#Permission combinations by job
Use this page when a job needs more than one permission. For detailed information about what each permission does on its own, see Content permissions and Management API permissions. For information on how to create a role and toggle permissions in Studio, see Roles.
#Permission layers
Most of the scenarios below combine the following layers:
| Layer | What it controls | Scope |
|---|---|---|
| Management API permissions | What the role can see in Studio (tabs, buttons, settings screens). Some also authorize Management API calls. | Global |
| Content permissions | What the role can do to entries (read, create, update, delete, publish, unpublish, read versions). | Per environment |
A role can have content Read and still see an empty Content tab. This isn't always intuitive because the two permissions that unlock sidebar visibility live under Management API permissions.
Add entry, Save, Publish, and Delete each require a separate Studio content actions permission on top of everything above. A button can render and still fail the moment someone clicks it, the same way a form can look submittable and reject on submit.
Read existing environments is required to open the project. Do not disable it.
#Content
The first row below covers opening Content in the sidebar. Every other row assumes that access already exists.
| Job | Management API permissions | Content permissions |
|---|---|---|
| See Content | Read public view groups and Read public content views | Read on DRAFT for each model that should appear |
| Create an entry | Create new entries | Read, Create, and Read versions. Also Read on DRAFT and the default locale. |
| Edit a draft | Update existing non published entries | Read, Update, and Read versions |
| Edit a published entry | Update published entries | Read, Update, and Read versions |
| Publish | Publish non-published entries and Update published entries | Read and Publish (Draft plus the target stage). Add Read versions if publishing from the entry form. |
| Unpublish | Update published entries | Read on all stages and Unpublish. Add Read versions if unpublishing from the entry form. |
| Delete | Delete existing entries | Read on all stages, Delete, and Unpublish on every stage except Draft. Add Read versions if deleting from the entry form. |
| Update view | Update public content views and Update system content views | Not applicable. Views aren't scoped by content permissions. |
#Assets
The first row below covers opening Assets in the sidebar. The second row assumes that access already exists.
| Job | Management API permissions | Content permissions |
|---|---|---|
| See Assets | Read public view groups and Read public content views | Read on the Asset model |
| Upload or create assets | Create new entries | Read and Create on the Asset model. Also Read on DRAFT and the default locale. Add Read versions if creating from the asset editor. |
#Schema
| Job | Minimum Management API permissions |
|---|---|
| Open Schema | Can see schema view, plus at least one of Read existing models, Read existing components, Read existing enumerations, or Read remote sources. Taxonomy read permissions do not count. |
| Browse models | Can see schema view and Read existing models |
| Add a model | Can see schema view, Read existing models, and Create new models |
| Edit model settings | Can see schema view, Read existing models, and Update existing models |
| Edit model fields | Everything in Edit model settings, plus Update existing fields. Add Create new fields or Delete existing fields to add or remove fields. |
| Open taxonomies | Everything in Open Schema, plus Read taxonomy. Add Read taxonomy node to open taxonomy nodes. |
| Create a taxonomy | Everything in Open taxonomies, plus Create taxonomy and Create taxonomy node. |
#Apps
| Job | Minimum Management API permissions |
|---|---|
| See Apps | Can see apps section |
| Install an app | Can see apps section and Can add app installations |
| Edit an app installation | Can see apps section and Can update app installations |
| Uninstall an app | Can see apps section and Can delete app installations |
#Project settings
| Job | Minimum Management API permissions |
|---|---|
| Open environments | Read existing environments and Can see environment selector |
| Clone an environment | Read existing environments, Can see environment selector, and Create new environment |
| Open Content API settings | Can see project settings and Read existing models |
| Manage Members | Can see Team Member Settings, plus Invite a user into an existing project, Assign a role to a user, or Remove a user from an existing project as needed |
| Manage Roles | Can see Role & Permissions Settings, plus Create new roles, Update existing roles, or Delete an existing role as needed |
| Add, edit, or delete content permissions | Can read content permissions, plus Can create content permissions, Can update content permissions, or Can delete content permissions as needed |
| Duplicate a custom role | Create new roles and an available custom role seat |
| Manage Permanent Auth Tokens | Can read existing permanent auth tokens, plus create, update, or delete as needed |
| Use API Playground with content | Can use the playground, plus the content Read the query needs |
| Restore a backup | Read existing environment backups and their details and Restore an existing environment backup to a standard environment |
#AI
| Job | Minimum Management API permissions |
|---|---|
| Edit guidelines | Read AI guidelines and Update AI guidelines |
| Create an agent | Read agent config and Create an agent |
| Edit or enable an agent | Read agent config and Update an agent config |
| Delete an agent | Remove a user from an existing project. Delete an agent config and Remove an agent have no effect today. |
| Manually run an agent from the content editor or table | Trigger an agent run, plus Content access |
#API access without Studio
Studio UI flags do not apply to tokens. Configure content permissions on the PAT or for unauthenticated requests to the Content API.
| Job | Minimum |
|---|---|
| Create or update content with a PAT | Matching content permissions: Create / Update (and Read). Do not rely on Create new entries or other UI-only Management API flags. |
| Modify schema with a PAT | Management API action permissions such as Read existing models and Create new models. |
#Content reviewer
Start from a new custom role. The following are read-only permissions in Studio.
Management API
Read public view groupsRead public content views
Content (per environment)
- Model: All, or the models they should see
Read: all locales,DRAFT(andPUBLISHEDif they should compare stages)- Read versions
#Content editor
Everything in Content reviewer, plus the permissions below. These permissions allow create and update in Studio, but do not include publish.
Management API
Create new entriesUpdate existing non published entriesUpdate published entriesif they save entries that are already published
Content
CreateUpdate- Default locale included
#Content publisher
Everything in Content editor, plus the permissions below. These permissions allow publish and unpublish in Studio.
Management API
Publish non-published entriesUpdate published entries(also required to unpublish in Studio)
Content
Publish(from Draft to the target stage)Unpublishif they should take content off a stage
#Schema developer
Start from a new custom role. The permissions below are for Schema only; they do not open Content.
Management API
Can see schema viewRead existing models,Read existing components,Read existing fields,Read existing enumerations,Read remote sources,Read taxonomy, andRead taxonomy nodeCreate new models,Create new components,Create new fields,Create new enumerations,Create remote sources,Create taxonomy, andCreate taxonomy node- Add update and delete permissions only for the schema elements they should change
Can use the playgroundif they should test queries in Studio
Do not enable Read public view groups or Read public content views unless they also need Content.
#Project settings admin
Start from a new custom role. The permissions below are for Project Settings only; they do not open Content or Schema. Add the screens they should manage, for example:
Can see project settingsRead existing webhooks(and create, update, or delete as needed)Can see Team Member SettingsandInvite a user into an existing projectCan see Role & Permissions SettingsandUpdate existing rolesCan read existing permanent auth tokens
#What's next
- Roles: Create custom roles and assign members.
- Content permissions: Actions, locales, stages, conditions, and how to scope a permission.
- Management API permissions: Full list of Management API permissions.
- API access: Configure content permissions on a Permanent Auth Token.
- Set up unauthenticated access to the Content API: Serve content without a token.