\ Search indexes this role is **forbidden** from manually re-indexing. Negative entries take precedence over positive ones; pair with a `search_index: null` positive entry to allow all-but-N.
Show objects format inside array **`search_index`** - Type: string, null
**`meta.final_permissions`** - Type: object The final set of permissions considering also inherited roles
Show object format **`can_edit_site`** - Type: boolean Can change project-wide settings (project name, internal subdomain, frontend preview URL, deployment settings) **`can_edit_favicon`** - Type: boolean Can edit favicon, global SEO settings and no-index policy **`can_edit_schema`** - Type: boolean Can create and edit the project schema: models, block models, fields, fieldsets, validators, and plugins **`can_manage_menu`** - Type: boolean Can customize content navigation bar **`can_manage_users`** - Type: boolean Can create and edit roles and invite/remove collaborators **`can_manage_environments`** - Type: boolean Can create, fork, and delete sandbox environments. Promotion to primary is gated separately by `can_promote_environments`. **`can_manage_webhooks`** - Type: boolean Can create and edit webhooks **`environments_access`** - Type: enum - Example: `"primary_only"` Specifies the environments the user can access
Show enum values **`all`** Grants access to all environments **`primary_only`** Grants access exclusively to the primary environment **`sandbox_only`** Grants access exclusively to sandbox environments **`none`** No access to any environment. This value is typically used when the role is intended to inherit access settings from other roles
**`can_manage_sso`** - Type: boolean Can manage Single Sign-On settings **`can_access_audit_log`** - Type: boolean Can access Audit Log **`can_manage_workflows`** - Type: boolean Can create and edit workflows **`can_edit_environment`** - Type: boolean Can edit per-environment settings of the environments this role has access to: locales, timezone, and UI theme. This is *not* about creating or switching environments — see `can_manage_environments` for that, and `environments_access` for which environments this role can enter at all. **`can_promote_environments`** - Type: boolean Can promote a sandbox environment to primary (atomic swap) and toggle the project's maintenance mode. Distinct from `can_manage_environments`, which covers creating/forking/deleting sandboxes. **`can_manage_shared_filters`** - Type: boolean Can create and edit shared filters (both for models and the media area) **`can_manage_search_indexes`** - Type: boolean Can create and edit search indexes **`can_manage_build_triggers`** - Type: boolean Can create and edit build triggers **`can_manage_upload_collections`** - Type: boolean Can create and edit upload collections **`can_manage_access_tokens`** - Type: boolean Can manage API tokens **`can_perform_site_search`** - Type: boolean Can perform Site Search API calls **`can_access_build_events_log`** - Type: boolean Can access the build events log **`can_access_search_index_events_log`** - Type: boolean Can access the search index events log **`positive_item_type_permissions`** - Type: Array\ Allowed actions on a model (or all) for a role. The shape of each entry depends on the `action` (discriminated union). Idiomatic recipes: - To grant every action, use a single `action: "all"` entry with `localization_scope: "all"`. - To grant a subset (e.g. create+read+update but not delete), prefer a single `action: "all"` entry plus `negative_item_type_permissions` entries for the actions to exclude — instead of listing each allowed action separately.
Show object format when action is "all" **`action`** - Type: enum - Example: `"all"` Permitted action
Show enum values **`all`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` For `action: "all"` this must be `"all"`.
Show enum values **`all`**
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`to_stage`** - Type: string, null Restrict to moves towards a specific workflow stage.
Show object format when action is "read" **`action`** - Type: enum - Example: `"read"` Permitted action
Show enum values **`read`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`.
Show object format when action is "create" **`action`** - Type: enum - Example: `"create"` Permitted action
Show enum values **`create`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Content under a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "update" or "publish" **`action`** - Type: enum - Example: `"update"` Permitted action
Show enum values **`update`** **`publish`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Content under a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "duplicate" **`action`** - Type: enum - Example: `"duplicate"` Permitted action
Show enum values **`duplicate`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage.
Show object format when action is "delete" or "edit_creator" or "take_over" **`action`** - Type: enum - Example: `"delete"` Permitted action
Show enum values **`delete`** **`edit_creator`** **`take_over`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage.
Show object format when action is "move_to_stage" **`action`** - Type: enum - Example: `"move_to_stage"` Permitted action
Show enum values **`move_to_stage`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`to_stage`** - Type: string, null Restrict to moves towards a specific workflow stage.
**`negative_item_type_permissions`** - Type: Array\ Prohibited actions on a model (or all) for a role. Negative permissions take precedence and are typically paired with a broader positive `action: "all"` entry to subtract specific actions (e.g. forbid `delete`).
Show object format when action is "all" **`action`** - Type: enum - Example: `"all"` Permitted action
Show enum values **`all`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` For `action: "all"` this must be `"all"`.
Show enum values **`all`**
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`to_stage`** - Type: string, null Restrict to moves towards a specific workflow stage.
Show object format when action is "read" **`action`** - Type: enum - Example: `"read"` Permitted action
Show enum values **`read`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`.
Show object format when action is "create" **`action`** - Type: enum - Example: `"create"` Permitted action
Show enum values **`create`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Content under a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "update" or "publish" **`action`** - Type: enum - Example: `"update"` Permitted action
Show enum values **`update`** **`publish`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Content under a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "duplicate" **`action`** - Type: enum - Example: `"duplicate"` Permitted action
Show enum values **`duplicate`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage.
Show object format when action is "delete" or "edit_creator" or "take_over" **`action`** - Type: enum - Example: `"delete"` Permitted action
Show enum values **`delete`** **`edit_creator`** **`take_over`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage.
Show object format when action is "move_to_stage" **`action`** - Type: enum - Example: `"move_to_stage"` Permitted action
Show enum values **`move_to_stage`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`item_type`** - Type: string, null Restricts the permission to a specific model. When `null`, the permission applies to all models. **`workflow`** - Type: string, null Restricts the permission to records associated with a specific workflow. Mutually exclusive with `item_type`. **`on_stage`** - Type: string, null Restrict to records currently on a workflow stage. **`to_stage`** - Type: string, null Restrict to moves towards a specific workflow stage.
**`positive_upload_permissions`** - Type: Array\ Allowed actions on uploads (or all) for a role. The shape of each entry depends on the `action` (discriminated union). To grant a subset, prefer a single `action: "all"` entry plus `negative_upload_permissions` entries for the actions to exclude.
Show object format when action is "all" **`action`** - Type: enum - Example: `"all"` Permitted action
Show enum values **`all`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` For `action: "all"` this must be `"all"`.
Show enum values **`all`**
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "update" **`action`** - Type: enum - Example: `"update"` Permitted action
Show enum values **`update`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Localized content in a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "create" **`action`** - Type: enum - Example: `"create"` Permitted action
Show enum values **`create`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "read" or "delete" or "edit_creator" or "replace_asset" **`action`** - Type: enum - Example: `"read"` Permitted action
Show enum values **`read`** **`delete`** **`edit_creator`** **`replace_asset`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "move" **`action`** - Type: enum - Example: `"move"` Permitted action
Show enum values **`move`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections. **`move_to_upload_collection`** - Type: string, null Restricts the destination upload collection of the move action. When `null`, any destination is allowed.
**`negative_upload_permissions`** - Type: Array\ Prohibited actions on uploads (or all) for a role. Negative permissions take precedence and are typically paired with a broader positive `action: "all"` entry to subtract specific actions.
Show object format when action is "all" **`action`** - Type: enum - Example: `"all"` Permitted action
Show enum values **`all`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` For `action: "all"` this must be `"all"`.
Show enum values **`all`**
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "update" **`action`** - Type: enum - Example: `"update"` Permitted action
Show enum values **`update`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`localization_scope`** - Type: enum - Example: `"all"` Permitted content scope
Show enum values **`all`** Any content (localized/unlocalized) **`localized`** Localized content in a specific locale (`locale` must be defined) **`not_localized`** Non-localized content
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections. **`locale`** - Type: string, null - Example: `"en"` Required (non-null) when `localization_scope` is `"localized"`; must be omitted otherwise.
Show object format when action is "create" **`action`** - Type: enum - Example: `"create"` Permitted action
Show enum values **`create`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "read" or "delete" or "edit_creator" or "replace_asset" **`action`** - Type: enum - Example: `"read"` Permitted action
Show enum values **`read`** **`delete`** **`edit_creator`** **`replace_asset`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections.
Show object format when action is "move" **`action`** - Type: enum - Example: `"move"` Permitted action
Show enum values **`move`**
**`environment`** - Type: string - Example: `"main"` ID of environment. Can only contain lowercase letters, numbers and dashes **`on_creator`** - Type: enum - Example: `"anyone"` Permitted creator
Show enum values **`anyone`** Created by anyone **`self`** Created by the user itself **`role`** Created by a user with the same role
**`upload_collection`** - Type: string, null Restricts the permission to a specific upload collection. When `null`, the permission applies to all collections. **`move_to_upload_collection`** - Type: string, null Restricts the destination upload collection of the move action. When `null`, any destination is allowed.
**`positive_build_trigger_permissions`** - Type: Array\ Build triggers this role is allowed to **manually fire**. An entry with `build_trigger: null` covers every build trigger. Note: this does not control creating/editing build triggers themselves — that is gated by `can_manage_build_triggers`.
Show objects format inside array **`build_trigger`** - Type: string, null
**`negative_build_trigger_permissions`** - Type: Array\ Build triggers this role is **forbidden** from manually firing. Negative entries take precedence over positive ones; pair with a `build_trigger: null` positive entry to allow all-but-N.
Show objects format inside array **`build_trigger`** - Type: string, null
**`positive_search_index_permissions`** - Type: Array\ Search indexes this role is allowed to **manually re-index**. An entry with `search_index: null` covers every search index. Note: this does not control creating/editing search indexes themselves — that is gated by `can_manage_search_indexes`.
Show objects format inside array **`search_index`** - Type: string, null
**`negative_search_index_permissions`** - Type: Array\ Search indexes this role is **forbidden** from manually re-indexing. Negative entries take precedence over positive ones; pair with a `search_index: null` positive entry to allow all-but-N.
Show objects format inside array **`search_index`** - Type: string, null
**`inherits_permissions_from`** - Type: Array<[ResourceLinkage\<"role"\>](https://www-draft.datocms.com/docs/content-management-api/resources/role.md)> The roles from which this role inherits permissions ## Available endpoints - [Create a new role](https://www.datocms.com/docs/content-management-api/resources/role/create.md) - [Update a role](https://www.datocms.com/docs/content-management-api/resources/role/update.md) - [List all roles](https://www.datocms.com/docs/content-management-api/resources/role/instances.md) - [Retrieve a role](https://www.datocms.com/docs/content-management-api/resources/role/self.md) - [Delete a role](https://www.datocms.com/docs/content-management-api/resources/role/destroy.md) - [Duplicate a role](https://www.datocms.com/docs/content-management-api/resources/role/duplicate.md) ## Related content in "Content Management API" - [Content Management API Overview](https://www.datocms.com/docs/content-management-api.md) - [Using the JavaScript CMA client](https://www.datocms.com/docs/content-management-api/using-the-nodejs-clients.md) - [API versioning](https://www.datocms.com/docs/content-management-api/api-versioning.md) - [Authentication](https://www.datocms.com/docs/content-management-api/authentication.md) - [Environments](https://www.datocms.com/docs/content-management-api/setting-the-environment.md) - [Error codes & handling failures (CMA)](https://www.datocms.com/docs/content-management-api/errors.md) - [Pagination](https://www.datocms.com/docs/content-management-api/pagination.md) - [Asynchronous jobs](https://www.datocms.com/docs/content-management-api/async-jobs.md) - [CMA Technical Limits & Rate Limits](https://www.datocms.com/docs/content-management-api/technical-limits.md) - [Record](https://www.datocms.com/docs/content-management-api/resources/item.md) - [Scheduled publication](https://www.datocms.com/docs/content-management-api/resources/scheduled-publication.md) - [Scheduled unpublishing](https://www.datocms.com/docs/content-management-api/resources/scheduled-unpublishing.md) - [Upload](https://www.datocms.com/docs/content-management-api/resources/upload.md) - [Site](https://www.datocms.com/docs/content-management-api/resources/site.md) - [Model/Block model](https://www.datocms.com/docs/content-management-api/resources/item-type.md) - [Field](https://www.datocms.com/docs/content-management-api/resources/field.md) - [Fieldset](https://www.datocms.com/docs/content-management-api/resources/fieldset.md) - [Record version](https://www.datocms.com/docs/content-management-api/resources/item-version.md) - [Upload permission](https://www.datocms.com/docs/content-management-api/resources/upload-request.md) - [Upload track](https://www.datocms.com/docs/content-management-api/resources/upload-track.md) - [Manual tags](https://www.datocms.com/docs/content-management-api/resources/upload-tag.md) - [Smart tags](https://www.datocms.com/docs/content-management-api/resources/upload-smart-tag.md) - [Upload Collection](https://www.datocms.com/docs/content-management-api/resources/upload-collection.md) - [Search Index](https://www.datocms.com/docs/content-management-api/resources/search-index.md) - [Search result](https://www.datocms.com/docs/content-management-api/resources/search-result.md) - [Search indexing activity](https://www.datocms.com/docs/content-management-api/resources/search-index-event.md) - [Environment](https://www.datocms.com/docs/content-management-api/resources/environment.md) - [Maintenance mode](https://www.datocms.com/docs/content-management-api/resources/maintenance-mode.md) - [Menu Item](https://www.datocms.com/docs/content-management-api/resources/menu-item.md) - [Schema Menu Item](https://www.datocms.com/docs/content-management-api/resources/schema-menu-item.md) - [Uploads filter](https://www.datocms.com/docs/content-management-api/resources/upload-filter.md) - [Model filter](https://www.datocms.com/docs/content-management-api/resources/item-type-filter.md) - [Plugin](https://www.datocms.com/docs/content-management-api/resources/plugin.md) - [Workflow](https://www.datocms.com/docs/content-management-api/resources/workflow.md) - [Asynchronous job](https://www.datocms.com/docs/content-management-api/resources/job.md) - [Job result](https://www.datocms.com/docs/content-management-api/resources/job-result.md) - [Account](https://www.datocms.com/docs/content-management-api/resources/account.md) - [Organization](https://www.datocms.com/docs/content-management-api/resources/organization.md) - [Invitation](https://www.datocms.com/docs/content-management-api/resources/site-invitation.md) - [Collaborator](https://www.datocms.com/docs/content-management-api/resources/user.md) - [Role](https://www.datocms.com/docs/content-management-api/resources/role.md) - [Create a new role](https://www.datocms.com/docs/content-management-api/resources/role/create.md) - [Update a role](https://www.datocms.com/docs/content-management-api/resources/role/update.md) - [List all roles](https://www.datocms.com/docs/content-management-api/resources/role/instances.md) - [Retrieve a role](https://www.datocms.com/docs/content-management-api/resources/role/self.md) - [Delete a role](https://www.datocms.com/docs/content-management-api/resources/role/destroy.md) - [Duplicate a role](https://www.datocms.com/docs/content-management-api/resources/role/duplicate.md) - [API token](https://www.datocms.com/docs/content-management-api/resources/access-token.md) - [Webhook](https://www.datocms.com/docs/content-management-api/resources/webhook.md) - [Webhook call](https://www.datocms.com/docs/content-management-api/resources/webhook-call.md) - [Build trigger](https://www.datocms.com/docs/content-management-api/resources/build-trigger.md) - [Deploy activity](https://www.datocms.com/docs/content-management-api/resources/build-event.md) - [Subscription limit](https://www.datocms.com/docs/content-management-api/resources/subscription-limit.md) - [Subscription feature](https://www.datocms.com/docs/content-management-api/resources/subscription-feature.md) - [SSO Settings](https://www.datocms.com/docs/content-management-api/resources/sso-settings.md) - [SSO User](https://www.datocms.com/docs/content-management-api/resources/sso-user.md) - [SSO Group](https://www.datocms.com/docs/content-management-api/resources/sso-group.md) - [White-label settings](https://www.datocms.com/docs/content-management-api/resources/white-label-settings.md) - [Audit log event](https://www.datocms.com/docs/content-management-api/resources/audit-log-event.md)