# Management API permissions

Learn how Management API permissions control UI visibility and API access for roles and Permanent Auth Tokens in Hygraph.

Management API permissions govern access to your project's structural and configuration elements, such as schema, environments, roles, webhooks, and so on. They control what users assigned to a role can see in the Hygraph UI, and what actions Permanent Auth Tokens (PATs) can perform through the Management API. The same set of permissions is available for both [custom roles](https://hygraph.com/docs/getting-started/access-and-permissions/user-roles-and-permissions#custom-roles) and [Permanent Auth Tokens (PATs)](https://hygraph.com/docs/getting-started/access-and-permissions/api-access#authenticated-requests-permanent-auth-tokens), but their defaults and behaviors differ.

Management API permissions are **global**. They apply across all environments in a project.

## Roles vs PATs

Understanding how Management API permissions behave differently for roles and PATs will save you a lot of confusion when configuring access.

- **Roles** - Management API permissions primarily control **UI visibility**. Granting a permission shows a button, tab, or section to users assigned to that role. Revoking it hides it. If a user lacks a permission, the effect is visible in the interface. They may not see a button, get an error when accessing a restricted area, or in some cases be logged out.
    - Defaults cover the read permissions needed to navigate the Hygraph UI correctly. Anything beyond that must be added manually.
 
- **PATs** - Management API permissions control **API access**. If a token lacks a permission, the API call fails with an insufficient permissions error. There is no UI involved. A token created with **Add token** starts with no Management API permissions. Enable each one you need.

This distinction matters because some permissions are **UI-only**. They control what users see in the Hygraph interface but have no effect on what a PAT can do programmatically. The most common example is **Create new entries**, which shows or hides the **Add entry** button in the content editor. Granting this to a PAT does nothing, because PATs do not interact with the UI and content creation is handled by the Content API, not the Management API.

Hiding a Studio button does not block the Content API. If the role has the matching [content permission](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions), the user can still perform that action by calling the API.

## Schema

Schema create and read permissions are defaults for custom roles, but **Can see schema view** is not. That permission is under [UI visibility](#ui-visibility). A new custom role therefore has **Read existing models**, but still does not see **Schema** in Studio until you enable **Can see schema view**.

### Models

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Create new models | `MODEL_CREATE` | With **Can see schema view**, shows **Add** for models. | Required for model creation mutations (`createModel`, `createSimpleModel`). | Yes |
| Read existing models | `MODEL_READ` | With **Can see schema view**, shows models in Schema. Also required for **Project Settings > Access > Content API**. | Required to read models and for most schema mutations that reference existing models. | Yes |
| Update existing models | `MODEL_UPDATE` | Edit the **Settings** tab of models. Also needs schema and model read. | Required for model update mutations. | No |
| Delete existing models | `MODEL_DELETE` | Shows **Delete** for models. | Required for model deletion mutations. | No |

### Fields

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Read existing fields | `FIELD_READ` | Shows the **Fields** tab. | Required to read fields and for field related schema operations. | Yes |
| Create new fields | `FIELD_CREATE` | Shows the **Fields** side panel in Schema. | Required for field creation mutations on models and components. | Yes |
| Update existing fields | `FIELD_UPDATE` | Shows **Edit** on field cards and the drag and drop handle. Also needs schema and model read. | Required for field update mutations. | No |
| Delete existing fields | `FIELD_DELETE` | Allows deleting fields. Also needs schema and model read. | Required for field deletion mutations. | No |

### Components

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Create new components | `COMPONENT_CREATE` | With **Can see schema view**, shows **Add** for components. | Required for component creation mutations. | Yes |
| Read existing components | `COMPONENT_READ` | With **Can see schema view**, shows components in Schema. | Required to read components and for component related schema operations. | Yes |
| Update existing components | `COMPONENT_UPDATE` | Edit component **Settings**. Controls schema level component metadata only. | Required for component update mutations. | No |
| Delete existing components | `COMPONENT_DELETE` | Shows **Delete** in a component's context menu. | Required for component deletion mutations. | No |

### Remote sources

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Read remote sources | `REMOTE_SOURCE_READ` | With **Can see schema view**, shows remote sources in Schema. | Required to read remote sources and for related schema operations. | Yes |
| Create remote sources | `REMOTE_SOURCE_CREATE` | With **Can see schema view**, shows **Add** for remote sources. | Required for remote source creation mutations. | Yes |
| Update remote sources | `REMOTE_SOURCE_UPDATE` | Edit remote source **Settings**. Without it, **Save** is hidden. | Required for remote source update mutations. | No |
| Delete remote sources | `REMOTE_SOURCE_DELETE` | Shows **Delete** for remote sources. | Required for remote source deletion mutations. | No |

### Enumerations

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Read existing enumerations | `ENUMERATION_READ` | With **Can see schema view**, shows enumerations in Schema. | Required to read enumerations and for enumeration related schema operations. | Yes |
| Create new enumerations | `ENUMERATION_CREATE` | With **Can see schema view**, shows **Add** for enumerations. | Required for enumeration creation mutations. | Yes |
| Update existing enumerations | `ENUMERATION_UPDATE` | Edit enumeration details. Also needs schema and enumeration read. | Required for enumeration update mutations. | No |
| Delete existing enumerations | `ENUMERATION_DELETE` | Shows **Delete** in the enumeration details context menu. | Required for enumeration deletion mutations. | No |

### Taxonomies

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Read taxonomy | `TAXONOMY_READ` | With **Can see schema view**, required to open taxonomies and view **Settings**. | Required for taxonomy queries and taxonomy related mutations. | Yes |
| Create taxonomy | `TAXONOMY_CREATE` | With **Can see schema view**, shows **Add Taxonomy**. Also needs **Create taxonomy node**. | Required for taxonomy creation mutations. | Yes |
| Update taxonomy | `TAXONOMY_UPDATE` | Without it, taxonomy **Settings** are read-only. | Required for taxonomy update mutations. | No |
| Delete taxonomy | `TAXONOMY_DELETE` | Shows **Delete** in the taxonomy details context menu. | Required for taxonomy deletion mutations. | No |
| Read taxonomy node | `TAXONOMY_NODE_READ` | With **Can see schema view**, browse taxonomy **Nodes**. | Required for taxonomy node queries and node related mutations. | Yes |
| Create taxonomy node | `TAXONOMY_NODE_CREATE` | Shows **Add child node**. Together with **Create taxonomy**, enables **Add Taxonomy**. | Required for taxonomy node creation mutations. | Yes |
| Update taxonomy node | `TAXONOMY_NODE_UPDATE` | Add child nodes, rename nodes, or move nodes. | Required for taxonomy node update mutations. | No |
| Delete taxonomy node | `TAXONOMY_NODE_DELETE` | Shows **Delete** next to the taxonomy node. | Required for taxonomy node deletion mutations. | No |

## Content

**Read public content views** and **Read public view groups** together gate the **Content** tab. Neither is a default for custom roles. Sidebar views also need [Read on DRAFT](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions#permission-actions) per model. **Assets** needs the same pair plus **Read** on the Asset model.

### Content views

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Create public content views | `CONTENTVIEW_CREATE` | Shows **Save as new view**. | Required for custom content view creation mutations. | No |
| Read public content views | `CONTENTVIEW_READ` | Required with **Read public view groups** to open **Content**. | Required to read `environment.contentView` and `environment.contentViews`. | No |
| Update public content views | `CONTENTVIEW_UPDATE` | Shows **Update view** and **Update custom view**. | Required to update custom content views. | No |
| Update system content views | `CONTENTVIEW_SYSTEM_UPDATE` | Update a model's **default** content view. | Required to update **system / default** content views. | No |
| Delete public content views | `CONTENTVIEW_DELETE` | Shows **Delete custom view**. | Required to delete **custom** content views. | No |

### View groups

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Create public view groups | `VIEW_GROUP_CREATE` | Shows **Add view group**. | Required for view group creation mutations. | No |
| Read public view groups | `VIEW_GROUP_READ` | Required with **Read public content views** to open **Content**. | Required to read `environment.viewGroups` and related fields. | No |
| Update public view groups | `VIEW_GROUP_UPDATE` | Shows **Edit view group**. | Required for view group update mutations. | No |
| Delete public view groups | `VIEW_GROUP_DELETE` | Shows **Delete view group**. | Required for view group deletion mutations. | No |

### Locales

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Read locales | `LOCALE_READ` | Required to access locale information. Missing it returns an error. | Required for locale queries and locale dependent Management API operations. | Yes |
| Create locales | `LOCALE_CREATE` | Shows **Add** in **Project Settings > General > Locales**. | Required for locale creation mutations. | No |
| Update locales | `LOCALE_UPDATE` | Without it, locales are read-only. | Required for locale update mutations. | No |
| Delete locales | `LOCALE_DELETE` | Shows **Delete** in **Project Settings > General > Locales**. | Required for locale deletion mutations. | No |

### Studio content actions

These permissions do **not** grant Content API access. For roles, they show or hide Studio buttons. For PATs, they have no useful effect. You need to configure [content permissions](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions#permission-actions).

**Read existing entries** does not control the **Content** or **Assets** tabs. Use **Read public view groups** and **Read public content views**.

| Permission name | Action | For roles | For PATs | Alternative |
|-----------------|--------|-----------|----------|-------------|
| Read existing entries | `CONTENT_READ` | Deprecated. Does not show **Content** or **Assets**. | Deprecated. No effect on Content API reads. | **Read public view groups** + **Read public content views**; **Assets** also needs Asset model **Read** |
| Create new entries | `CONTENT_CREATE` | Shows **Add entry**. | Deprecated. Does not grant Content API **Create**. | [Content permissions — Create](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions#permission-actions) |
| Delete existing entries | `CONTENT_DELETE` | Shows **Delete**. | Deprecated. Does not grant Content API **Delete**. | [Content permissions — Delete](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions#permission-actions) |
| Publish non-published entries | `CONTENT_PUBLISH` | Shows Publish in Studio. | Deprecated. Does not grant Content API **Publish**. | [Content permissions — Publish](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions#permission-actions) |
| Update existing non published entries | `CONTENT_UPDATE` | **Save** on draft / non-published entries. | Deprecated. Does not grant Content API **Update**. | [Content permissions — Update](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions#permission-actions) |
| Update published entries | `CONTENT_UPDATE_PUBLISHED` | **Save** on published entries; also required for Unpublish and for Publish to work across Studio. | Deprecated. Does not grant Content API **Update** or **Unpublish**. | [Content permissions — Update or Unpublish](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions#permission-actions) |

## Environments & stages

**Read existing environments** is a custom role default. Do not disable it. Without it, users cannot open the project.

The environment selector is under [UI visibility](#ui-visibility).

### Environments

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Read existing environments | `ENVIRONMENT_READ` | Required to access the project. Together with **Can see environment selector**, shows **Environments** in Project Settings. | Required for environment scoped queries and mutations for the PAT's environment. | Yes |
| Create new environment | `ENVIRONMENT_CREATE` | Enables **Clone** in **Project Settings > General > Environments**. | Required for environment clone/create mutations. | No |
| Update an existing environment | `ENVIRONMENT_UPDATE` | Edit environments in Studio and through the Management API. | Required for environment update mutations. | No |
| Delete an existing environment | `ENVIRONMENT_DELETE` | Enables **Delete** in **Project Settings > General > Environments**. | Required for environment deletion mutations. | No |
| Promote an existing environment | `ENVIRONMENT_PROMOTE` | Shows **Promote**. | Required for promote mutations. Restoring from backup uses `ENVIRONMENT_BACKUP_RESTORE`. | No |

### Content stages

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Read stages | `STAGE_READ` | Required to access content stage information. Shows **Project Settings > General > Content Stages**. | Required for stage queries and content stage configuration. | Yes |
| Create stages | `STAGE_CREATE` | Shows **Add Stage**. | Required for content stage creation mutations. | No |
| Update stages | `STAGE_UPDATE` | Edit content stages. | Required for content stage update mutations. | No |
| Delete stages | `STAGE_DELETE` | Without it, **Delete** on a content stage throws an error. | Required for content stage deletion mutations. | No |

### Environment backups

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Create new environment backup | `ENVIRONMENT_BACKUP_CREATE` | Create an environment backup. | Required for backup creation mutations. | No |
| Read existing environment backups and their details | `ENVIRONMENT_BACKUP_READ` | Shows **Project Settings > Governance > Backup & Recovery**. | Required to query environment backups and their metadata. | No |
| Update an existing environment backup | `ENVIRONMENT_BACKUP_UPDATE` | Update an environment backup. | Required for backup update mutations. | No |
| Delete an existing environment backup | `ENVIRONMENT_BACKUP_DELETE` | Delete an environment backup. | Required for backup deletion mutations. | No |
| Restore an existing environment backup to a standard environment | `ENVIRONMENT_BACKUP_RESTORE` | Restore a backup into a standard environment. | Required to restore a backup into a standard environment. | No |

## Team & access

Showing the **Members** and **Roles** screens also requires the matching [UI visibility](#ui-visibility) permissions.

These content permission rows control who can manage permission configuration in Settings.

### Members

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Invite a user into an existing project | `USER_INVITE` | Shows **Invite members** in **Project Settings > Team > Members**. | Required for member invite mutations. | No |
| Assign a role to a user | `USER_ASSIGNROLE` | Shows **Change role** in **Members**. Also shows **Assign members** on a role. | Required for role assignment mutations. | No |
| Remove a user from an existing project | `USER_REMOVE` | Shows **Remove** and **Remove from project**. Also required to delete agents from **AI Hub > Agents**. | Required for `remove` member and `deleteAgent` mutations. | No |

### Roles

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Create new roles | `ROLE_CREATE` | Shows **Add custom role**. | Required for custom role creation mutations. | No |
| Update existing roles | `ROLE_UPDATE` | Without it, roles open read-only and editing content permissions fails. | Required for role update mutations, including management and content permissions on roles. | No |
| Delete an existing role | `ROLE_DELETE` | Shows **Delete** for custom roles. | Required for custom role deletion mutations. | No |

### Permanent auth tokens

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Can create new permanent auth tokens | `PAT_CREATE` | Shows **Add token** on **Permanent Auth Tokens**. | Required for PAT creation mutations. Grant on a token only when automation manages other PATs. | No |
| Can read existing permanent auth tokens | `PAT_READ` | Shows **Permanent Auth Tokens** in **Project Settings > Access**. For the API Playground, also grant **Can use the playground**. | Required for PAT read/list operations. | No |
| Can update existing permanent auth tokens | `PAT_UPDATE` | Shows **Edit** in the PAT context menu. | Required for PAT update mutations. | No |
| Can delete existing permanent auth tokens | `PAT_DELETE` | Shows **Delete** in the PAT context menu. | Required for PAT deletion mutations. | No |

### Content permissions

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Can create content permissions | `CONTENT_PERMISSION_CREATE` | Shows **Add permissions** on the public Content API, roles, and PATs. | Required to create content permission rows via the Management API. | No |
| Can read content permissions | `CONTENT_PERMISSION_READ` | Shows the **Content permissions** block for roles and PATs. | Required to read content permission configuration. | No |
| Can update content permissions | `CONTENT_PERMISSION_UPDATE` | Shows **Edit** on content permissions. | Required to update content permission rows. | No |
| Can delete content permissions | `CONTENT_PERMISSION_DELETE` | Shows **Delete** on content permissions. | Required to delete content permission rows. | No |

## Automation

### Webhooks

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Create new webhooks | `WEBHOOK_CREATE` | Shows **Add webhook**. | Required for webhook creation mutations. | No |
| Read existing webhooks | `WEBHOOK_READ` | Shows **Project Settings > Automation > Webhooks**. | Required for webhook queries. | No |
| Update existing webhooks | `WEBHOOK_UPDATE` | Shows **Edit** for webhooks. | Required for webhook update mutations. | No |
| Delete an existing webhook | `WEBHOOK_DELETE` | Shows **Delete** for webhooks. | Required for webhook deletion mutations. | No |

### Workflows

**Read workflow** is a custom role default. It shows **Project Settings > Governance > Workflows**.

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Read workflow | `WORKFLOW_READ` | Access workflow information and related UI. | Required for workflow queries and related Management API operations. | Yes |
| Create a new workflow | `WORKFLOW_CREATE` | Create a workflow. | Required for workflow creation mutations. | No |
| Update a workflow | `WORKFLOW_UPDATE` | Update a workflow. | Required for workflow update mutations. | No |
| Delete a workflow | `WORKFLOW_DELETE` | Delete a workflow. | Required for workflow deletion mutations. | No |
| Create a new workflow step | `WORKFLOW_STEP_CREATE` | Create a workflow step. | Required for workflow step creation mutations. | No |
| Update a workflow step | `WORKFLOW_STEP_UPDATE` | Update a workflow step. | Required for workflow step update mutations. | No |
| Delete a workflow step | `WORKFLOW_STEP_DELETE` | Delete a workflow step. | Required for workflow step deletion mutations. | No |

### Netlify

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Can trigger a netlify build for an existing integration | `NETLIFY_TRIGGER_BUILD` | Trigger a Netlify build. | Required for Netlify build trigger mutations. | No |

## Apps & integrations

**Apps** in the Studio sidebar is controlled by **Can see apps section** under [UI visibility](#ui-visibility). The permissions below control install, edit, and uninstall.

### App installations

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Can add app installations | `APP_INSTALLATION_CREATE` | Shows the **Explore apps** banner. Projects without this permission do not appear in the project selector for new installs. | Required for app installation mutations. | No |
| Can update app installations | `APP_INSTALLATION_UPDATE` | Shows **Edit** on app cards. | Required for app installation update mutations. | No |
| Can delete app installations | `APP_INSTALLATION_DELETE` | Shows **Uninstall app** in the app card context menu. | Required for app uninstall mutations. | No |

### Integrations

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Can add new integrations to an existing project | `INTEGRATION_CREATE` | Create an integration. | Required for integration creation mutations. | No |
| Can see existing integrations in an existing project | `INTEGRATION_READ` | Read existing integrations. | Required for integration queries. | No |
| Can update existing integrations in an existing project | `INTEGRATION_UPDATE` | Update an integration. | Required for integration update mutations. | No |
| Can delete existing integrations in an existing project | `INTEGRATION_DELETE` | Delete an integration. | Required for integration deletion mutations. | No |

### Extensions

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Can add new extension to an existing project | `EXTENSION_CREATE` | Create an extension. | Required for extension creation mutations. | No |
| Can see existing extensions in an existing project | `EXTENSION_READ` | Read existing extensions. | Required for extension queries. | No |
| Can update existing extensions in an existing project | `EXTENSION_UPDATE` | Update an extension. | Required for extension update mutations. | No |
| Can delete existing extensions in an existing project | `EXTENSION_DELETE` | Delete an extension. | Required for extension deletion mutations. | No |

## AI Hub

### Agents

**Note:**
**Remove an agent** and **Delete an agent config** appear in Roles & Permissions but have no effect today. Leave them disabled.

Deleting an agent uses [**Remove a user from an existing project**](#members).

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Create an agent | `AGENT_CREATE` | Shows **Add agent** in **AI Hub > Agents**. | Required for `createAgent` mutations. | No |
| Read agent config | `AGENT_CONFIG_READ` | Required to open **AI Hub > Agents** and agent KPIs when agents are enabled. | Required for agent configuration queries. | No |
| Update an agent config | `AGENT_CONFIG_UPDATE` | Edit or enable/disable agents. | Required for `updateAgent` mutations. | No |
| Trigger an agent run | `AGENT_RUN` | Required to manually trigger agents from the content editor or content table. | **UI-only**. Not used for workflow-triggered runs. | No |
| Delete an agent config | `AGENT_CONFIG_DELETE` | No effect. | No effect. `deleteAgentConfig` is not implemented. Use `deleteAgent`, which checks **Remove a user from an existing project**. | No |
| Remove an agent | `AGENT_REMOVE` | No effect. | No effect. `removeAgentFromProject` is not implemented. | No |

### Guidelines

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Create AI guidelines | `AI_GUIDELINE_CREATE` | Create an AI guideline. | Required for AI guideline creation mutations. | No |
| Read AI guidelines | `AI_GUIDELINE_READ` | Required to open **AI Hub > Guidelines** when the feature is enabled. | Required for AI guideline queries. | No |
| Update AI guidelines | `AI_GUIDELINE_UPDATE` | Edit AI guidelines. | Required for AI guideline update mutations. | No |
| Delete AI guidelines | `AI_GUIDELINE_DELETE` | Delete AI guidelines. | Required for AI guideline deletion mutations. | No |

## Tags

Tags is a Labs feature. 

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Read tags | `ENTRY_TAG_READ` | Required to open tags in Studio. | Required for tag queries. | Yes |
| Create tags | `ENTRY_TAG_CREATE` | Shows **New tag**. | Required for tag creation mutations. | Yes |
| Update tags | `ENTRY_TAG_UPDATE` | Rename or move tags. | Required for tag update mutations. | No |
| Delete tags | `ENTRY_TAG_DELETE` | Delete tags. | Required for tag deletion mutations. | No |

## UI visibility

These permissions only decide whether a part of the Studio interface is visible, such as a sidebar entry, a settings screen, or the environment selector. They do not grant access to the data behind that screen, which still depends on the permissions listed in the other sections. They have no effect on a PAT.

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Can see Team Member Settings | `VIEW_TEAM_MEMBER_SETTINGS` | Shows **Project Settings > Team > Members**. | **UI-only** | No |
| Can see Role & Permissions Settings | `VIEW_ROLE_PERMISSION_SETTINGS` | Shows **Project Settings > Team > Roles & Permissions**. | **UI-only** | No |
| Can see schema view | `VIEW_SCHEMA` | Required to see **Schema**. Also needs at least one of **Read existing models**, **Read existing components**, **Read existing enumerations**, or **Read remote sources**. | **UI-only** | No |
| Can see project settings | `VIEW_PROJECT_SETTINGS` | Shows **Project Settings** in the sidebar. Individual screens still need their own permissions. | **UI-only** | Yes |
| Can see apps section | `VIEW_APPS` | Shows **Apps** in the sidebar. Install, edit, and uninstall still need the [app installation](#app-installations) permissions. | **UI-only** | Yes |
| Can see environment selector | `VIEW_ENVIRONMENT_SELECTOR` | Shows the environment selector. Together with **Read existing environments**, shows **Project Settings > General > Environments**. | **UI-only** | Yes |

## Project & governance

| Permission name | Action | For roles | For PATs | Custom role default |
|-----------------|--------|-----------|----------|---------------------|
| Change the name, picture and description of a project | `PROJECT_UPDATE` | **Project Settings > General > Project** is otherwise read-only. Included by default for Admin and Developer system roles. | Required for project metadata mutations (name, picture, description, support access). | No |
| Can use the playground | `PLAYGROUND_USE` | Shows **API Playground** and **Preview in Playground** in the content editor and Assets. | **UI-only** | No |
| Read audit logs | `AUDIT_LOGS_READ` | Shows **Project Settings > Governance > Audit Logs**. | **UI-only** | No |
| Allows starting, scheduling, and lifting content freezes | `MANAGE_CONTENT_FREEZE` | Shows **Project Settings > Governance > Content Freeze** and the **Manage freeze** banner action. | Required for `startContentFreeze` and `liftContentFreeze`. | No |
| Allows managing experimental features and their role assignments | `MANAGE_EXPERIMENTAL_FEATURES` | Manage lab / experimental features. | Required for experimental feature management mutations. | No |
| Read observability data | `OBSERVABILITY_READ` | Shows **Project Settings > General > Usage**. | Required for observability read operations on the Management API. | No |

## What's next

- [Permission combinations by job](https://hygraph.com/docs/getting-started/access-and-permissions/permission-combinations-by-job): Combined permission sets by job.
- [Roles](https://hygraph.com/docs/getting-started/access-and-permissions/user-roles-and-permissions): Create a custom role and assign members.
- [API access](https://hygraph.com/docs/getting-started/access-and-permissions/api-access): PATs and the public Content API.
- [Content permissions](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions): Read, Create, Update, Publish, and related rules.