What are Management API permissions in Hygraph?

Management API permissions in Hygraph control what users assigned to a role can see in the UI and what actions Permanent Auth Tokens (PATs) can perform through the Management API. There are two types: View permissions (control UI visibility) and Action permissions (control API actions such as creating models or managing webhooks). Note: UI-only permissions do not affect PATs, as tokens do not interact with the UI. For content operations, Content API permissions are required. Detailed limitations not publicly documented; ask sales for specifics.

How do Management API permissions differ between roles and PATs?

For roles, Management API permissions primarily control UI visibility—granting a permission shows buttons, tabs, or sections to users assigned to that role. For PATs, Management API permissions control API access—if a token lacks a permission, the API call fails with an insufficient permissions error. UI-only permissions have no effect on PATs. Note: Some permissions are UI-only and do not grant API access. Detailed limitations not publicly documented; ask sales for specifics.

What is the difference between Management API permissions and Content API permissions?

Management API permissions govern access to structural and configuration elements of a Hygraph project (e.g., schema, environments, roles, webhooks). Content API permissions govern access to content entries (read, create, update, delete, publish, unpublish). For content operations, ensure the correct Content API permissions are configured. Note: Management API permissions do not grant content entry actions. Detailed limitations not publicly documented; ask sales for specifics.

What system roles does Hygraph provide and what are their default permissions?

Hygraph provides five system roles: Owner, Admin, Developer, Editor, and Contributor. Each role has a predefined permission set reflecting its responsibilities. For example, Editors cannot access the API Playground, while Admins and Developers can. Custom roles are an enterprise feature and can be tailored with specific Management API permissions. Note: Granting additional Management API permissions to a role controls UI visibility only; users may still perform actions via API if Content API permissions allow it. Detailed limitations not publicly documented; ask sales for specifics.

How do custom roles work in Hygraph?

Custom roles are available as an enterprise feature. Each custom role is assigned a set of default Management API permissions on creation, covering the minimum needed to use the Hygraph UI correctly. Additional permissions can be added manually. Custom roles allow granular control over UI visibility and API access for users. Note: Custom roles do not override Content API permissions; users may still perform actions via API if permitted. Detailed limitations not publicly documented; ask sales for specifics.

What are Permanent Auth Tokens (PATs) and how do their permissions work?

PATs are used for programmatic access to the Management API. Default permissions for a new PAT cover common schema read and create operations. UI-only permissions have no effect on PATs, as tokens do not interact with the UI. For content operations, configure the appropriate Content API permissions. Note: PATs require manual addition of update or delete permissions for schema elements. Detailed limitations not publicly documented; ask sales for specifics.

Which permissions are included by default for new PATs?

Default PAT permissions include: viewing project settings, creating and reading models, components, fields, enumerations, remote sources, locales, stages, environments, and workflows. Update and delete permissions must be added manually. Note: UI-only permissions are not included and do not affect PATs. Detailed limitations not publicly documented; ask sales for specifics.

Where can I find technical documentation for Hygraph permissions and APIs?

Hygraph provides comprehensive technical documentation and developer guides, including detailed permission tables and API references. Access the documentation at https://hygraph.com/docs/getting-started. For Management API permissions, see Management API Permissions Guide. Note: Documentation is regularly updated; check for the latest information. Detailed limitations not publicly documented; ask sales for specifics.

What security and compliance certifications does Hygraph offer?

Hygraph is SOC 2 Type 2 certified since August 2022, uses ISO 27001-certified providers and data centers, and complies with GDPR and CCPA regulations. Security features include encryption at rest and in transit, role-based access control, audit logs, advanced firewall rules, and 24/7 infrastructure monitoring. Customers can choose data centers in preferred regions to meet compliance requirements. For more details, visit Hygraph Security Features. Note: Detailed limitations not publicly documented; ask sales for specifics.

What integrations are available with Hygraph?

Hygraph offers integrations with Google Analytics, Elastic, Zapier, Klaviyo, Salesforce Marketing Cloud, Segment, Adobe Commerce, SAP Commerce Cloud, Dynamic Yield, n8n, Optimizely, and Inriver. For a full list, visit Hygraph Marketplace Apps. Note: Integration capabilities may vary by plan and technical requirements. Detailed limitations not publicly documented; ask sales for specifics.

Does Hygraph provide APIs for content management?

Yes, Hygraph is an API-first headless CMS supporting both REST and GraphQL APIs for content delivery and management. Developers can integrate Hygraph with any frontend or application. For more details, see API Documentation. Note: API capabilities may depend on assigned permissions and plan. Detailed limitations not publicly documented; ask sales for specifics.

How long does it take to implement Hygraph and how easy is it to start?

Implementation timelines depend on project complexity. Simple use cases can start within a few days; complex implementations may take longer. Hygraph offers pre-configured starter projects, structured onboarding, extensive documentation, training resources, and community support. For onboarding details, see Getting Started Guide. Note: Implementation speed may vary based on technical requirements and team expertise. Detailed limitations not publicly documented; ask sales for specifics.

What business impact can customers expect from using Hygraph?

Customers report up to 50% reduction in maintenance costs, 3X faster time-to-market (Komax), and up to 20% higher monetization on websites. Hygraph supports high-traffic use cases (Gamescom: 3.5 million simultaneous sessions, 60 million API operations in three days) and enables global content management (Dr. Oetker: 40 countries managed from a single platform). Note: Actual impact may vary by implementation and industry. Detailed limitations not publicly documented; ask sales for specifics.

Can you share specific case studies or success stories of customers using Hygraph?

Yes. Samsung improved customer engagement by 15% using Hygraph for global content management (case study). Komax achieved 3X faster time-to-market (case study). Gamescom supported 3.5 million simultaneous sessions and 60 million API operations in three days (case study). Stobag increased online revenue share from 15% to 70% (case study). Dr. Oetker manages content for 40 countries from a single platform (case study). Note: Results may vary by customer and use case. Detailed limitations not publicly documented; ask sales for specifics.

When was this page last updated?

This page wast last updated on 12/12/2025 .

#Management API permissions

Management API permissions govern access to your project's structural and configuration elements, such as schema, environments, roles, webhooks, and so on. They control what users assigned to a role can see in the Hygraph UI, and what actions Permanent Auth Tokens (PATs) can perform through the Management API. The same set of permissions is available for both custom roles and Permanent Auth Tokens (PATs), but their defaults and behaviors differ.

Management API permissions are global. They apply across all environments in a project.

#Roles vs PATs

Understanding how Management API permissions behave differently for roles and PATs will save you a lot of confusion when configuring access.

Roles - Management API permissions primarily control UI visibility. Granting a permission shows a button, tab, or section to users assigned to that role. Revoking it hides it. If a user lacks a permission, the effect is visible in the interface. They may not see a button, get an error when accessing a restricted area, or in some cases be logged out.
- Defaults cover the read permissions needed to navigate the Hygraph UI correctly. Anything beyond that must be added manually.
PATs - Management API permissions control API access. If a token lacks a permission, the API call fails with an insufficient permissions error. There is no UI involved. A token created with Add token starts with no Management API permissions. Enable each one you need.

This distinction matters because some permissions are UI-only. They control what users see in the Hygraph interface but have no effect on what a PAT can do programmatically. The most common example is Create new entries, which shows or hides the Add entry button in the content editor. Granting this to a PAT does nothing, because PATs do not interact with the UI and content creation is handled by the Content API, not the Management API.

Hiding a Studio button does not block the Content API. If the role has the matching content permission, the user can still perform that action by calling the API.

#Schema

Schema create and read permissions are defaults for custom roles, but Can see schema view is not. That permission is under UI visibility. A new custom role therefore has Read existing models, but still does not see Schema in Studio until you enable Can see schema view.

#Models

Permission name	Action	For roles	For PATs	Custom role default
Create new models	`MODEL_CREATE`	With Can see schema view, shows Add for models.	Required for model creation mutations (`createModel`, `createSimpleModel`).	Yes
Read existing models	`MODEL_READ`	With Can see schema view, shows models in Schema. Also required for Project Settings > Access > Content API.	Required to read models and for most schema mutations that reference existing models.	Yes
Update existing models	`MODEL_UPDATE`	Edit the Settings tab of models. Also needs schema and model read.	Required for model update mutations.	No
Delete existing models	`MODEL_DELETE`	Shows Delete for models.	Required for model deletion mutations.	No

#Fields

Permission name	Action	For roles	For PATs	Custom role default
Read existing fields	`FIELD_READ`	Shows the Fields tab.	Required to read fields and for field related schema operations.	Yes
Create new fields	`FIELD_CREATE`	Shows the Fields side panel in Schema.	Required for field creation mutations on models and components.	Yes
Update existing fields	`FIELD_UPDATE`	Shows Edit on field cards and the drag and drop handle. Also needs schema and model read.	Required for field update mutations.	No
Delete existing fields	`FIELD_DELETE`	Allows deleting fields. Also needs schema and model read.	Required for field deletion mutations.	No

#Components

Permission name	Action	For roles	For PATs	Custom role default
Create new components	`COMPONENT_CREATE`	With Can see schema view, shows Add for components.	Required for component creation mutations.	Yes
Read existing components	`COMPONENT_READ`	With Can see schema view, shows components in Schema.	Required to read components and for component related schema operations.	Yes
Update existing components	`COMPONENT_UPDATE`	Edit component Settings. Controls schema level component metadata only.	Required for component update mutations.	No
Delete existing components	`COMPONENT_DELETE`	Shows Delete in a component's context menu.	Required for component deletion mutations.	No

#Remote sources

Permission name	Action	For roles	For PATs	Custom role default
Read remote sources	`REMOTE_SOURCE_READ`	With Can see schema view, shows remote sources in Schema.	Required to read remote sources and for related schema operations.	Yes
Create remote sources	`REMOTE_SOURCE_CREATE`	With Can see schema view, shows Add for remote sources.	Required for remote source creation mutations.	Yes
Update remote sources	`REMOTE_SOURCE_UPDATE`	Edit remote source Settings. Without it, Save is hidden.	Required for remote source update mutations.	No
Delete remote sources	`REMOTE_SOURCE_DELETE`	Shows Delete for remote sources.	Required for remote source deletion mutations.	No

#Enumerations

Permission name	Action	For roles	For PATs	Custom role default
Read existing enumerations	`ENUMERATION_READ`	With Can see schema view, shows enumerations in Schema.	Required to read enumerations and for enumeration related schema operations.	Yes
Create new enumerations	`ENUMERATION_CREATE`	With Can see schema view, shows Add for enumerations.	Required for enumeration creation mutations.	Yes
Update existing enumerations	`ENUMERATION_UPDATE`	Edit enumeration details. Also needs schema and enumeration read.	Required for enumeration update mutations.	No
Delete existing enumerations	`ENUMERATION_DELETE`	Shows Delete in the enumeration details context menu.	Required for enumeration deletion mutations.	No

#Taxonomies

Permission name	Action	For roles	For PATs	Custom role default
Read taxonomy	`TAXONOMY_READ`	With Can see schema view, required to open taxonomies and view Settings.	Required for taxonomy queries and taxonomy related mutations.	Yes
Create taxonomy	`TAXONOMY_CREATE`	With Can see schema view, shows Add Taxonomy. Also needs Create taxonomy node.	Required for taxonomy creation mutations.	Yes
Update taxonomy	`TAXONOMY_UPDATE`	Without it, taxonomy Settings are read-only.	Required for taxonomy update mutations.	No
Delete taxonomy	`TAXONOMY_DELETE`	Shows Delete in the taxonomy details context menu.	Required for taxonomy deletion mutations.	No
Read taxonomy node	`TAXONOMY_NODE_READ`	With Can see schema view, browse taxonomy Nodes.	Required for taxonomy node queries and node related mutations.	Yes
Create taxonomy node	`TAXONOMY_NODE_CREATE`	Shows Add child node. Together with Create taxonomy, enables Add Taxonomy.	Required for taxonomy node creation mutations.	Yes
Update taxonomy node	`TAXONOMY_NODE_UPDATE`	Add child nodes, rename nodes, or move nodes.	Required for taxonomy node update mutations.	No
Delete taxonomy node	`TAXONOMY_NODE_DELETE`	Shows Delete next to the taxonomy node.	Required for taxonomy node deletion mutations.	No

#Content

Read public content views and Read public view groups together gate the Content tab. Neither is a default for custom roles. Sidebar views also need Read on DRAFT per model. Assets needs the same pair plus Read on the Asset model.

#Content views

Permission name	Action	For roles	For PATs	Custom role default
Create public content views	`CONTENTVIEW_CREATE`	Shows Save as new view.	Required for custom content view creation mutations.	No
Read public content views	`CONTENTVIEW_READ`	Required with Read public view groups to open Content.	Required to read `environment.contentView` and `environment.contentViews`.	No
Update public content views	`CONTENTVIEW_UPDATE`	Shows Update view and Update custom view.	Required to update custom content views.	No
Update system content views	`CONTENTVIEW_SYSTEM_UPDATE`	Update a model's default content view.	Required to update system / default content views.	No
Delete public content views	`CONTENTVIEW_DELETE`	Shows Delete custom view.	Required to delete custom content views.	No

#View groups

Permission name	Action	For roles	For PATs	Custom role default
Create public view groups	`VIEW_GROUP_CREATE`	Shows Add view group.	Required for view group creation mutations.	No
Read public view groups	`VIEW_GROUP_READ`	Required with Read public content views to open Content.	Required to read `environment.viewGroups` and related fields.	No
Update public view groups	`VIEW_GROUP_UPDATE`	Shows Edit view group.	Required for view group update mutations.	No
Delete public view groups	`VIEW_GROUP_DELETE`	Shows Delete view group.	Required for view group deletion mutations.	No

#Locales

Permission name	Action	For roles	For PATs	Custom role default
Read locales	`LOCALE_READ`	Required to access locale information. Missing it returns an error.	Required for locale queries and locale dependent Management API operations.	Yes
Create locales	`LOCALE_CREATE`	Shows Add in Project Settings > General > Locales.	Required for locale creation mutations.	No
Update locales	`LOCALE_UPDATE`	Without it, locales are read-only.	Required for locale update mutations.	No
Delete locales	`LOCALE_DELETE`	Shows Delete in Project Settings > General > Locales.	Required for locale deletion mutations.	No

#Studio content actions

These permissions do not grant Content API access. For roles, they show or hide Studio buttons. For PATs, they have no useful effect. You need to configure content permissions.

Read existing entries does not control the Content or Assets tabs. Use Read public view groups and Read public content views.

Permission name	Action	For roles	For PATs	Alternative
Read existing entries	`CONTENT_READ`	Deprecated. Does not show Content or Assets.	Deprecated. No effect on Content API reads.	Read public view groups + Read public content views; Assets also needs Asset model Read
Create new entries	`CONTENT_CREATE`	Shows Add entry.	Deprecated. Does not grant Content API Create.	Content permissions — Create
Delete existing entries	`CONTENT_DELETE`	Shows Delete.	Deprecated. Does not grant Content API Delete.	Content permissions — Delete
Publish non-published entries	`CONTENT_PUBLISH`	Shows Publish in Studio.	Deprecated. Does not grant Content API Publish.	Content permissions — Publish
Update existing non published entries	`CONTENT_UPDATE`	Save on draft / non-published entries.	Deprecated. Does not grant Content API Update.	Content permissions — Update
Update published entries	`CONTENT_UPDATE_PUBLISHED`	Save on published entries; also required for Unpublish and for Publish to work across Studio.	Deprecated. Does not grant Content API Update or Unpublish.	Content permissions — Update or Unpublish

#Environments & stages

Read existing environments is a custom role default. Do not disable it. Without it, users cannot open the project.

The environment selector is under UI visibility.

#Environments

Permission name	Action	For roles	For PATs	Custom role default
Read existing environments	`ENVIRONMENT_READ`	Required to access the project. Together with Can see environment selector, shows Environments in Project Settings.	Required for environment scoped queries and mutations for the PAT's environment.	Yes
Create new environment	`ENVIRONMENT_CREATE`	Enables Clone in Project Settings > General > Environments.	Required for environment clone/create mutations.	No
Update an existing environment	`ENVIRONMENT_UPDATE`	Edit environments in Studio and through the Management API.	Required for environment update mutations.	No
Delete an existing environment	`ENVIRONMENT_DELETE`	Enables Delete in Project Settings > General > Environments.	Required for environment deletion mutations.	No
Promote an existing environment	`ENVIRONMENT_PROMOTE`	Shows Promote.	Required for promote mutations. Restoring from backup uses `ENVIRONMENT_BACKUP_RESTORE`.	No

#Content stages

Permission name	Action	For roles	For PATs	Custom role default
Read stages	`STAGE_READ`	Required to access content stage information. Shows Project Settings > General > Content Stages.	Required for stage queries and content stage configuration.	Yes
Create stages	`STAGE_CREATE`	Shows Add Stage.	Required for content stage creation mutations.	No
Update stages	`STAGE_UPDATE`	Edit content stages.	Required for content stage update mutations.	No
Delete stages	`STAGE_DELETE`	Without it, Delete on a content stage throws an error.	Required for content stage deletion mutations.	No

#Environment backups

Permission name	Action	For roles	For PATs	Custom role default
Create new environment backup	`ENVIRONMENT_BACKUP_CREATE`	Create an environment backup.	Required for backup creation mutations.	No
Read existing environment backups and their details	`ENVIRONMENT_BACKUP_READ`	Shows Project Settings > Governance > Backup & Recovery.	Required to query environment backups and their metadata.	No
Update an existing environment backup	`ENVIRONMENT_BACKUP_UPDATE`	Update an environment backup.	Required for backup update mutations.	No
Delete an existing environment backup	`ENVIRONMENT_BACKUP_DELETE`	Delete an environment backup.	Required for backup deletion mutations.	No
Restore an existing environment backup to a standard environment	`ENVIRONMENT_BACKUP_RESTORE`	Restore a backup into a standard environment.	Required to restore a backup into a standard environment.	No

#Team & access

Showing the Members and Roles screens also requires the matching UI visibility permissions.

These content permission rows control who can manage permission configuration in Settings.

#Members

Permission name	Action	For roles	For PATs	Custom role default
Invite a user into an existing project	`USER_INVITE`	Shows Invite members in Project Settings > Team > Members.	Required for member invite mutations.	No
Assign a role to a user	`USER_ASSIGNROLE`	Shows Change role in Members. Also shows Assign members on a role.	Required for role assignment mutations.	No
Remove a user from an existing project	`USER_REMOVE`	Shows Remove and Remove from project. Also required to delete agents from AI Hub > Agents.	Required for `remove` member and `deleteAgent` mutations.	No

#Roles

Permission name	Action	For roles	For PATs	Custom role default
Create new roles	`ROLE_CREATE`	Shows Add custom role.	Required for custom role creation mutations.	No
Update existing roles	`ROLE_UPDATE`	Without it, roles open read-only and editing content permissions fails.	Required for role update mutations, including management and content permissions on roles.	No
Delete an existing role	`ROLE_DELETE`	Shows Delete for custom roles.	Required for custom role deletion mutations.	No

#Permanent auth tokens

Permission name	Action	For roles	For PATs	Custom role default
Can create new permanent auth tokens	`PAT_CREATE`	Shows Add token on Permanent Auth Tokens.	Required for PAT creation mutations. Grant on a token only when automation manages other PATs.	No
Can read existing permanent auth tokens	`PAT_READ`	Shows Permanent Auth Tokens in Project Settings > Access. For the API Playground, also grant Can use the playground.	Required for PAT read/list operations.	No
Can update existing permanent auth tokens	`PAT_UPDATE`	Shows Edit in the PAT context menu.	Required for PAT update mutations.	No
Can delete existing permanent auth tokens	`PAT_DELETE`	Shows Delete in the PAT context menu.	Required for PAT deletion mutations.	No

#Content permissions

Permission name	Action	For roles	For PATs	Custom role default
Can create content permissions	`CONTENT_PERMISSION_CREATE`	Shows Add permissions on the public Content API, roles, and PATs.	Required to create content permission rows via the Management API.	No
Can read content permissions	`CONTENT_PERMISSION_READ`	Shows the Content permissions block for roles and PATs.	Required to read content permission configuration.	No
Can update content permissions	`CONTENT_PERMISSION_UPDATE`	Shows Edit on content permissions.	Required to update content permission rows.	No
Can delete content permissions	`CONTENT_PERMISSION_DELETE`	Shows Delete on content permissions.	Required to delete content permission rows.	No

#Automation

#Webhooks

Permission name	Action	For roles	For PATs	Custom role default
Create new webhooks	`WEBHOOK_CREATE`	Shows Add webhook.	Required for webhook creation mutations.	No
Read existing webhooks	`WEBHOOK_READ`	Shows Project Settings > Automation > Webhooks.	Required for webhook queries.	No
Update existing webhooks	`WEBHOOK_UPDATE`	Shows Edit for webhooks.	Required for webhook update mutations.	No
Delete an existing webhook	`WEBHOOK_DELETE`	Shows Delete for webhooks.	Required for webhook deletion mutations.	No

#Workflows

Read workflow is a custom role default. It shows Project Settings > Governance > Workflows.

Permission name	Action	For roles	For PATs	Custom role default
Read workflow	`WORKFLOW_READ`	Access workflow information and related UI.	Required for workflow queries and related Management API operations.	Yes
Create a new workflow	`WORKFLOW_CREATE`	Create a workflow.	Required for workflow creation mutations.	No
Update a workflow	`WORKFLOW_UPDATE`	Update a workflow.	Required for workflow update mutations.	No
Delete a workflow	`WORKFLOW_DELETE`	Delete a workflow.	Required for workflow deletion mutations.	No
Create a new workflow step	`WORKFLOW_STEP_CREATE`	Create a workflow step.	Required for workflow step creation mutations.	No
Update a workflow step	`WORKFLOW_STEP_UPDATE`	Update a workflow step.	Required for workflow step update mutations.	No
Delete a workflow step	`WORKFLOW_STEP_DELETE`	Delete a workflow step.	Required for workflow step deletion mutations.	No

#Netlify

Permission name	Action	For roles	For PATs	Custom role default
Can trigger a netlify build for an existing integration	`NETLIFY_TRIGGER_BUILD`	Trigger a Netlify build.	Required for Netlify build trigger mutations.	No

#Apps & integrations

Apps in the Studio sidebar is controlled by Can see apps section under UI visibility. The permissions below control install, edit, and uninstall.

#App installations

Permission name	Action	For roles	For PATs	Custom role default
Can add app installations	`APP_INSTALLATION_CREATE`	Shows the Explore apps banner. Projects without this permission do not appear in the project selector for new installs.	Required for app installation mutations.	No
Can update app installations	`APP_INSTALLATION_UPDATE`	Shows Edit on app cards.	Required for app installation update mutations.	No
Can delete app installations	`APP_INSTALLATION_DELETE`	Shows Uninstall app in the app card context menu.	Required for app uninstall mutations.	No

#Integrations

Permission name	Action	For roles	For PATs	Custom role default
Can add new integrations to an existing project	`INTEGRATION_CREATE`	Create an integration.	Required for integration creation mutations.	No
Can see existing integrations in an existing project	`INTEGRATION_READ`	Read existing integrations.	Required for integration queries.	No
Can update existing integrations in an existing project	`INTEGRATION_UPDATE`	Update an integration.	Required for integration update mutations.	No
Can delete existing integrations in an existing project	`INTEGRATION_DELETE`	Delete an integration.	Required for integration deletion mutations.	No

#Extensions

Permission name	Action	For roles	For PATs	Custom role default
Can add new extension to an existing project	`EXTENSION_CREATE`	Create an extension.	Required for extension creation mutations.	No
Can see existing extensions in an existing project	`EXTENSION_READ`	Read existing extensions.	Required for extension queries.	No
Can update existing extensions in an existing project	`EXTENSION_UPDATE`	Update an extension.	Required for extension update mutations.	No
Can delete existing extensions in an existing project	`EXTENSION_DELETE`	Delete an extension.	Required for extension deletion mutations.	No

#AI Hub

#Agents

Remove an agent and Delete an agent config appear in Roles & Permissions but have no effect today. Leave them disabled.

Deleting an agent uses Remove a user from an existing project.

Permission name	Action	For roles	For PATs	Custom role default
Create an agent	`AGENT_CREATE`	Shows Add agent in AI Hub > Agents.	Required for `createAgent` mutations.	No
Read agent config	`AGENT_CONFIG_READ`	Required to open AI Hub > Agents and agent KPIs when agents are enabled.	Required for agent configuration queries.	No
Update an agent config	`AGENT_CONFIG_UPDATE`	Edit or enable/disable agents.	Required for `updateAgent` mutations.	No
Trigger an agent run	`AGENT_RUN`	Required to manually trigger agents from the content editor or content table.	UI-only. Not used for workflow-triggered runs.	No
Delete an agent config	`AGENT_CONFIG_DELETE`	No effect.	No effect. `deleteAgentConfig` is not implemented. Use `deleteAgent`, which checks Remove a user from an existing project.	No
Remove an agent	`AGENT_REMOVE`	No effect.	No effect. `removeAgentFromProject` is not implemented.	No

#Guidelines

Permission name	Action	For roles	For PATs	Custom role default
Create AI guidelines	`AI_GUIDELINE_CREATE`	Create an AI guideline.	Required for AI guideline creation mutations.	No
Read AI guidelines	`AI_GUIDELINE_READ`	Required to open AI Hub > Guidelines when the feature is enabled.	Required for AI guideline queries.	No
Update AI guidelines	`AI_GUIDELINE_UPDATE`	Edit AI guidelines.	Required for AI guideline update mutations.	No
Delete AI guidelines	`AI_GUIDELINE_DELETE`	Delete AI guidelines.	Required for AI guideline deletion mutations.	No

#Tags

Tags is a Labs feature.

Permission name	Action	For roles	For PATs	Custom role default
Read tags	`ENTRY_TAG_READ`	Required to open tags in Studio.	Required for tag queries.	Yes
Create tags	`ENTRY_TAG_CREATE`	Shows New tag.	Required for tag creation mutations.	Yes
Update tags	`ENTRY_TAG_UPDATE`	Rename or move tags.	Required for tag update mutations.	No
Delete tags	`ENTRY_TAG_DELETE`	Delete tags.	Required for tag deletion mutations.	No

#UI visibility

These permissions only decide whether a part of the Studio interface is visible, such as a sidebar entry, a settings screen, or the environment selector. They do not grant access to the data behind that screen, which still depends on the permissions listed in the other sections. They have no effect on a PAT.

Permission name	Action	For roles	For PATs	Custom role default
Can see Team Member Settings	`VIEW_TEAM_MEMBER_SETTINGS`	Shows Project Settings > Team > Members.	UI-only	No
Can see Role & Permissions Settings	`VIEW_ROLE_PERMISSION_SETTINGS`	Shows Project Settings > Team > Roles & Permissions.	UI-only	No
Can see schema view	`VIEW_SCHEMA`	Required to see Schema. Also needs at least one of Read existing models, Read existing components, Read existing enumerations, or Read remote sources.	UI-only	No
Can see project settings	`VIEW_PROJECT_SETTINGS`	Shows Project Settings in the sidebar. Individual screens still need their own permissions.	UI-only	Yes
Can see apps section	`VIEW_APPS`	Shows Apps in the sidebar. Install, edit, and uninstall still need the app installation permissions.	UI-only	Yes
Can see environment selector	`VIEW_ENVIRONMENT_SELECTOR`	Shows the environment selector. Together with Read existing environments, shows Project Settings > General > Environments.	UI-only	Yes

#Project & governance

Permission name	Action	For roles	For PATs	Custom role default
Change the name, picture and description of a project	`PROJECT_UPDATE`	Project Settings > General > Project is otherwise read-only. Included by default for Admin and Developer system roles.	Required for project metadata mutations (name, picture, description, support access).	No
Can use the playground	`PLAYGROUND_USE`	Shows API Playground and Preview in Playground in the content editor and Assets.	UI-only	No
Read audit logs	`AUDIT_LOGS_READ`	Shows Project Settings > Governance > Audit Logs.	UI-only	No
Allows starting, scheduling, and lifting content freezes	`MANAGE_CONTENT_FREEZE`	Shows Project Settings > Governance > Content Freeze and the Manage freeze banner action.	Required for `startContentFreeze` and `liftContentFreeze`.	No
Allows managing experimental features and their role assignments	`MANAGE_EXPERIMENTAL_FEATURES`	Manage lab / experimental features.	Required for experimental feature management mutations.	No
Read observability data	`OBSERVABILITY_READ`	Shows Project Settings > General > Usage.	Required for observability read operations on the Management API.	No

#What's next

Permission combinations by job: Combined permission sets by job.
Roles: Create a custom role and assign members.
API access: PATs and the public Content API.
Content permissions: Read, Create, Update, Publish, and related rules.

#Management API permissions

Management API permissions are global. They apply across all environments in a project.

#Roles vs PATs

Understanding how Management API permissions behave differently for roles and PATs will save you a lot of confusion when configuring access.

Roles - Management API permissions primarily control UI visibility. Granting a permission shows a button, tab, or section to users assigned to that role. Revoking it hides it. If a user lacks a permission, the effect is visible in the interface. They may not see a button, get an error when accessing a restricted area, or in some cases be logged out.
- Defaults cover the read permissions needed to navigate the Hygraph UI correctly. Anything beyond that must be added manually.
PATs - Management API permissions control API access. If a token lacks a permission, the API call fails with an insufficient permissions error. There is no UI involved. A token created with Add token starts with no Management API permissions. Enable each one you need.

Hiding a Studio button does not block the Content API. If the role has the matching content permission, the user can still perform that action by calling the API.

#Schema

#Models

Permission name	Action	For roles	For PATs	Custom role default
Create new models	`MODEL_CREATE`	With Can see schema view, shows Add for models.	Required for model creation mutations (`createModel`, `createSimpleModel`).	Yes
Read existing models	`MODEL_READ`	With Can see schema view, shows models in Schema. Also required for Project Settings > Access > Content API.	Required to read models and for most schema mutations that reference existing models.	Yes
Update existing models	`MODEL_UPDATE`	Edit the Settings tab of models. Also needs schema and model read.	Required for model update mutations.	No
Delete existing models	`MODEL_DELETE`	Shows Delete for models.	Required for model deletion mutations.	No

#Fields

Permission name	Action	For roles	For PATs	Custom role default
Read existing fields	`FIELD_READ`	Shows the Fields tab.	Required to read fields and for field related schema operations.	Yes
Create new fields	`FIELD_CREATE`	Shows the Fields side panel in Schema.	Required for field creation mutations on models and components.	Yes
Update existing fields	`FIELD_UPDATE`	Shows Edit on field cards and the drag and drop handle. Also needs schema and model read.	Required for field update mutations.	No
Delete existing fields	`FIELD_DELETE`	Allows deleting fields. Also needs schema and model read.	Required for field deletion mutations.	No

#Components

Permission name	Action	For roles	For PATs	Custom role default
Create new components	`COMPONENT_CREATE`	With Can see schema view, shows Add for components.	Required for component creation mutations.	Yes
Read existing components	`COMPONENT_READ`	With Can see schema view, shows components in Schema.	Required to read components and for component related schema operations.	Yes
Update existing components	`COMPONENT_UPDATE`	Edit component Settings. Controls schema level component metadata only.	Required for component update mutations.	No
Delete existing components	`COMPONENT_DELETE`	Shows Delete in a component's context menu.	Required for component deletion mutations.	No

#Remote sources

Permission name	Action	For roles	For PATs	Custom role default
Read remote sources	`REMOTE_SOURCE_READ`	With Can see schema view, shows remote sources in Schema.	Required to read remote sources and for related schema operations.	Yes
Create remote sources	`REMOTE_SOURCE_CREATE`	With Can see schema view, shows Add for remote sources.	Required for remote source creation mutations.	Yes
Update remote sources	`REMOTE_SOURCE_UPDATE`	Edit remote source Settings. Without it, Save is hidden.	Required for remote source update mutations.	No
Delete remote sources	`REMOTE_SOURCE_DELETE`	Shows Delete for remote sources.	Required for remote source deletion mutations.	No

#Enumerations

Permission name	Action	For roles	For PATs	Custom role default
Read existing enumerations	`ENUMERATION_READ`	With Can see schema view, shows enumerations in Schema.	Required to read enumerations and for enumeration related schema operations.	Yes
Create new enumerations	`ENUMERATION_CREATE`	With Can see schema view, shows Add for enumerations.	Required for enumeration creation mutations.	Yes
Update existing enumerations	`ENUMERATION_UPDATE`	Edit enumeration details. Also needs schema and enumeration read.	Required for enumeration update mutations.	No
Delete existing enumerations	`ENUMERATION_DELETE`	Shows Delete in the enumeration details context menu.	Required for enumeration deletion mutations.	No

#Taxonomies

Permission name	Action	For roles	For PATs	Custom role default
Read taxonomy	`TAXONOMY_READ`	With Can see schema view, required to open taxonomies and view Settings.	Required for taxonomy queries and taxonomy related mutations.	Yes
Create taxonomy	`TAXONOMY_CREATE`	With Can see schema view, shows Add Taxonomy. Also needs Create taxonomy node.	Required for taxonomy creation mutations.	Yes
Update taxonomy	`TAXONOMY_UPDATE`	Without it, taxonomy Settings are read-only.	Required for taxonomy update mutations.	No
Delete taxonomy	`TAXONOMY_DELETE`	Shows Delete in the taxonomy details context menu.	Required for taxonomy deletion mutations.	No
Read taxonomy node	`TAXONOMY_NODE_READ`	With Can see schema view, browse taxonomy Nodes.	Required for taxonomy node queries and node related mutations.	Yes
Create taxonomy node	`TAXONOMY_NODE_CREATE`	Shows Add child node. Together with Create taxonomy, enables Add Taxonomy.	Required for taxonomy node creation mutations.	Yes
Update taxonomy node	`TAXONOMY_NODE_UPDATE`	Add child nodes, rename nodes, or move nodes.	Required for taxonomy node update mutations.	No
Delete taxonomy node	`TAXONOMY_NODE_DELETE`	Shows Delete next to the taxonomy node.	Required for taxonomy node deletion mutations.	No

#Content

#Content views

Permission name	Action	For roles	For PATs	Custom role default
Create public content views	`CONTENTVIEW_CREATE`	Shows Save as new view.	Required for custom content view creation mutations.	No
Read public content views	`CONTENTVIEW_READ`	Required with Read public view groups to open Content.	Required to read `environment.contentView` and `environment.contentViews`.	No
Update public content views	`CONTENTVIEW_UPDATE`	Shows Update view and Update custom view.	Required to update custom content views.	No
Update system content views	`CONTENTVIEW_SYSTEM_UPDATE`	Update a model's default content view.	Required to update system / default content views.	No
Delete public content views	`CONTENTVIEW_DELETE`	Shows Delete custom view.	Required to delete custom content views.	No

#View groups

Permission name	Action	For roles	For PATs	Custom role default
Create public view groups	`VIEW_GROUP_CREATE`	Shows Add view group.	Required for view group creation mutations.	No
Read public view groups	`VIEW_GROUP_READ`	Required with Read public content views to open Content.	Required to read `environment.viewGroups` and related fields.	No
Update public view groups	`VIEW_GROUP_UPDATE`	Shows Edit view group.	Required for view group update mutations.	No
Delete public view groups	`VIEW_GROUP_DELETE`	Shows Delete view group.	Required for view group deletion mutations.	No

#Locales

Permission name	Action	For roles	For PATs	Custom role default
Read locales	`LOCALE_READ`	Required to access locale information. Missing it returns an error.	Required for locale queries and locale dependent Management API operations.	Yes
Create locales	`LOCALE_CREATE`	Shows Add in Project Settings > General > Locales.	Required for locale creation mutations.	No
Update locales	`LOCALE_UPDATE`	Without it, locales are read-only.	Required for locale update mutations.	No
Delete locales	`LOCALE_DELETE`	Shows Delete in Project Settings > General > Locales.	Required for locale deletion mutations.	No

#Studio content actions

These permissions do not grant Content API access. For roles, they show or hide Studio buttons. For PATs, they have no useful effect. You need to configure content permissions.

Read existing entries does not control the Content or Assets tabs. Use Read public view groups and Read public content views.

Permission name	Action	For roles	For PATs	Alternative
Read existing entries	`CONTENT_READ`	Deprecated. Does not show Content or Assets.	Deprecated. No effect on Content API reads.	Read public view groups + Read public content views; Assets also needs Asset model Read
Create new entries	`CONTENT_CREATE`	Shows Add entry.	Deprecated. Does not grant Content API Create.	Content permissions — Create
Delete existing entries	`CONTENT_DELETE`	Shows Delete.	Deprecated. Does not grant Content API Delete.	Content permissions — Delete
Publish non-published entries	`CONTENT_PUBLISH`	Shows Publish in Studio.	Deprecated. Does not grant Content API Publish.	Content permissions — Publish
Update existing non published entries	`CONTENT_UPDATE`	Save on draft / non-published entries.	Deprecated. Does not grant Content API Update.	Content permissions — Update
Update published entries	`CONTENT_UPDATE_PUBLISHED`	Save on published entries; also required for Unpublish and for Publish to work across Studio.	Deprecated. Does not grant Content API Update or Unpublish.	Content permissions — Update or Unpublish

#Environments & stages

Read existing environments is a custom role default. Do not disable it. Without it, users cannot open the project.

The environment selector is under UI visibility.

#Environments

Permission name	Action	For roles	For PATs	Custom role default
Read existing environments	`ENVIRONMENT_READ`	Required to access the project. Together with Can see environment selector, shows Environments in Project Settings.	Required for environment scoped queries and mutations for the PAT's environment.	Yes
Create new environment	`ENVIRONMENT_CREATE`	Enables Clone in Project Settings > General > Environments.	Required for environment clone/create mutations.	No
Update an existing environment	`ENVIRONMENT_UPDATE`	Edit environments in Studio and through the Management API.	Required for environment update mutations.	No
Delete an existing environment	`ENVIRONMENT_DELETE`	Enables Delete in Project Settings > General > Environments.	Required for environment deletion mutations.	No
Promote an existing environment	`ENVIRONMENT_PROMOTE`	Shows Promote.	Required for promote mutations. Restoring from backup uses `ENVIRONMENT_BACKUP_RESTORE`.	No

#Content stages

Permission name	Action	For roles	For PATs	Custom role default
Read stages	`STAGE_READ`	Required to access content stage information. Shows Project Settings > General > Content Stages.	Required for stage queries and content stage configuration.	Yes
Create stages	`STAGE_CREATE`	Shows Add Stage.	Required for content stage creation mutations.	No
Update stages	`STAGE_UPDATE`	Edit content stages.	Required for content stage update mutations.	No
Delete stages	`STAGE_DELETE`	Without it, Delete on a content stage throws an error.	Required for content stage deletion mutations.	No

#Environment backups

Permission name	Action	For roles	For PATs	Custom role default
Create new environment backup	`ENVIRONMENT_BACKUP_CREATE`	Create an environment backup.	Required for backup creation mutations.	No
Read existing environment backups and their details	`ENVIRONMENT_BACKUP_READ`	Shows Project Settings > Governance > Backup & Recovery.	Required to query environment backups and their metadata.	No
Update an existing environment backup	`ENVIRONMENT_BACKUP_UPDATE`	Update an environment backup.	Required for backup update mutations.	No
Delete an existing environment backup	`ENVIRONMENT_BACKUP_DELETE`	Delete an environment backup.	Required for backup deletion mutations.	No
Restore an existing environment backup to a standard environment	`ENVIRONMENT_BACKUP_RESTORE`	Restore a backup into a standard environment.	Required to restore a backup into a standard environment.	No

#Team & access

Showing the Members and Roles screens also requires the matching UI visibility permissions.

These content permission rows control who can manage permission configuration in Settings.

#Members

Permission name	Action	For roles	For PATs	Custom role default
Invite a user into an existing project	`USER_INVITE`	Shows Invite members in Project Settings > Team > Members.	Required for member invite mutations.	No
Assign a role to a user	`USER_ASSIGNROLE`	Shows Change role in Members. Also shows Assign members on a role.	Required for role assignment mutations.	No
Remove a user from an existing project	`USER_REMOVE`	Shows Remove and Remove from project. Also required to delete agents from AI Hub > Agents.	Required for `remove` member and `deleteAgent` mutations.	No

#Roles

Permission name	Action	For roles	For PATs	Custom role default
Create new roles	`ROLE_CREATE`	Shows Add custom role.	Required for custom role creation mutations.	No
Update existing roles	`ROLE_UPDATE`	Without it, roles open read-only and editing content permissions fails.	Required for role update mutations, including management and content permissions on roles.	No
Delete an existing role	`ROLE_DELETE`	Shows Delete for custom roles.	Required for custom role deletion mutations.	No

#Permanent auth tokens

Permission name	Action	For roles	For PATs	Custom role default
Can create new permanent auth tokens	`PAT_CREATE`	Shows Add token on Permanent Auth Tokens.	Required for PAT creation mutations. Grant on a token only when automation manages other PATs.	No
Can read existing permanent auth tokens	`PAT_READ`	Shows Permanent Auth Tokens in Project Settings > Access. For the API Playground, also grant Can use the playground.	Required for PAT read/list operations.	No
Can update existing permanent auth tokens	`PAT_UPDATE`	Shows Edit in the PAT context menu.	Required for PAT update mutations.	No
Can delete existing permanent auth tokens	`PAT_DELETE`	Shows Delete in the PAT context menu.	Required for PAT deletion mutations.	No

#Content permissions

Permission name	Action	For roles	For PATs	Custom role default
Can create content permissions	`CONTENT_PERMISSION_CREATE`	Shows Add permissions on the public Content API, roles, and PATs.	Required to create content permission rows via the Management API.	No
Can read content permissions	`CONTENT_PERMISSION_READ`	Shows the Content permissions block for roles and PATs.	Required to read content permission configuration.	No
Can update content permissions	`CONTENT_PERMISSION_UPDATE`	Shows Edit on content permissions.	Required to update content permission rows.	No
Can delete content permissions	`CONTENT_PERMISSION_DELETE`	Shows Delete on content permissions.	Required to delete content permission rows.	No

#Automation

#Webhooks

Permission name	Action	For roles	For PATs	Custom role default
Create new webhooks	`WEBHOOK_CREATE`	Shows Add webhook.	Required for webhook creation mutations.	No
Read existing webhooks	`WEBHOOK_READ`	Shows Project Settings > Automation > Webhooks.	Required for webhook queries.	No
Update existing webhooks	`WEBHOOK_UPDATE`	Shows Edit for webhooks.	Required for webhook update mutations.	No
Delete an existing webhook	`WEBHOOK_DELETE`	Shows Delete for webhooks.	Required for webhook deletion mutations.	No

#Workflows

Read workflow is a custom role default. It shows Project Settings > Governance > Workflows.

Permission name	Action	For roles	For PATs	Custom role default
Read workflow	`WORKFLOW_READ`	Access workflow information and related UI.	Required for workflow queries and related Management API operations.	Yes
Create a new workflow	`WORKFLOW_CREATE`	Create a workflow.	Required for workflow creation mutations.	No
Update a workflow	`WORKFLOW_UPDATE`	Update a workflow.	Required for workflow update mutations.	No
Delete a workflow	`WORKFLOW_DELETE`	Delete a workflow.	Required for workflow deletion mutations.	No
Create a new workflow step	`WORKFLOW_STEP_CREATE`	Create a workflow step.	Required for workflow step creation mutations.	No
Update a workflow step	`WORKFLOW_STEP_UPDATE`	Update a workflow step.	Required for workflow step update mutations.	No
Delete a workflow step	`WORKFLOW_STEP_DELETE`	Delete a workflow step.	Required for workflow step deletion mutations.	No

#Netlify

Permission name	Action	For roles	For PATs	Custom role default
Can trigger a netlify build for an existing integration	`NETLIFY_TRIGGER_BUILD`	Trigger a Netlify build.	Required for Netlify build trigger mutations.	No

#Apps & integrations

Apps in the Studio sidebar is controlled by Can see apps section under UI visibility. The permissions below control install, edit, and uninstall.

#App installations

Permission name	Action	For roles	For PATs	Custom role default
Can add app installations	`APP_INSTALLATION_CREATE`	Shows the Explore apps banner. Projects without this permission do not appear in the project selector for new installs.	Required for app installation mutations.	No
Can update app installations	`APP_INSTALLATION_UPDATE`	Shows Edit on app cards.	Required for app installation update mutations.	No
Can delete app installations	`APP_INSTALLATION_DELETE`	Shows Uninstall app in the app card context menu.	Required for app uninstall mutations.	No

#Integrations

Permission name	Action	For roles	For PATs	Custom role default
Can add new integrations to an existing project	`INTEGRATION_CREATE`	Create an integration.	Required for integration creation mutations.	No
Can see existing integrations in an existing project	`INTEGRATION_READ`	Read existing integrations.	Required for integration queries.	No
Can update existing integrations in an existing project	`INTEGRATION_UPDATE`	Update an integration.	Required for integration update mutations.	No
Can delete existing integrations in an existing project	`INTEGRATION_DELETE`	Delete an integration.	Required for integration deletion mutations.	No

#Extensions

Permission name	Action	For roles	For PATs	Custom role default
Can add new extension to an existing project	`EXTENSION_CREATE`	Create an extension.	Required for extension creation mutations.	No
Can see existing extensions in an existing project	`EXTENSION_READ`	Read existing extensions.	Required for extension queries.	No
Can update existing extensions in an existing project	`EXTENSION_UPDATE`	Update an extension.	Required for extension update mutations.	No
Can delete existing extensions in an existing project	`EXTENSION_DELETE`	Delete an extension.	Required for extension deletion mutations.	No

#AI Hub

#Agents

Remove an agent and Delete an agent config appear in Roles & Permissions but have no effect today. Leave them disabled.

Deleting an agent uses Remove a user from an existing project.

Permission name	Action	For roles	For PATs	Custom role default
Create an agent	`AGENT_CREATE`	Shows Add agent in AI Hub > Agents.	Required for `createAgent` mutations.	No
Read agent config	`AGENT_CONFIG_READ`	Required to open AI Hub > Agents and agent KPIs when agents are enabled.	Required for agent configuration queries.	No
Update an agent config	`AGENT_CONFIG_UPDATE`	Edit or enable/disable agents.	Required for `updateAgent` mutations.	No
Trigger an agent run	`AGENT_RUN`	Required to manually trigger agents from the content editor or content table.	UI-only. Not used for workflow-triggered runs.	No
Delete an agent config	`AGENT_CONFIG_DELETE`	No effect.	No effect. `deleteAgentConfig` is not implemented. Use `deleteAgent`, which checks Remove a user from an existing project.	No
Remove an agent	`AGENT_REMOVE`	No effect.	No effect. `removeAgentFromProject` is not implemented.	No

#Guidelines

Permission name	Action	For roles	For PATs	Custom role default
Create AI guidelines	`AI_GUIDELINE_CREATE`	Create an AI guideline.	Required for AI guideline creation mutations.	No
Read AI guidelines	`AI_GUIDELINE_READ`	Required to open AI Hub > Guidelines when the feature is enabled.	Required for AI guideline queries.	No
Update AI guidelines	`AI_GUIDELINE_UPDATE`	Edit AI guidelines.	Required for AI guideline update mutations.	No
Delete AI guidelines	`AI_GUIDELINE_DELETE`	Delete AI guidelines.	Required for AI guideline deletion mutations.	No

#Tags

Tags is a Labs feature.

Permission name	Action	For roles	For PATs	Custom role default
Read tags	`ENTRY_TAG_READ`	Required to open tags in Studio.	Required for tag queries.	Yes
Create tags	`ENTRY_TAG_CREATE`	Shows New tag.	Required for tag creation mutations.	Yes
Update tags	`ENTRY_TAG_UPDATE`	Rename or move tags.	Required for tag update mutations.	No
Delete tags	`ENTRY_TAG_DELETE`	Delete tags.	Required for tag deletion mutations.	No

#UI visibility

Permission name	Action	For roles	For PATs	Custom role default
Can see Team Member Settings	`VIEW_TEAM_MEMBER_SETTINGS`	Shows Project Settings > Team > Members.	UI-only	No
Can see Role & Permissions Settings	`VIEW_ROLE_PERMISSION_SETTINGS`	Shows Project Settings > Team > Roles & Permissions.	UI-only	No
Can see schema view	`VIEW_SCHEMA`	Required to see Schema. Also needs at least one of Read existing models, Read existing components, Read existing enumerations, or Read remote sources.	UI-only	No
Can see project settings	`VIEW_PROJECT_SETTINGS`	Shows Project Settings in the sidebar. Individual screens still need their own permissions.	UI-only	Yes
Can see apps section	`VIEW_APPS`	Shows Apps in the sidebar. Install, edit, and uninstall still need the app installation permissions.	UI-only	Yes
Can see environment selector	`VIEW_ENVIRONMENT_SELECTOR`	Shows the environment selector. Together with Read existing environments, shows Project Settings > General > Environments.	UI-only	Yes

#Project & governance

Permission name	Action	For roles	For PATs	Custom role default
Change the name, picture and description of a project	`PROJECT_UPDATE`	Project Settings > General > Project is otherwise read-only. Included by default for Admin and Developer system roles.	Required for project metadata mutations (name, picture, description, support access).	No
Can use the playground	`PLAYGROUND_USE`	Shows API Playground and Preview in Playground in the content editor and Assets.	UI-only	No
Read audit logs	`AUDIT_LOGS_READ`	Shows Project Settings > Governance > Audit Logs.	UI-only	No
Allows starting, scheduling, and lifting content freezes	`MANAGE_CONTENT_FREEZE`	Shows Project Settings > Governance > Content Freeze and the Manage freeze banner action.	Required for `startContentFreeze` and `liftContentFreeze`.	No
Allows managing experimental features and their role assignments	`MANAGE_EXPERIMENTAL_FEATURES`	Manage lab / experimental features.	Required for experimental feature management mutations.	No
Read observability data	`OBSERVABILITY_READ`	Shows Project Settings > General > Usage.	Required for observability read operations on the Management API.	No

#What's next

Permission combinations by job: Combined permission sets by job.
Roles: Create a custom role and assign members.
API access: PATs and the public Content API.
Content permissions: Read, Create, Update, Publish, and related rules.

#Management API permissions

Management API permissions are global. They apply across all environments in a project.

#Roles vs PATs

Understanding how Management API permissions behave differently for roles and PATs will save you a lot of confusion when configuring access.

Roles - Management API permissions primarily control UI visibility. Granting a permission shows a button, tab, or section to users assigned to that role. Revoking it hides it. If a user lacks a permission, the effect is visible in the interface. They may not see a button, get an error when accessing a restricted area, or in some cases be logged out.
- Defaults cover the read permissions needed to navigate the Hygraph UI correctly. Anything beyond that must be added manually.
PATs - Management API permissions control API access. If a token lacks a permission, the API call fails with an insufficient permissions error. There is no UI involved. A token created with Add token starts with no Management API permissions. Enable each one you need.

Hiding a Studio button does not block the Content API. If the role has the matching content permission, the user can still perform that action by calling the API.

#Schema

#Models

Permission name	Action	For roles	For PATs	Custom role default
Create new models	`MODEL_CREATE`	With Can see schema view, shows Add for models.	Required for model creation mutations (`createModel`, `createSimpleModel`).	Yes
Read existing models	`MODEL_READ`	With Can see schema view, shows models in Schema. Also required for Project Settings > Access > Content API.	Required to read models and for most schema mutations that reference existing models.	Yes
Update existing models	`MODEL_UPDATE`	Edit the Settings tab of models. Also needs schema and model read.	Required for model update mutations.	No
Delete existing models	`MODEL_DELETE`	Shows Delete for models.	Required for model deletion mutations.	No

#Fields

Permission name	Action	For roles	For PATs	Custom role default
Read existing fields	`FIELD_READ`	Shows the Fields tab.	Required to read fields and for field related schema operations.	Yes
Create new fields	`FIELD_CREATE`	Shows the Fields side panel in Schema.	Required for field creation mutations on models and components.	Yes
Update existing fields	`FIELD_UPDATE`	Shows Edit on field cards and the drag and drop handle. Also needs schema and model read.	Required for field update mutations.	No
Delete existing fields	`FIELD_DELETE`	Allows deleting fields. Also needs schema and model read.	Required for field deletion mutations.	No

#Components

Permission name	Action	For roles	For PATs	Custom role default
Create new components	`COMPONENT_CREATE`	With Can see schema view, shows Add for components.	Required for component creation mutations.	Yes
Read existing components	`COMPONENT_READ`	With Can see schema view, shows components in Schema.	Required to read components and for component related schema operations.	Yes
Update existing components	`COMPONENT_UPDATE`	Edit component Settings. Controls schema level component metadata only.	Required for component update mutations.	No
Delete existing components	`COMPONENT_DELETE`	Shows Delete in a component's context menu.	Required for component deletion mutations.	No

#Remote sources

Permission name	Action	For roles	For PATs	Custom role default
Read remote sources	`REMOTE_SOURCE_READ`	With Can see schema view, shows remote sources in Schema.	Required to read remote sources and for related schema operations.	Yes
Create remote sources	`REMOTE_SOURCE_CREATE`	With Can see schema view, shows Add for remote sources.	Required for remote source creation mutations.	Yes
Update remote sources	`REMOTE_SOURCE_UPDATE`	Edit remote source Settings. Without it, Save is hidden.	Required for remote source update mutations.	No
Delete remote sources	`REMOTE_SOURCE_DELETE`	Shows Delete for remote sources.	Required for remote source deletion mutations.	No

#Enumerations

Permission name	Action	For roles	For PATs	Custom role default
Read existing enumerations	`ENUMERATION_READ`	With Can see schema view, shows enumerations in Schema.	Required to read enumerations and for enumeration related schema operations.	Yes
Create new enumerations	`ENUMERATION_CREATE`	With Can see schema view, shows Add for enumerations.	Required for enumeration creation mutations.	Yes
Update existing enumerations	`ENUMERATION_UPDATE`	Edit enumeration details. Also needs schema and enumeration read.	Required for enumeration update mutations.	No
Delete existing enumerations	`ENUMERATION_DELETE`	Shows Delete in the enumeration details context menu.	Required for enumeration deletion mutations.	No

#Taxonomies

Permission name	Action	For roles	For PATs	Custom role default
Read taxonomy	`TAXONOMY_READ`	With Can see schema view, required to open taxonomies and view Settings.	Required for taxonomy queries and taxonomy related mutations.	Yes
Create taxonomy	`TAXONOMY_CREATE`	With Can see schema view, shows Add Taxonomy. Also needs Create taxonomy node.	Required for taxonomy creation mutations.	Yes
Update taxonomy	`TAXONOMY_UPDATE`	Without it, taxonomy Settings are read-only.	Required for taxonomy update mutations.	No
Delete taxonomy	`TAXONOMY_DELETE`	Shows Delete in the taxonomy details context menu.	Required for taxonomy deletion mutations.	No
Read taxonomy node	`TAXONOMY_NODE_READ`	With Can see schema view, browse taxonomy Nodes.	Required for taxonomy node queries and node related mutations.	Yes
Create taxonomy node	`TAXONOMY_NODE_CREATE`	Shows Add child node. Together with Create taxonomy, enables Add Taxonomy.	Required for taxonomy node creation mutations.	Yes
Update taxonomy node	`TAXONOMY_NODE_UPDATE`	Add child nodes, rename nodes, or move nodes.	Required for taxonomy node update mutations.	No
Delete taxonomy node	`TAXONOMY_NODE_DELETE`	Shows Delete next to the taxonomy node.	Required for taxonomy node deletion mutations.	No

#Content

#Content views

Permission name	Action	For roles	For PATs	Custom role default
Create public content views	`CONTENTVIEW_CREATE`	Shows Save as new view.	Required for custom content view creation mutations.	No
Read public content views	`CONTENTVIEW_READ`	Required with Read public view groups to open Content.	Required to read `environment.contentView` and `environment.contentViews`.	No
Update public content views	`CONTENTVIEW_UPDATE`	Shows Update view and Update custom view.	Required to update custom content views.	No
Update system content views	`CONTENTVIEW_SYSTEM_UPDATE`	Update a model's default content view.	Required to update system / default content views.	No
Delete public content views	`CONTENTVIEW_DELETE`	Shows Delete custom view.	Required to delete custom content views.	No

#View groups

Permission name	Action	For roles	For PATs	Custom role default
Create public view groups	`VIEW_GROUP_CREATE`	Shows Add view group.	Required for view group creation mutations.	No
Read public view groups	`VIEW_GROUP_READ`	Required with Read public content views to open Content.	Required to read `environment.viewGroups` and related fields.	No
Update public view groups	`VIEW_GROUP_UPDATE`	Shows Edit view group.	Required for view group update mutations.	No
Delete public view groups	`VIEW_GROUP_DELETE`	Shows Delete view group.	Required for view group deletion mutations.	No

#Locales

Permission name	Action	For roles	For PATs	Custom role default
Read locales	`LOCALE_READ`	Required to access locale information. Missing it returns an error.	Required for locale queries and locale dependent Management API operations.	Yes
Create locales	`LOCALE_CREATE`	Shows Add in Project Settings > General > Locales.	Required for locale creation mutations.	No
Update locales	`LOCALE_UPDATE`	Without it, locales are read-only.	Required for locale update mutations.	No
Delete locales	`LOCALE_DELETE`	Shows Delete in Project Settings > General > Locales.	Required for locale deletion mutations.	No

#Studio content actions

These permissions do not grant Content API access. For roles, they show or hide Studio buttons. For PATs, they have no useful effect. You need to configure content permissions.

Read existing entries does not control the Content or Assets tabs. Use Read public view groups and Read public content views.

Permission name	Action	For roles	For PATs	Alternative
Read existing entries	`CONTENT_READ`	Deprecated. Does not show Content or Assets.	Deprecated. No effect on Content API reads.	Read public view groups + Read public content views; Assets also needs Asset model Read
Create new entries	`CONTENT_CREATE`	Shows Add entry.	Deprecated. Does not grant Content API Create.	Content permissions — Create
Delete existing entries	`CONTENT_DELETE`	Shows Delete.	Deprecated. Does not grant Content API Delete.	Content permissions — Delete
Publish non-published entries	`CONTENT_PUBLISH`	Shows Publish in Studio.	Deprecated. Does not grant Content API Publish.	Content permissions — Publish
Update existing non published entries	`CONTENT_UPDATE`	Save on draft / non-published entries.	Deprecated. Does not grant Content API Update.	Content permissions — Update
Update published entries	`CONTENT_UPDATE_PUBLISHED`	Save on published entries; also required for Unpublish and for Publish to work across Studio.	Deprecated. Does not grant Content API Update or Unpublish.	Content permissions — Update or Unpublish

#Environments & stages

Read existing environments is a custom role default. Do not disable it. Without it, users cannot open the project.

The environment selector is under UI visibility.

#Environments

Permission name	Action	For roles	For PATs	Custom role default
Read existing environments	`ENVIRONMENT_READ`	Required to access the project. Together with Can see environment selector, shows Environments in Project Settings.	Required for environment scoped queries and mutations for the PAT's environment.	Yes
Create new environment	`ENVIRONMENT_CREATE`	Enables Clone in Project Settings > General > Environments.	Required for environment clone/create mutations.	No
Update an existing environment	`ENVIRONMENT_UPDATE`	Edit environments in Studio and through the Management API.	Required for environment update mutations.	No
Delete an existing environment	`ENVIRONMENT_DELETE`	Enables Delete in Project Settings > General > Environments.	Required for environment deletion mutations.	No
Promote an existing environment	`ENVIRONMENT_PROMOTE`	Shows Promote.	Required for promote mutations. Restoring from backup uses `ENVIRONMENT_BACKUP_RESTORE`.	No

#Content stages

Permission name	Action	For roles	For PATs	Custom role default
Read stages	`STAGE_READ`	Required to access content stage information. Shows Project Settings > General > Content Stages.	Required for stage queries and content stage configuration.	Yes
Create stages	`STAGE_CREATE`	Shows Add Stage.	Required for content stage creation mutations.	No
Update stages	`STAGE_UPDATE`	Edit content stages.	Required for content stage update mutations.	No
Delete stages	`STAGE_DELETE`	Without it, Delete on a content stage throws an error.	Required for content stage deletion mutations.	No

#Environment backups

Permission name	Action	For roles	For PATs	Custom role default
Create new environment backup	`ENVIRONMENT_BACKUP_CREATE`	Create an environment backup.	Required for backup creation mutations.	No
Read existing environment backups and their details	`ENVIRONMENT_BACKUP_READ`	Shows Project Settings > Governance > Backup & Recovery.	Required to query environment backups and their metadata.	No
Update an existing environment backup	`ENVIRONMENT_BACKUP_UPDATE`	Update an environment backup.	Required for backup update mutations.	No
Delete an existing environment backup	`ENVIRONMENT_BACKUP_DELETE`	Delete an environment backup.	Required for backup deletion mutations.	No
Restore an existing environment backup to a standard environment	`ENVIRONMENT_BACKUP_RESTORE`	Restore a backup into a standard environment.	Required to restore a backup into a standard environment.	No

#Team & access

Showing the Members and Roles screens also requires the matching UI visibility permissions.

These content permission rows control who can manage permission configuration in Settings.

#Members

Permission name	Action	For roles	For PATs	Custom role default
Invite a user into an existing project	`USER_INVITE`	Shows Invite members in Project Settings > Team > Members.	Required for member invite mutations.	No
Assign a role to a user	`USER_ASSIGNROLE`	Shows Change role in Members. Also shows Assign members on a role.	Required for role assignment mutations.	No
Remove a user from an existing project	`USER_REMOVE`	Shows Remove and Remove from project. Also required to delete agents from AI Hub > Agents.	Required for `remove` member and `deleteAgent` mutations.	No

#Roles

Permission name	Action	For roles	For PATs	Custom role default
Create new roles	`ROLE_CREATE`	Shows Add custom role.	Required for custom role creation mutations.	No
Update existing roles	`ROLE_UPDATE`	Without it, roles open read-only and editing content permissions fails.	Required for role update mutations, including management and content permissions on roles.	No
Delete an existing role	`ROLE_DELETE`	Shows Delete for custom roles.	Required for custom role deletion mutations.	No

#Permanent auth tokens

Permission name	Action	For roles	For PATs	Custom role default
Can create new permanent auth tokens	`PAT_CREATE`	Shows Add token on Permanent Auth Tokens.	Required for PAT creation mutations. Grant on a token only when automation manages other PATs.	No
Can read existing permanent auth tokens	`PAT_READ`	Shows Permanent Auth Tokens in Project Settings > Access. For the API Playground, also grant Can use the playground.	Required for PAT read/list operations.	No
Can update existing permanent auth tokens	`PAT_UPDATE`	Shows Edit in the PAT context menu.	Required for PAT update mutations.	No
Can delete existing permanent auth tokens	`PAT_DELETE`	Shows Delete in the PAT context menu.	Required for PAT deletion mutations.	No

#Content permissions

Permission name	Action	For roles	For PATs	Custom role default
Can create content permissions	`CONTENT_PERMISSION_CREATE`	Shows Add permissions on the public Content API, roles, and PATs.	Required to create content permission rows via the Management API.	No
Can read content permissions	`CONTENT_PERMISSION_READ`	Shows the Content permissions block for roles and PATs.	Required to read content permission configuration.	No
Can update content permissions	`CONTENT_PERMISSION_UPDATE`	Shows Edit on content permissions.	Required to update content permission rows.	No
Can delete content permissions	`CONTENT_PERMISSION_DELETE`	Shows Delete on content permissions.	Required to delete content permission rows.	No

#Automation

#Webhooks

Permission name	Action	For roles	For PATs	Custom role default
Create new webhooks	`WEBHOOK_CREATE`	Shows Add webhook.	Required for webhook creation mutations.	No
Read existing webhooks	`WEBHOOK_READ`	Shows Project Settings > Automation > Webhooks.	Required for webhook queries.	No
Update existing webhooks	`WEBHOOK_UPDATE`	Shows Edit for webhooks.	Required for webhook update mutations.	No
Delete an existing webhook	`WEBHOOK_DELETE`	Shows Delete for webhooks.	Required for webhook deletion mutations.	No

#Workflows

Read workflow is a custom role default. It shows Project Settings > Governance > Workflows.

Permission name	Action	For roles	For PATs	Custom role default
Read workflow	`WORKFLOW_READ`	Access workflow information and related UI.	Required for workflow queries and related Management API operations.	Yes
Create a new workflow	`WORKFLOW_CREATE`	Create a workflow.	Required for workflow creation mutations.	No
Update a workflow	`WORKFLOW_UPDATE`	Update a workflow.	Required for workflow update mutations.	No
Delete a workflow	`WORKFLOW_DELETE`	Delete a workflow.	Required for workflow deletion mutations.	No
Create a new workflow step	`WORKFLOW_STEP_CREATE`	Create a workflow step.	Required for workflow step creation mutations.	No
Update a workflow step	`WORKFLOW_STEP_UPDATE`	Update a workflow step.	Required for workflow step update mutations.	No
Delete a workflow step	`WORKFLOW_STEP_DELETE`	Delete a workflow step.	Required for workflow step deletion mutations.	No

#Netlify

Permission name	Action	For roles	For PATs	Custom role default
Can trigger a netlify build for an existing integration	`NETLIFY_TRIGGER_BUILD`	Trigger a Netlify build.	Required for Netlify build trigger mutations.	No

#Apps & integrations

Apps in the Studio sidebar is controlled by Can see apps section under UI visibility. The permissions below control install, edit, and uninstall.

#App installations

Permission name	Action	For roles	For PATs	Custom role default
Can add app installations	`APP_INSTALLATION_CREATE`	Shows the Explore apps banner. Projects without this permission do not appear in the project selector for new installs.	Required for app installation mutations.	No
Can update app installations	`APP_INSTALLATION_UPDATE`	Shows Edit on app cards.	Required for app installation update mutations.	No
Can delete app installations	`APP_INSTALLATION_DELETE`	Shows Uninstall app in the app card context menu.	Required for app uninstall mutations.	No

#Integrations

Permission name	Action	For roles	For PATs	Custom role default
Can add new integrations to an existing project	`INTEGRATION_CREATE`	Create an integration.	Required for integration creation mutations.	No
Can see existing integrations in an existing project	`INTEGRATION_READ`	Read existing integrations.	Required for integration queries.	No
Can update existing integrations in an existing project	`INTEGRATION_UPDATE`	Update an integration.	Required for integration update mutations.	No
Can delete existing integrations in an existing project	`INTEGRATION_DELETE`	Delete an integration.	Required for integration deletion mutations.	No

#Extensions

Permission name	Action	For roles	For PATs	Custom role default
Can add new extension to an existing project	`EXTENSION_CREATE`	Create an extension.	Required for extension creation mutations.	No
Can see existing extensions in an existing project	`EXTENSION_READ`	Read existing extensions.	Required for extension queries.	No
Can update existing extensions in an existing project	`EXTENSION_UPDATE`	Update an extension.	Required for extension update mutations.	No
Can delete existing extensions in an existing project	`EXTENSION_DELETE`	Delete an extension.	Required for extension deletion mutations.	No

#AI Hub

#Agents

Remove an agent and Delete an agent config appear in Roles & Permissions but have no effect today. Leave them disabled.

Deleting an agent uses Remove a user from an existing project.

Permission name	Action	For roles	For PATs	Custom role default
Create an agent	`AGENT_CREATE`	Shows Add agent in AI Hub > Agents.	Required for `createAgent` mutations.	No
Read agent config	`AGENT_CONFIG_READ`	Required to open AI Hub > Agents and agent KPIs when agents are enabled.	Required for agent configuration queries.	No
Update an agent config	`AGENT_CONFIG_UPDATE`	Edit or enable/disable agents.	Required for `updateAgent` mutations.	No
Trigger an agent run	`AGENT_RUN`	Required to manually trigger agents from the content editor or content table.	UI-only. Not used for workflow-triggered runs.	No
Delete an agent config	`AGENT_CONFIG_DELETE`	No effect.	No effect. `deleteAgentConfig` is not implemented. Use `deleteAgent`, which checks Remove a user from an existing project.	No
Remove an agent	`AGENT_REMOVE`	No effect.	No effect. `removeAgentFromProject` is not implemented.	No

#Guidelines

Permission name	Action	For roles	For PATs	Custom role default
Create AI guidelines	`AI_GUIDELINE_CREATE`	Create an AI guideline.	Required for AI guideline creation mutations.	No
Read AI guidelines	`AI_GUIDELINE_READ`	Required to open AI Hub > Guidelines when the feature is enabled.	Required for AI guideline queries.	No
Update AI guidelines	`AI_GUIDELINE_UPDATE`	Edit AI guidelines.	Required for AI guideline update mutations.	No
Delete AI guidelines	`AI_GUIDELINE_DELETE`	Delete AI guidelines.	Required for AI guideline deletion mutations.	No

#Tags

Tags is a Labs feature.

Permission name	Action	For roles	For PATs	Custom role default
Read tags	`ENTRY_TAG_READ`	Required to open tags in Studio.	Required for tag queries.	Yes
Create tags	`ENTRY_TAG_CREATE`	Shows New tag.	Required for tag creation mutations.	Yes
Update tags	`ENTRY_TAG_UPDATE`	Rename or move tags.	Required for tag update mutations.	No
Delete tags	`ENTRY_TAG_DELETE`	Delete tags.	Required for tag deletion mutations.	No

#UI visibility

Permission name	Action	For roles	For PATs	Custom role default
Can see Team Member Settings	`VIEW_TEAM_MEMBER_SETTINGS`	Shows Project Settings > Team > Members.	UI-only	No
Can see Role & Permissions Settings	`VIEW_ROLE_PERMISSION_SETTINGS`	Shows Project Settings > Team > Roles & Permissions.	UI-only	No
Can see schema view	`VIEW_SCHEMA`	Required to see Schema. Also needs at least one of Read existing models, Read existing components, Read existing enumerations, or Read remote sources.	UI-only	No
Can see project settings	`VIEW_PROJECT_SETTINGS`	Shows Project Settings in the sidebar. Individual screens still need their own permissions.	UI-only	Yes
Can see apps section	`VIEW_APPS`	Shows Apps in the sidebar. Install, edit, and uninstall still need the app installation permissions.	UI-only	Yes
Can see environment selector	`VIEW_ENVIRONMENT_SELECTOR`	Shows the environment selector. Together with Read existing environments, shows Project Settings > General > Environments.	UI-only	Yes

#Project & governance

Permission name	Action	For roles	For PATs	Custom role default
Change the name, picture and description of a project	`PROJECT_UPDATE`	Project Settings > General > Project is otherwise read-only. Included by default for Admin and Developer system roles.	Required for project metadata mutations (name, picture, description, support access).	No
Can use the playground	`PLAYGROUND_USE`	Shows API Playground and Preview in Playground in the content editor and Assets.	UI-only	No
Read audit logs	`AUDIT_LOGS_READ`	Shows Project Settings > Governance > Audit Logs.	UI-only	No
Allows starting, scheduling, and lifting content freezes	`MANAGE_CONTENT_FREEZE`	Shows Project Settings > Governance > Content Freeze and the Manage freeze banner action.	Required for `startContentFreeze` and `liftContentFreeze`.	No
Allows managing experimental features and their role assignments	`MANAGE_EXPERIMENTAL_FEATURES`	Manage lab / experimental features.	Required for experimental feature management mutations.	No
Read observability data	`OBSERVABILITY_READ`	Shows Project Settings > General > Usage.	Required for observability read operations on the Management API.	No

#What's next

Permission combinations by job: Combined permission sets by job.
Roles: Create a custom role and assign members.
API access: PATs and the public Content API.
Content permissions: Read, Create, Update, Publish, and related rules.

Frequently Asked Questions