Fine-grained permissions

What a fine-grained personal access token needs for each action this server offers, as GitLab 19.4.1 declares it. The requests come from the handlers (docs/development/action-requests.json) and the permissions from the authorization GitLab records for each route, GraphQL type and mutation (docs/development/gitlab-api-live.json). Permissions are named in GitLab’s own words, as its token creation page shows them, with the boundary each is held at: a token whose grant covers every permission of one line, at one of the boundaries named, can run the action. Where an action has several lines, any one of them is enough, since the action sends a different request depending on its input. Where one of those requests is one no fine-grained token passes, the entry says so after what the others need: the action runs, except with an input that makes it send that request.

An action GitLab declares nothing for cannot be run with a fine-grained token at this release, whatever the grant says: the reason is in the second column, and a classic personal access token is the way out. Served empty names a part of the answer GitLab leaves out for a fine-grained token while the rest is served: always, or unless the grant also holds what follows it. Each part is written as the GraphQL selection that reaches it from the field the action asks for.

Classic personal access tokens are not judged here: their scopes decide what they can do, as before. The same requirement is served for each action in the fine_grained block of its gitlab://tools/{id} detail. Fine-grained tokens covers creating a token, what the server needs from it at startup, and how a refusal reads.

access

Action	Needs	Served empty
access.approve_group	Access Request: Approve at group
access.approve_project	Access Request: Approve at project
access.deny_group	Access Request: Delete at group or user
access.deny_project	Access Request: Delete at project or user
access.deploy_key_add	Deploy Key: Create at project
access.deploy_key_add_instance	Deploy Key: Create at instance
access.deploy_key_delete	Deploy Key: Delete at project
access.deploy_key_enable	Deploy Key: Enable at project
access.deploy_key_get	Deploy Key: Read at project
access.deploy_key_list_all	Deploy Key: Read at instance
access.deploy_key_list_project	Deploy Key: Read at project
access.deploy_key_list_user_project	Deploy Key: Read at user
access.deploy_key_update	Deploy Key: Update at project
access.deploy_token_create_group	Deploy Token: Create at group
access.deploy_token_create_project	Deploy Token: Create at project
access.deploy_token_delete_group	Deploy Token: Delete at group
access.deploy_token_delete_project	Deploy Token: Delete at project
access.deploy_token_get_group	Deploy Token: Read at group
access.deploy_token_get_project	Deploy Token: Read at project
access.deploy_token_list_all	Deploy Token: Read at instance
access.deploy_token_list_group	Deploy Token: Read at group
access.deploy_token_list_project	Deploy Token: Read at project
access.invite_group	Invitation: Create at group
access.invite_list_group	Invitation: Read at group
access.invite_list_project	Invitation: Read at project
access.invite_project	Invitation: Create at project
access.request_group	Access Request: Create at user
access.request_list_group	Access Request: Read at group
access.request_list_project	Access Request: Read at project
access.request_project	Access Request: Create at user
access.token_group_create	Resource Access Token: Create at group
access.token_group_get	Resource Access Token: Read at group
access.token_group_list	Resource Access Token: Read at group
access.token_group_revoke	Resource Access Token: Delete at group
access.token_group_rotate	Resource Access Token: Rotate at group
access.token_group_rotate_self	Resource Access Token: Rotate at group
access.token_personal_get	Personal Access Token: Read at user
access.token_personal_list	Personal Access Token: Read at user
access.token_personal_revoke	Personal Access Token: Revoke at user
access.token_personal_revoke_self	Personal Access Token: Revoke at user
access.token_personal_rotate	Personal Access Token: Rotate at user
access.token_personal_rotate_self	Personal Access Token: Rotate at user
access.token_project_create	Resource Access Token: Create at project
access.token_project_get	Resource Access Token: Read at project
access.token_project_list	Resource Access Token: Read at project
access.token_project_revoke	Resource Access Token: Delete at project
access.token_project_rotate	Resource Access Token: Rotate at project
access.token_project_rotate_self	Resource Access Token: Rotate at project

achievement

Action	Needs	Served empty
achievement.award	Not reachable at this release: GitLab declares no fine-grained permission for UserAchievement in the answer, so the write commits and its answer is lost
achievement.create	Not reachable at this release: GitLab declares no fine-grained permission for Achievement in the answer, so the write commits and its answer is lost
achievement.delete	Not reachable at this release: GitLab declares no fine-grained permission for Achievement in the answer, so the write commits and its answer is lost
achievement.list	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
achievement.recipients	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
achievement.revoke	Not reachable at this release: GitLab declares no fine-grained permission for UserAchievement in the answer, so the write commits and its answer is lost
achievement.unique_users	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
achievement.update	Not reachable at this release: GitLab declares no fine-grained permission for Achievement in the answer, so the write commits and its answer is lost
achievement.user_achievement_delete	Not reachable at this release: GitLab declares no fine-grained permission for UserAchievement in the answer, so the write commits and its answer is lost
achievement.user_achievement_reorder	Not reachable at this release: GitLab declares no fine-grained permission for UserAchievement in the answer, so the write commits and its answer is lost
achievement.user_achievement_update	Not reachable at this release: GitLab declares no fine-grained permission for UserAchievement in the answer, so the write commits and its answer is lost
achievement.user_list	Not reachable at this release: GitLab declares no fine-grained permission for UserAchievement, which the answer is made of

admin

Action	Needs	Served empty
admin.alert_metric_image_delete	Alert Metric Image: Delete at project
admin.alert_metric_image_list	Alert Metric Image: Read at project
admin.alert_metric_image_update	Alert Metric Image: Update at project
admin.alert_metric_image_upload	Alert Metric Image: Create at project
admin.app_statistics_get	Statistic: Read at instance
admin.appearance_get	Application Appearance: Read at instance
admin.appearance_update	Application Appearance: Update at instance
admin.application_create	OAuth Application: Create at instance
admin.application_delete	OAuth Application: Delete at instance
admin.application_list	OAuth Application: Read at instance
admin.application_renew_secret	OAuth Application: Renew Secret at instance
admin.broadcast_message_create	Broadcast Message: Create at instance
admin.broadcast_message_delete	Broadcast Message: Delete at instance
admin.broadcast_message_get	a request GitLab does not judge by the grant
admin.broadcast_message_list	a request GitLab does not judge by the grant
admin.broadcast_message_update	Broadcast Message: Update at instance
admin.bulk_import_cancel	Import: Cancel at instance
admin.bulk_import_entity_failures	Import: Read at instance
admin.bulk_import_entity_get	Import: Read at instance
admin.bulk_import_entity_list	Import: Read at instance
admin.bulk_import_get	Import: Read at instance
admin.bulk_import_list	Import: Read at instance
admin.bulk_import_start	Import: Create at instance
admin.cluster_agent_delete	Cluster Agent: Delete at project
admin.cluster_agent_get	Cluster Agent: Read at project
admin.cluster_agent_list	Cluster Agent: Read at project
admin.cluster_agent_register	Cluster Agent: Create at project
admin.cluster_agent_token_create	Cluster Agent Token: Create at project
admin.cluster_agent_token_get	Cluster Agent Token: Read at project
admin.cluster_agent_token_list	Cluster Agent Token: Read at project
admin.cluster_agent_token_revoke	Cluster Agent Token: Revoke at project
admin.custom_attr_delete	one of: Custom Attribute: Delete at instance or Custom Attribute: Delete at group or Custom Attribute: Delete at project
admin.custom_attr_get	one of: Custom Attribute: Read at instance or Custom Attribute: Read at group or Custom Attribute: Read at project
admin.custom_attr_list	one of: Custom Attribute: Read at instance or Custom Attribute: Read at group or Custom Attribute: Read at project
admin.custom_attr_set	one of: Custom Attribute: Update at instance or Custom Attribute: Update at group or Custom Attribute: Update at project
admin.db_migration_mark	Database Migration: Mark at instance
admin.dependency_proxy_delete	Dependency Proxy Cache: Purge at group
admin.error_tracking_create	Error Tracking Client Key: Create at project
admin.error_tracking_delete	Error Tracking Client Key: Delete at project
admin.error_tracking_get_settings	Error Tracking Setting: Read at project
admin.error_tracking_list	Error Tracking Client Key: Read at project
admin.error_tracking_update_settings	Error Tracking Setting: Update at project
admin.feature_delete	Feature: Delete at instance
admin.feature_list	Feature: Read at instance
admin.feature_list_definitions	Feature: Read at instance
admin.feature_set	Feature: Update at instance
admin.import_bitbucket	Import: Create at group or user
admin.import_bitbucket_server	Import: Create at instance
admin.import_cancel_github	Import: Cancel at user
admin.import_gists	Import: Create at user
admin.import_github	Import: Create at group or user
admin.license_add	License: Create at instance
admin.license_delete	License: Delete at instance
admin.license_get	License: Read at instance
admin.metadata_get	Metadata: Read at instance
admin.plan_limits_change	Plan Limit: Update at instance
admin.plan_limits_get	Plan Limit: Read at instance
admin.secure_file_create	Secure File: Create at project
admin.secure_file_delete	Secure File: Delete at project
admin.secure_file_get	Secure File: Read at project
admin.secure_file_list	Secure File: Read at project
admin.settings_get	Application Setting: Read at instance
admin.settings_update	Application Setting: Update at instance
admin.sidekiq_compound_metrics	Sidekiq Metric: Read at instance
admin.sidekiq_job_stats	Sidekiq Metric: Read at instance
admin.sidekiq_process_metrics	Sidekiq Metric: Read at instance
admin.sidekiq_queue_metrics	Sidekiq Metric: Read at instance
admin.system_hook_add	Webhook: Create at instance
admin.system_hook_delete	Webhook: Delete at instance
admin.system_hook_delete_url_variable	Webhook: Update at instance
admin.system_hook_edit	Webhook: Update at instance
admin.system_hook_get	Webhook: Read at instance
admin.system_hook_list	Webhook: Read at instance
admin.system_hook_set_url_variable	Webhook: Update at instance
admin.system_hook_test	Webhook: Trigger at instance
admin.terraform_state_delete	Terraform State: Delete at project
admin.terraform_state_get	Project: Read at project; Terraform State: Read at project	project { terraformState { latestVersion } } (without Terraform State: Read at project)
admin.terraform_state_list	Project: Read at project; Terraform State: Read at project	project { terraformStates { nodes { latestVersion } } } (without Terraform State: Read at project)
admin.terraform_state_lock	Terraform State: Lock at project
admin.terraform_state_unlock	Terraform State: Lock at project
admin.terraform_version_delete	Terraform State: Delete at project
admin.topic_create	Topic: Create at instance
admin.topic_delete	Topic: Delete at instance
admin.topic_get	a request GitLab does not judge by the grant
admin.topic_list	a request GitLab does not judge by the grant
admin.topic_update	Topic: Update at instance
admin.usage_data_metric_definitions	a request GitLab does not judge by the grant
admin.usage_data_non_sql_metrics	Usage Data Metric: Read at instance
admin.usage_data_queries	Usage Data Query: Read at instance
admin.usage_data_service_ping	Service Ping: Read at instance
admin.usage_data_track_event	Internal Event: Track at instance
admin.usage_data_track_events	Internal Event: Track at instance

attestation

Action	Needs	Served empty
attestation.download	Attestation: Read at project
attestation.list	Attestation: Read at project

audit_event

Action	Needs	Served empty
audit_event.get_group	Audit Event: Read at group
audit_event.get_instance	Audit Event: Read at instance
audit_event.get_project	Audit Event: Read at project
audit_event.list_group	Audit Event: Read at group
audit_event.list_instance	Audit Event: Read at instance
audit_event.list_project	Audit Event: Read at project

branch

Action	Needs	Served empty
branch.create	Branch: Create at project
branch.delete	Branch: Delete at project
branch.delete_merged	Branch: Delete at project
branch.get	Branch: Read at project
branch.get_protected	Protected Branch: Read at project
branch.list	Branch: Read at project
branch.list_protected	Protected Branch: Read at project
branch.protect	Branch: Protect at project
branch.rule_list	Not reachable at this release: GitLab declares no fine-grained permission for BranchRule, which the answer is made of
branch.unprotect	Branch: Protect at project
branch.update_protected	Protected Branch: Update at project

ci_catalog

Action	Needs	Served empty
ci_catalog.get	Not reachable at this release: GitLab declares no fine-grained permission for CiCatalogResource, which the answer is made of
ci_catalog.list	Not reachable at this release: GitLab declares no fine-grained permission for CiCatalogResource, which the answer is made of

ci_variable

Action	Needs	Served empty
ci_variable.create	Variable: Create at project
ci_variable.delete	Variable: Delete at project
ci_variable.get	Variable: Read at project
ci_variable.group_create	Variable: Create at group
ci_variable.group_delete	Variable: Delete at group
ci_variable.group_get	Variable: Read at group
ci_variable.group_list	Variable: Read at group
ci_variable.group_update	Variable: Update at group
ci_variable.instance_create	Variable: Create at instance
ci_variable.instance_delete	Variable: Delete at instance
ci_variable.instance_get	Variable: Read at instance
ci_variable.instance_list	Variable: Read at instance
ci_variable.instance_update	Variable: Update at instance
ci_variable.list	Variable: Read at project
ci_variable.update	Variable: Update at project

compliance_policy

Action	Needs	Served empty
compliance_policy.get	Compliance Policy Setting: Read at instance
compliance_policy.update	Compliance Policy Setting: Update at instance

custom_emoji

Action	Needs	Served empty
custom_emoji.create	Not reachable at this release: GitLab declares no fine-grained permission for CustomEmoji in the answer, so the write commits and its answer is lost
custom_emoji.delete	Not reachable at this release: GitLab declares no fine-grained permission for CustomEmoji in the answer, so the write commits and its answer is lost
custom_emoji.list	Not reachable at this release: GitLab declares no fine-grained permission for CustomEmoji, which the answer is made of

dependency

Action	Needs	Served empty
dependency.export_create	Dependency List Export: Create at project
dependency.export_download	Dependency List Export: Read at project or group
dependency.export_get	Dependency List Export: Read at project or group
dependency.list	Dependency: Read at project

discover_project

Action	Needs	Served empty
discover_project.resolve	Project: Read at project

dora_metrics

Action	Needs	Served empty
dora_metrics.group	Dora Metric: Read at group
dora_metrics.project	Dora Metric: Read at project

enterprise_user

Action	Needs	Served empty
enterprise_user.delete	Enterprise User: Delete at group
enterprise_user.disable_2fa	Enterprise User: Disable Two Factor at group
enterprise_user.get	Enterprise User: Read at group
enterprise_user.list	Enterprise User: Read at group

environment

Action	Needs	Served empty
environment.create	Environment: Create at project
environment.delete	Environment: Delete at project
environment.deployment_approve_or_reject	Deployment: Approve at project
environment.deployment_create	Deployment: Create at project
environment.deployment_delete	Deployment: Delete at project
environment.deployment_get	Deployment: Read at project
environment.deployment_list	Deployment: Read at project
environment.deployment_merge_requests	Deployment: Read, Merge Request: Read at project
environment.deployment_update	Deployment: Update at project
environment.freeze_create	Freeze Period: Create at project
environment.freeze_delete	Freeze Period: Delete at project
environment.freeze_get	Freeze Period: Read at project
environment.freeze_list	Freeze Period: Read at project
environment.freeze_update	Freeze Period: Update at project
environment.get	Environment: Read at project
environment.list	Environment: Read at project
environment.protected_get	Protected Environment: Read at project
environment.protected_list	Protected Environment: Read at project
environment.protected_protect	Protected Environment: Create at project
environment.protected_unprotect	Protected Environment: Delete at project
environment.protected_update	Protected Environment: Update at project
environment.stop	Environment: Stop at project
environment.update	Environment: Update at project

external_status_check

Action	Needs	Served empty
external_status_check.create_project	External Status Check Service: Create at project
external_status_check.delete_project	External Status Check Service: Delete at project
external_status_check.list_project	External Status Check Service: Read at project
external_status_check.list_project_checks	External Status Check Service: Read at project
external_status_check.list_project_mr_checks	External Status Check: Read at project
external_status_check.retry_project	External Status Check: Retry at project
external_status_check.set_project_mr_status	External Status Check: Update at project
external_status_check.update_project	External Status Check Service: Update at project

feature_flags

Action	Needs	Served empty
feature_flags.feature_flag_create	Feature Flag: Create at project
feature_flags.feature_flag_delete	Feature Flag: Delete at project
feature_flags.feature_flag_get	Feature Flag: Read at project
feature_flags.feature_flag_list	Feature Flag: Read at project
feature_flags.feature_flag_update	Feature Flag: Update at project
feature_flags.ff_user_list_create	Feature Flag User List: Create at project
feature_flags.ff_user_list_delete	Feature Flag User List: Delete at project
feature_flags.ff_user_list_get	Feature Flag User List: Read at project
feature_flags.ff_user_list_list	Feature Flag User List: Read at project
feature_flags.ff_user_list_update	Feature Flag User List: Update at project

geo

Action	Needs	Served empty
geo.create	Geo Site: Create at instance
geo.delete	Geo Site: Delete at instance
geo.edit	Geo Site: Update at instance
geo.get	Geo Site: Read at instance
geo.get_status	Geo Site: Read at instance
geo.list	Geo Site: Read at instance
geo.list_status	Geo Site: Read at instance
geo.repair	Geo Site: Repair at instance

group

Action	Needs	Served empty
group.analytics_issues_count	Activity Analytics: Read at group
group.analytics_members_count	Activity Analytics: Read at group
group.analytics_mr_count	Activity Analytics: Read at group
group.archive	Group: Archive at group
group.badge_add	Badge: Create at group
group.badge_delete	Badge: Delete at group
group.badge_edit	Badge: Update at group
group.badge_get	Badge: Read at group
group.badge_list	Badge: Read at group
group.badge_preview	Badge: Read at group
group.create	Group: Create at user
group.credential_delete_ssh_key	SSH Key: Delete at group
group.credential_list_pats	Personal Access Token: Read at group
group.credential_list_ssh_keys	SSH Key: Read at group
group.credential_revoke_pat	Personal Access Token: Revoke at group
group.delete	Group: Delete at group
group.epic_board_get	Work Item: Read at group
group.epic_board_list	Work Item: Read at group
group.epic_create	Not reachable at this release: WorkItem is declared at a boundary the object the action reaches never resolves to, so the write commits and its answer is lost
group.epic_delete	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_discussion_add_note	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_discussion_create	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_discussion_delete_note	Work Item: Delete at project or group
group.epic_discussion_get	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_discussion_list	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_discussion_update_note	Work Item: Update at project or group; Work Item: Read at project or group	updateNote { quickActionsStatus } (always), updateNote { note { author } } (without User: Read at user), updateNote { note { lastEditedBy } } (without User: Read at user), updateNote { note { resolvedBy } } (without User: Read at user)
group.epic_get	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_get_links	Work Item: Read at group
group.epic_issue_assign	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_issue_list	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_issue_remove	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_issue_update	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_list	Work Item: Read at group. With an input that sends another request instead, not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_note_create	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_note_delete	Work Item: Delete at project or group
group.epic_note_get	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_note_list	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.epic_note_update	Work Item: Update at project or group; Work Item: Read at project or group	updateNote { quickActionsStatus } (always), updateNote { note { author } } (without User: Read at user), updateNote { note { lastEditedBy } } (without User: Read at user), updateNote { note { resolvedBy } } (without User: Read at user)
group.epic_update	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
group.event_epic_label_get	Work Item: Read at group
group.event_epic_label_list	Work Item: Read at group
group.get	Group: Read at group
group.group_billable_member_memberships_list	Member: Read at group
group.group_billable_member_remove	Member: Delete at group
group.group_billable_members_list	Member: Read at group
group.group_board_create	Work Item: Create at group
group.group_board_create_list	Work Item: Create at group
group.group_board_delete	Work Item: Delete at group
group.group_board_delete_list	Work Item: Delete at group
group.group_board_get	Work Item: Read at group
group.group_board_get_list	Work Item: Read at group
group.group_board_list	Work Item: Read at group
group.group_board_list_lists	Work Item: Read at group
group.group_board_update	Work Item: Update at group
group.group_board_update_list	Work Item: Update at group
group.group_export_download	Export: Download at group
group.group_export_schedule	Export: Create at group
group.group_import_file	Import: Create at instance
group.group_label_create	Label: Create at group
group.group_label_delete	Label: Delete at group
group.group_label_get	Label: Read at group
group.group_label_list	Label: Read at group
group.group_label_subscribe	Label: Subscribe at group
group.group_label_unsubscribe	Label: Subscribe at group
group.group_label_update	Label: Update at group
group.group_member_add	Member: Create at group
group.group_member_edit	Member: Update at group
group.group_member_get	Member: Read at group
group.group_member_get_inherited	Member: Read at group
group.group_member_remove	Member: Delete at group
group.group_member_share	Group: Share at group
group.group_member_unshare	Group: Share at group
group.group_milestone_burndown	Work Item: Read at group
group.group_milestone_create	Work Item: Create at group
group.group_milestone_delete	Work Item: Read at group; Work Item: Delete at group
group.group_milestone_get	Work Item: Read at group
group.group_milestone_issues	Work Item: Read at group
group.group_milestone_list	Work Item: Read at group
group.group_milestone_merge_requests	Work Item: Read at group
group.group_milestone_update	Work Item: Read at group; Work Item: Update at group
group.group_relations_list_status	Export: Read at group
group.group_relations_schedule	Export: Create at group
group.group_upload_delete_by_id	Markdown Upload: Delete at group
group.group_upload_delete_by_secret	Markdown Upload: Delete at group
group.group_upload_list	Markdown Upload: Read at group
group.hook_add	Webhook: Create at group
group.hook_delete	Webhook: Delete at group
group.hook_delete_custom_header	Webhook: Update at group
group.hook_delete_url_variable	Webhook: Update at group
group.hook_edit	Webhook: Update at group
group.hook_get	Webhook: Read at group
group.hook_list	Webhook: Read at group
group.hook_resend_event	Webhook: Trigger at group
group.hook_set_custom_header	Webhook: Update at group
group.hook_set_url_variable	Webhook: Update at group
group.hook_test	Webhook: Trigger at group
group.invited_groups	Group: Read at group
group.issues	Work Item: Read at group
group.ldap_link_add	LDAP Group Link: Create at group
group.ldap_link_delete	LDAP Group Link: Delete at group
group.ldap_link_delete_for_provider	LDAP Group Link: Delete at group
group.ldap_link_list	LDAP Group Link: Read at group
group.ldap_sync	LDAP Group Sync: Run at group
group.list	Group: Read at user
group.list_provisioned_users	Provisioned User: Read at group
group.members	Member: Read at group
group.projects	Project: Read at group
group.protected_branch_get	Protected Branch: Read at group
group.protected_branch_list	Protected Branch: Read at group
group.protected_branch_protect	Branch: Protect at group
group.protected_branch_unprotect	Branch: Protect at group
group.protected_branch_update	Protected Branch: Update at group
group.protected_env_get	Protected Environment: Read at group
group.protected_env_list	Protected Environment: Read at group
group.protected_env_protect	Protected Environment: Create at group
group.protected_env_unprotect	Protected Environment: Delete at group
group.protected_env_update	Protected Environment: Update at group
group.push_rule_add	Push Rule: Create at group
group.push_rule_delete	Push Rule: Delete at group
group.push_rule_edit	Push Rule: Update at group
group.push_rule_get	Push Rule: Read at group
group.release_list	Release: Read at group
group.restore	Group: Update at group
group.saml_link_add	SAML Group Link: Create at group
group.saml_link_delete	SAML Group Link: Delete at group
group.saml_link_get	SAML Group Link: Read at group
group.saml_link_list	SAML Group Link: Read at group
group.saml_users_list	SAML User: Read at group
group.search	Group: Read at user
group.security_settings_update	Security Setting: Update at group
group.service_account_create	Service Account: Create at group
group.service_account_delete	Service Account: Delete at group
group.service_account_get	Service Account: Read at group
group.service_account_list	Service Account: Read at group
group.service_account_pat_create	Service Account Personal Access Token: Create at group
group.service_account_pat_list	Service Account Personal Access Token: Read at group
group.service_account_pat_revoke	Service Account Personal Access Token: Revoke at group
group.service_account_pat_rotate	Service Account Personal Access Token: Rotate at group
group.service_account_update	Service Account: Update at group
group.share_with_group	Group: Share at group
group.shared_projects	Group: Read at group
group.shared_with	Group: Read at group
group.ssh_cert_create	SSH Certificate: Create at group
group.ssh_cert_delete	SSH Certificate: Delete at group
group.ssh_cert_list	SSH Certificate: Read at group
group.subgroups	Group: Read at group
group.transfer	Group: Transfer at group
group.transfer_locations	Group: Read at group
group.transfer_project	Project: Transfer at instance
group.unarchive	Group: Archive at group
group.unshare_from_group	Group: Share at group
group.update	Group: Update at group
group.upload_avatar	Group: Update at group
group.wiki_create	Wiki: Create at group
group.wiki_delete	Wiki: Delete at group
group.wiki_edit	Wiki: Update at group
group.wiki_get	Wiki: Read at group
group.wiki_list	Wiki: Read at group

group_scim

Action	Needs	Served empty
group_scim.delete	SCIM Identity: Delete at group
group_scim.get	SCIM Identity: Read at group
group_scim.list	SCIM Identity: Read at group
group_scim.update	SCIM Identity: Update at group

interactive

Action	Needs	Served empty
interactive.issue_create	Work Item: Create at project
interactive.mr_create	Merge Request: Create at project
interactive.project_create	Project: Create at user
interactive.release_create	Release: Create at project

issue

Action	Needs	Served empty
issue.create	Work Item: Create at project
issue.create_todo	Todo: Create at project
issue.delete	Work Item: Delete at project
issue.discussion_add_note	Work Item: Create at project
issue.discussion_create	Work Item: Create at project
issue.discussion_delete_note	Work Item: Delete at project
issue.discussion_get	Work Item: Read at project
issue.discussion_list	Work Item: Read at project
issue.discussion_update_note	Work Item: Update at project
issue.emoji_issue_create	Work Item: Create at project
issue.emoji_issue_delete	Work Item: Delete at project
issue.emoji_issue_get	Work Item: Read at project
issue.emoji_issue_list	Work Item: Read at project
issue.emoji_issue_note_create	Work Item: Create at project
issue.emoji_issue_note_delete	Work Item: Delete at project
issue.emoji_issue_note_get	Work Item: Read at project
issue.emoji_issue_note_list	Work Item: Read at project
issue.event_issue_iteration_get	Work Item: Read at project
issue.event_issue_iteration_list	Work Item: Read at project
issue.event_issue_label_get	Work Item: Read at project
issue.event_issue_label_list	Work Item: Read at project
issue.event_issue_milestone_get	Work Item: Read at project
issue.event_issue_milestone_list	Work Item: Read at project
issue.event_issue_state_get	Work Item: Read at project
issue.event_issue_state_list	Work Item: Read at project
issue.event_issue_weight_list	Work Item: Read at project
issue.get	Work Item: Read at project
issue.get_by_id	Work Item: Read at instance
issue.iteration_list_group	Work Item: Read at group
issue.iteration_list_project	Work Item: Read at project
issue.link_create	Work Item: Create at project
issue.link_delete	Work Item: Delete at project
issue.link_get	Work Item: Read at project
issue.link_list	Work Item: Read at project
issue.list	Work Item: Read at project
issue.list_all	Work Item: Read at user
issue.list_group	Work Item: Read at group
issue.move	Work Item: Update at project
issue.mrs_closing	Work Item: Read at project
issue.mrs_related	Work Item: Read at project
issue.note_create	Work Item: Create at project
issue.note_delete	Work Item: Delete at project
issue.note_get	Work Item: Read at project
issue.note_list	Work Item: Read at project
issue.note_update	Work Item: Update at project
issue.participants	Work Item: Read at project
issue.reorder	Work Item: Update at project
issue.spent_time_add	Work Item: Update at project
issue.spent_time_reset	Work Item: Update at project
issue.statistics_get	Work Item: Read at user
issue.statistics_get_group	Work Item: Read at group
issue.statistics_get_project	Work Item: Read at project
issue.subscribe	Issue: Subscribe at project
issue.time_estimate_reset	Work Item: Update at project
issue.time_estimate_set	Work Item: Update at project
issue.time_stats_get	Work Item: Read at project
issue.unsubscribe	Issue: Subscribe at project
issue.update	Work Item: Update at project
issue.work_item_create	Not reachable at this release: GitLab declares no fine-grained permission for WorkItemType in the answer, so the write commits and its answer is lost
issue.work_item_delete	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
issue.work_item_get	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
issue.work_item_list	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
issue.work_item_saved_view_create	Not reachable at this release: GitLab declares no fine-grained permission for WorkItemSavedViewType in the answer, so the write commits and its answer is lost
issue.work_item_saved_view_delete	Work Item Saved View: Delete at project or group
issue.work_item_saved_view_get	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
issue.work_item_saved_view_list	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
issue.work_item_saved_view_subscribe	Not reachable at this release: GitLab declares no fine-grained permission for WorkItemSavedViewType in the answer, so the write commits and its answer is lost
issue.work_item_saved_view_unsubscribe	Not reachable at this release: GitLab declares no fine-grained permission for WorkItemSavedViewType in the answer, so the write commits and its answer is lost
issue.work_item_saved_view_update	Not reachable at this release: GitLab declares no fine-grained permission for WorkItemSavedViewType in the answer, so the write commits and its answer is lost
issue.work_item_type_list	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of
issue.work_item_update	Not reachable at this release: GitLab declares no fine-grained permission for Namespace, which the answer is made of

job

Action	Needs	Served empty
job.artifacts	Job Artifact: Read at project
job.cancel	Job: Update at project
job.delete_artifacts	Job Artifact: Delete at project
job.delete_project_artifacts	Artifact: Delete at project
job.download_artifacts	Job Artifact: Read at project
job.download_single_artifact	Job Artifact: Read at project
job.download_single_artifact_by_ref	Job Artifact: Read at project
job.erase	Job: Delete at project
job.get	Job: Read at project
job.keep_artifacts	Job Artifact: Update at project
job.list	Pipeline: Read at project
job.list_bridges	Pipeline: Read at project
job.list_project	Job: Read at project
job.play	Job: Run at project
job.retry	Job: Run at project
job.token_scope_add_group	Job Token Scope Allowlist: Create at project
job.token_scope_add_project	Job Token Scope Allowlist: Create at project
job.token_scope_get	Job Token Scope: Read at project
job.token_scope_list_groups	Job Token Scope Allowlist: Read at project
job.token_scope_list_inbound	Job Token Scope Allowlist: Read at project
job.token_scope_patch	Job Token Scope: Update at project
job.token_scope_remove_group	Job Token Scope Allowlist: Delete at project
job.token_scope_remove_project	Job Token Scope Allowlist: Delete at project
job.trace	Job: Read at project
job.wait	Job: Read at project

member_role

Action	Needs	Served empty
member_role.create_group	Member Role: Create at group
member_role.create_instance	Member Role: Create at instance
member_role.delete_group	Member Role: Delete at group
member_role.delete_instance	Member Role: Delete at instance
member_role.list_group	Member Role: Read at group
member_role.list_instance	Member Role: Read at instance

merge_request

Action	Needs	Served empty
merge_request.approval_config	Merge Request: Read at project
merge_request.approval_reset	Merge Request: Approve at project
merge_request.approval_rule_create	Merge Request Approval Rule: Create at project
merge_request.approval_rule_delete	Merge Request Approval Rule: Delete at project
merge_request.approval_rule_update	Merge Request Approval Rule: Update at project
merge_request.approval_rules	Merge Request Approval Rule: Read at project
merge_request.approval_settings_group_get	Approval Setting: Read at group
merge_request.approval_settings_group_update	Approval Setting: Update at group
merge_request.approval_settings_project_get	Approval Setting: Read at project
merge_request.approval_settings_project_update	Approval Setting: Update at project
merge_request.approval_state	Merge Request: Read at project
merge_request.approve	Merge Request: Approve at project
merge_request.cancel_auto_merge	Merge Request: Merge at project
merge_request.commits	Merge Request: Read at project
merge_request.context_commits_create	Merge Request: Update at project
merge_request.context_commits_delete	Merge Request: Update at project
merge_request.context_commits_list	Merge Request: Read at project
merge_request.create	Merge Request: Create at project
merge_request.create_pipeline	Merge Request: Update at project
merge_request.create_todo	Todo: Create at project
merge_request.delete	Merge Request: Delete at project
merge_request.dependencies_list	Merge Request: Read at project
merge_request.dependency_create	Merge Request: Create at project
merge_request.dependency_delete	Merge Request: Delete at project
merge_request.emoji_mr_create	Work Item: Create at project
merge_request.emoji_mr_delete	Work Item: Delete at project
merge_request.emoji_mr_get	Work Item: Read at project
merge_request.emoji_mr_list	Work Item: Read at project
merge_request.emoji_mr_note_create	Work Item: Create at project
merge_request.emoji_mr_note_delete	Work Item: Delete at project
merge_request.emoji_mr_note_get	Work Item: Read at project
merge_request.emoji_mr_note_list	Work Item: Read at project
merge_request.event_mr_label_get	Merge Request: Read at project
merge_request.event_mr_label_list	Merge Request: Read at project
merge_request.event_mr_milestone_get	Work Item: Read at project
merge_request.event_mr_milestone_list	Work Item: Read at project
merge_request.event_mr_state_get	Work Item: Read at project
merge_request.event_mr_state_list	Work Item: Read at project
merge_request.get	Merge Request: Read at project
merge_request.issues_closed	Merge Request: Read at project
merge_request.list	Merge Request: Read at project
merge_request.list_global	Merge Request: Read at user
merge_request.list_group	Merge Request: Read at group
merge_request.merge	Merge Request: Merge at project
merge_request.participants	Merge Request: Read at project
merge_request.pipelines	Merge Request: Read at project
merge_request.rebase	Merge Request: Update at project
merge_request.related_issues	Merge Request: Read at project
merge_request.reviewers	Merge Request: Read at project
merge_request.spent_time_add	Work Item: Update at project
merge_request.spent_time_reset	Work Item: Update at project
merge_request.subscribe	Merge Request: Subscribe at project
merge_request.time_estimate_reset	Work Item: Update at project
merge_request.time_estimate_set	Work Item: Update at project
merge_request.time_stats	Work Item: Read at project
merge_request.unapprove	Merge Request: Approve at project
merge_request.unsubscribe	Merge Request: Subscribe at project
merge_request.update	Merge Request: Update at project

merge_train

Action	Needs	Served empty
merge_train.add	Merge Train Merge Request: Add at project
merge_train.get	Merge Train: Read at project
merge_train.list_branch	Merge Train: Read at project
merge_train.list_project	Merge Train: Read at project

model_registry

Action	Needs	Served empty
model_registry.download	Model Version: Read at project

mr_review

Action	Needs	Served empty
mr_review.changes_get	Merge Request: Read at project
mr_review.diff_version_get	Merge Request: Read at project
mr_review.diff_versions_list	Merge Request: Read at project
mr_review.discussion_create	Merge Request: Create at project
mr_review.discussion_get	Merge Request: Read at project
mr_review.discussion_list	Merge Request: Read at project
mr_review.discussion_note_delete	Merge Request: Delete at project
mr_review.discussion_note_update	Merge Request: Update at project
mr_review.discussion_reply	Merge Request: Create at project
mr_review.discussion_resolve	Merge Request: Update at project
mr_review.draft_note_create	Merge Request: Update at project
mr_review.draft_note_delete	Merge Request: Update at project
mr_review.draft_note_get	Merge Request: Read at project
mr_review.draft_note_list	Merge Request: Read at project
mr_review.draft_note_publish	Merge Request: Update at project
mr_review.draft_note_publish_all	Merge Request: Update at project
mr_review.draft_note_update	Merge Request: Update at project
mr_review.note_create	Work Item: Create at project
mr_review.note_delete	Work Item: Delete at project
mr_review.note_get	Work Item: Read at project
mr_review.note_list	Work Item: Read at project
mr_review.note_update	Work Item: Update at project
mr_review.raw_diffs	Merge Request: Read at project

orbit

Action	Needs	Served empty
orbit.dsl	Knowledge Graph: Read at user
orbit.graph_status	Knowledge Graph: Read at user
orbit.query	Knowledge Graph: Read at user
orbit.schema	Knowledge Graph: Read at user
orbit.status	Knowledge Graph: Read at user
orbit.tools	Knowledge Graph: Read at user

package

Action	Needs	Served empty
package.delete	Package: Delete at project
package.download	Package: Read at project
package.file_delete	Package: Delete at project
package.file_list	Package: Read at project
package.get	Package: Read at project
package.group_list	Package: Read at group
package.list	Package: Read at project
package.protection_rule_create	Package: Create at project
package.protection_rule_delete	Package: Delete at project
package.protection_rule_list	Package: Read at project
package.protection_rule_update	Package: Update at project
package.publish	Package: Create at project
package.publish_and_link	Package: Create at project; Release Link: Create at project
package.publish_directory	Package: Create at project
package.registry_delete	Container Repository: Delete at project
package.registry_get	Container Repository: Read at project
package.registry_list_group	Container Repository: Read at group
package.registry_list_project	Container Repository: Read at project
package.registry_rule_create	Container Repository Protection Rule: Create at project
package.registry_rule_delete	Container Repository Protection Rule: Delete at project
package.registry_rule_list	Container Repository Protection Rule: Read at project
package.registry_rule_update	Container Repository Protection Rule: Update at project
package.registry_tag_delete	Container Repository: Delete at project
package.registry_tag_delete_bulk	Container Repository: Delete at project
package.registry_tag_get	Container Repository: Read at project
package.registry_tag_list	Container Repository: Read at project
package.registry_tag_rule_create	Container Registry Protection Tag Rule: Create at project
package.registry_tag_rule_delete	Container Registry Protection Tag Rule: Delete at project
package.registry_tag_rule_list	Container Registry Protection Tag Rule: Read at project
package.registry_tag_rule_update	Container Registry Protection Tag Rule: Update at project

pipeline

Action	Needs	Served empty
pipeline.cancel	Pipeline: Update at project
pipeline.create	Pipeline: Create at project
pipeline.delete	Pipeline: Delete at project
pipeline.get	Pipeline: Read at project
pipeline.latest	Pipeline: Read at project
pipeline.list	Pipeline: Read at project
pipeline.resource_group_edit	Resource Group: Update at project
pipeline.resource_group_get	Resource Group: Read at project
pipeline.resource_group_list	Resource Group: Read at project
pipeline.resource_group_upcoming_jobs	Job: Read, Resource Group: Read at project
pipeline.retry	Pipeline: Update at project
pipeline.schedule_create	Pipeline Schedule: Create at project
pipeline.schedule_create_variable	Pipeline Schedule: Update at project
pipeline.schedule_delete	Pipeline Schedule: Delete at project
pipeline.schedule_delete_variable	Pipeline Schedule: Update at project
pipeline.schedule_edit_variable	Pipeline Schedule: Update at project
pipeline.schedule_get	Pipeline Schedule: Read at project
pipeline.schedule_list	Pipeline Schedule: Read at project
pipeline.schedule_list_triggered_pipelines	Pipeline: Read, Pipeline Schedule: Read at project
pipeline.schedule_run	Pipeline Schedule: Read at project; Pipeline Schedule: Update at project
pipeline.schedule_take_ownership	Pipeline Schedule: Update at project
pipeline.schedule_update	Pipeline Schedule: Update at project
pipeline.test_report	Pipeline: Read at project
pipeline.test_report_summary	Pipeline: Read at project
pipeline.trigger_create	Trigger: Create at project
pipeline.trigger_delete	Trigger: Delete at project
pipeline.trigger_get	Trigger: Read at project
pipeline.trigger_list	Trigger: Read at project
pipeline.trigger_run	a request GitLab does not judge by the grant
pipeline.trigger_update	Trigger: Update at project
pipeline.update_metadata	Pipeline: Update at project
pipeline.variables	Pipeline: Read at project
pipeline.wait	Pipeline: Read at project

project

Action	Needs	Served empty
project.approval_config_change	Approval Configuration: Update at project
project.approval_config_get	Approval Configuration: Read at project
project.approval_rule_create	Approval Rule: Create at project
project.approval_rule_delete	Approval Rule: Delete at project
project.approval_rule_get	Approval Rule: Read at project
project.approval_rule_list	Approval Rule: Read at project
project.approval_rule_update	Approval Rule: Update at project
project.archive	Project: Archive at project
project.badge_add	Badge: Create at project
project.badge_delete	Badge: Delete at project
project.badge_edit	Badge: Update at project
project.badge_get	Badge: Read at project
project.badge_list	Badge: Read at project
project.badge_preview	Badge: Read at project
project.board_create	Work Item: Create at project
project.board_delete	Work Item: Delete at project
project.board_get	Work Item: Read at project
project.board_list	Work Item: Read at project
project.board_list_create	Work Item: Create at project
project.board_list_delete	Work Item: Delete at project
project.board_list_get	Work Item: Read at project
project.board_list_list	Work Item: Read at project
project.board_list_update	Work Item: Update at project
project.board_update	Work Item: Update at project
project.create	Project: Create at user
project.create_for_user	Project: Create at user
project.create_fork_relation	Project: Fork at project
project.delete	Project: Delete at project
project.delete_fork_relation	Project: Fork at project
project.delete_shared_group	Project: Share at project
project.dependency_firewall_evaluate	Dependency Firewall Evaluation: Create at project
project.download_avatar	Avatar: Read at project
project.export_download	Export: Download at project
project.export_schedule	Export: Create at project
project.export_status	Export: Read at project
project.fork	Project: Fork at project
project.get	Project: Read at project
project.hook_add	Webhook: Create at project
project.hook_delete	Webhook: Delete at project
project.hook_delete_custom_header	Webhook: Update at project
project.hook_delete_url_variable	Webhook: Update at project
project.hook_edit	Webhook: Update at project
project.hook_get	Webhook: Read at project
project.hook_list	Webhook: Read at project
project.hook_set_custom_header	Webhook: Update at project
project.hook_set_url_variable	Webhook: Update at project
project.hook_test	Webhook: Trigger at project
project.import_from_file	Import: Create at group or user
project.import_status	Import: Read at project
project.integration_delete	Integration: Delete at project or group
project.integration_delete_group	Integration: Delete at project or group
project.integration_delete_group_datadog	Integration: Delete at project or group
project.integration_get	Integration: Read at project or group
project.integration_get_group	Integration: Read at project or group
project.integration_get_group_datadog	Integration: Read at project or group
project.integration_list	Integration: Read at project or group
project.integration_list_group	Integration: Read at project or group
project.integration_set	Integration: Update at project or group
project.integration_set_group	Integration: Update at project or group
project.integration_set_group_datadog	Integration: Update at project or group
project.integration_set_jira	Integration: Update at project or group
project.label_create	Label: Create at project
project.label_delete	Label: Delete at project
project.label_get	Label: Read at project
project.label_list	Label: Read at project
project.label_promote	Label: Promote at project
project.label_subscribe	Label: Subscribe at project
project.label_unsubscribe	Label: Subscribe at project
project.label_update	Label: Update at project
project.languages	Project: Read at project
project.list	Project: Read at user
project.list_forks	Project: Read at project
project.list_groups	Project: Read at project
project.list_invited_groups	Project: Read at project
project.list_starrers	Project: Read at project
project.list_user_contributed	Project: Read at user
project.list_user_projects	Project: Read at user
project.list_user_starred	Project: Read at user
project.list_users	Project: Read at project
project.member_add	Member: Create at project
project.member_delete	Member: Delete at project
project.member_edit	Member: Update at project
project.member_get	Member: Read at project
project.member_inherited	Member: Read at project
project.members	Member: Read at project
project.milestone_create	Work Item: Create at project
project.milestone_delete	Work Item: Read at project; Work Item: Delete at project
project.milestone_get	Work Item: Read at project
project.milestone_issues	Work Item: Read at project
project.milestone_list	Work Item: Read at project
project.milestone_merge_requests	Work Item: Read at project
project.milestone_update	Work Item: Read at project; Work Item: Update at project
project.mirror_add	Remote Mirror: Create at project
project.mirror_delete	Remote Mirror: Delete at project
project.mirror_edit	Remote Mirror: Update at project
project.mirror_force_push	Remote Mirror: Update at project
project.mirror_get	Remote Mirror: Read at project
project.mirror_get_public_key	Remote Mirror Public Key: Read at project
project.mirror_list	Remote Mirror: Read at project
project.pages_domain_create	Pages Domain: Create at project
project.pages_domain_delete	Pages Domain: Delete at project
project.pages_domain_get	Pages Domain: Read at project
project.pages_domain_list	Pages Domain: Read at project
project.pages_domain_list_all	Pages Domain: Read at instance
project.pages_domain_update	Pages Domain: Update at project
project.pages_get	Page: Read at project
project.pages_unpublish	Page: Delete at project
project.pages_update	Page: Update at project
project.pull_mirror_configure	Pull Mirror: Update at project
project.pull_mirror_get	Pull Mirror: Read at project
project.push_rule_add	Push Rule: Create at project
project.push_rule_delete	Push Rule: Delete at project
project.push_rule_edit	Push Rule: Update at project
project.push_rule_get	Push Rule: Read at project
project.repository_storage_get	Project: Read at project
project.restore	Project: Update at project
project.security_settings_get	Security Setting: Read at project
project.security_settings_update	Security Setting: Update at project
project.service_account_create	Service Account: Create at project
project.service_account_delete	Service Account: Delete at project
project.service_account_get	Service Account: Read at project
project.service_account_list	Service Account: Read at project
project.service_account_pat_create	Service Account Personal Access Token: Create at project
project.service_account_pat_list	Service Account Personal Access Token: Read at project
project.service_account_pat_revoke	Service Account Personal Access Token: Revoke at project
project.service_account_pat_rotate	Service Account Personal Access Token: Rotate at project
project.service_account_update	Service Account: Update at project
project.share_with_group	Project: Share at project
project.star	Project: Update at project
project.start_housekeeping	Project: Update at project
project.start_mirroring	Pull Mirror: Create at project
project.statistics_get	Statistic: Read at project
project.target_branch_rule_create	Not reachable at this release: GitLab declares no fine-grained permission for ProjectTargetBranchRule in the answer, so the write commits and its answer is lost
project.target_branch_rule_delete	Target Branch Rule: Delete at project
project.target_branch_rule_list	Not reachable at this release: GitLab declares no fine-grained permission for ProjectTargetBranchRule, which the answer is made of
project.transfer	Project: Transfer at project
project.unarchive	Project: Archive at project
project.unstar	Project: Update at project
project.update	Project: Update at project
project.upload	Markdown Upload: Create at project
project.upload_avatar	Project: Update at project
project.upload_delete	Markdown Upload: Delete at project
project.upload_delete_by_secret	Markdown Upload: Delete at project
project.upload_list	Markdown Upload: Read at project

project_alias

Action	Needs	Served empty
project_alias.create	Alias: Create at instance
project_alias.delete	Alias: Delete at instance
project_alias.get	Alias: Read at instance
project_alias.list	Alias: Read at instance

release

Action	Needs	Served empty
release.create	Release: Create at project
release.delete	Release: Delete at project
release.get	Release: Read at project
release.get_latest	Release: Read at project
release.link_create	Release Link: Create at project
release.link_create_batch	Release Link: Create at project
release.link_delete	Release Link: Delete at project
release.link_get	Release Link: Read at project
release.link_list	Release Link: Read at project
release.link_update	Release Link: Update at project
release.list	Release: Read at project
release.update	Release: Update at project

repository

Action	Needs	Served empty
repository.archive	no permission
repository.blob	Repository: Read at project
repository.changelog_add	Repository: Create at project
repository.changelog_generate	Repository: Read at project
repository.commit_cherry_pick	Commit: Create at project
repository.commit_comment_create	Commit: Update at project
repository.commit_comments	Commit: Read at project
repository.commit_create	Commit: Create at project
repository.commit_diff	Commit: Read at project
repository.commit_discussion_add_note	Commit: Create at project
repository.commit_discussion_create	Commit: Create at project
repository.commit_discussion_delete_note	Commit: Delete at project
repository.commit_discussion_get	Commit: Read at project
repository.commit_discussion_list	Commit: Read at project
repository.commit_discussion_update_note	Commit: Update at project
repository.commit_get	Commit: Read at project
repository.commit_list	Commit: Read at project
repository.commit_merge_requests	Commit: Read at project
repository.commit_refs	Commit: Read at project
repository.commit_revert	Commit: Create at project
repository.commit_signature	Commit: Read at project
repository.commit_status_set	Commit Status: Create at project
repository.commit_statuses	Commit: Read at project
repository.compare	Repository: Read at project
repository.contributors	Repository: Read at project
repository.file_blame	Repository: Read at project
repository.file_create	Repository: Create at project
repository.file_delete	Repository: Delete at project
repository.file_get	Repository: Read at project
repository.file_history	Commit: Read at project
repository.file_metadata	Repository: Read at project
repository.file_raw	Repository: Read at project
repository.file_raw_metadata	Repository: Read at project
repository.file_update	Repository: Update at project
repository.list_submodules	Repository: Read at project
repository.markdown_render	Markdown: Render at project or user
repository.merge_base	Repository: Read at project
repository.raw_blob	Repository: Read at project
repository.read_submodule_file	Repository: Read at project
repository.tree	Repository: Read at project
repository.update_submodule	Repository Submodule: Update at project

runner

Action	Needs	Served empty
runner.controller_create	Runner Controller: Create at instance
runner.controller_delete	Runner Controller: Delete at instance
runner.controller_get	Runner Controller: Read at instance
runner.controller_list	Runner Controller: Read at instance
runner.controller_scope_add_instance	Runner Controller: Update at instance
runner.controller_scope_add_runner	Runner Controller: Update at instance
runner.controller_scope_list	Runner Controller: Read at instance
runner.controller_scope_remove_instance	Runner Controller: Update at instance
runner.controller_scope_remove_runner	Runner Controller: Update at instance
runner.controller_token_create	Runner Controller Token: Create at instance
runner.controller_token_get	Runner Controller Token: Read at instance
runner.controller_token_list	Runner Controller Token: Read at instance
runner.controller_token_revoke	Runner Controller Token: Revoke at instance
runner.controller_token_rotate	Runner Controller Token: Rotate at instance
runner.controller_update	Runner Controller: Update at instance
runner.delete_by_token	a request GitLab does not judge by the grant
runner.delete_registered	Runner: Delete at project or group or instance
runner.disable_project	Runner: Assign at project
runner.enable_project	Runner: Assign at project
runner.get	Runner: Read at project or group or instance
runner.jobs	Runner: Read at project or group or instance
runner.list	Runner: Read at user
runner.list_all	Runner: Read at instance
runner.list_group	Runner: Read at group
runner.list_managers	Runner: Read at project or group or instance
runner.list_project	Runner: Read at project
runner.register	a request GitLab does not judge by the grant
runner.remove	Runner: Delete at project or group or instance
runner.reset_group_reg_token	Runner Registration Token: Reset at group
runner.reset_instance_reg_token	Runner Registration Token: Reset at instance
runner.reset_project_reg_token	Runner Registration Token: Reset at project
runner.reset_token	Runner: Update at project or group or instance
runner.update	Runner: Update at project or group or instance
runner.verify	a request GitLab does not judge by the grant

search

Action	Needs	Served empty
search.code	one of: Global Search: Use at project or Global Search: Use at group or Global Search: Use at user
search.commits	one of: Global Search: Use at project or Global Search: Use at group or Global Search: Use at user
search.issues	one of: Global Search: Use at project or Global Search: Use at group or Global Search: Use at user
search.merge_requests	one of: Global Search: Use at project or Global Search: Use at group or Global Search: Use at user
search.milestones	one of: Global Search: Use at project or Global Search: Use at group or Global Search: Use at user
search.notes	Global Search: Use at project
search.projects	one of: Global Search: Use at group or Global Search: Use at user
search.snippets	Global Search: Use at user
search.users	one of: Global Search: Use at project or Global Search: Use at group or Global Search: Use at user
search.wiki	one of: Global Search: Use at project or Global Search: Use at group or Global Search: Use at user

security_attribute

Action	Needs	Served empty
security_attribute.bulk_update	Not reachable at this release: GitLab declares no fine-grained permission for the mutation bulkUpdateSecurityAttributes, and refuses it
security_attribute.create	Not reachable at this release: GitLab declares no fine-grained permission for SecurityAttribute in the answer, so the write commits and its answer is lost
security_attribute.delete	Security Attribute: Delete at group
security_attribute.project_update	Security Attribute: Update at project
security_attribute.update	Not reachable at this release: GitLab declares no fine-grained permission for SecurityAttribute in the answer, so the write commits and its answer is lost

security_category

Action	Needs	Served empty
security_category.create	Not reachable at this release: GitLab declares no fine-grained permission for SecurityCategory in the answer, so the write commits and its answer is lost
security_category.delete	Security Attribute: Delete at group
security_category.update	Not reachable at this release: GitLab declares no fine-grained permission for SecurityCategory in the answer, so the write commits and its answer is lost

security_finding

Action	Needs	Served empty
security_finding.list	Not reachable at this release: GitLab declares no fine-grained permission for PipelineSecurityReportFinding, which the answer is made of

security_scan_profile

Action	Needs	Served empty
security_scan_profile.attach	Not reachable at this release: GitLab declares no fine-grained permission for the mutation securityScanProfileAttach, and refuses it
security_scan_profile.detach	Not reachable at this release: GitLab declares no fine-grained permission for the mutation securityScanProfileDetach, and refuses it
security_scan_profile.list_project_statuses	Not reachable at this release: GitLab declares no fine-grained permission for ScanProfileProjectStatus, which the answer is made of

server

Action	Needs	Served empty
server.health_check	Metadata: Read at instance
server.status	Metadata: Read at instance

snippet

Action	Needs	Served empty
snippet.content	Snippet: Read at user
snippet.create	Snippet: Create at user
snippet.delete	Snippet: Delete at user
snippet.discussion_add_note	Work Item: Create at project
snippet.discussion_create	Work Item: Create at project
snippet.discussion_delete_note	Work Item: Delete at project
snippet.discussion_get	Work Item: Read at project
snippet.discussion_list	Work Item: Read at project
snippet.discussion_update_note	Work Item: Update at project
snippet.emoji_snippet_create	Work Item: Create at project
snippet.emoji_snippet_delete	Work Item: Delete at project
snippet.emoji_snippet_get	Work Item: Read at project
snippet.emoji_snippet_list	Work Item: Read at project
snippet.emoji_snippet_note_create	Work Item: Create at project
snippet.emoji_snippet_note_delete	Work Item: Delete at project
snippet.emoji_snippet_note_get	Work Item: Read at project
snippet.emoji_snippet_note_list	Work Item: Read at project
snippet.explore	Snippet: Read at user
snippet.file_content	Snippet: Read at user
snippet.get	Snippet: Read at user
snippet.list	Snippet: Read at user
snippet.list_all	Snippet: Read at user
snippet.note_create	Work Item: Create at project
snippet.note_delete	Work Item: Delete at project
snippet.note_get	Work Item: Read at project
snippet.note_list	Work Item: Read at project
snippet.note_update	Work Item: Update at project
snippet.project_content	Snippet: Read at project
snippet.project_create	Snippet: Create at project
snippet.project_delete	Snippet: Delete at project
snippet.project_get	Snippet: Read at project
snippet.project_list	Snippet: Read at project
snippet.project_update	Snippet: Update at project
snippet.update	Snippet: Update at user

storage_move

Action	Needs	Served empty
storage_move.get_group	Repository Storage Move: Read at instance
storage_move.get_group_for_group	Repository Storage Move: Read at group
storage_move.get_project	Repository Storage Move: Read at instance
storage_move.get_project_for_project	Repository Storage Move: Read at project
storage_move.get_snippet	Repository Storage Move: Read at instance
storage_move.get_snippet_for_snippet	Repository Storage Move: Read at instance
storage_move.retrieve_all_group	Repository Storage Move: Read at instance
storage_move.retrieve_all_project	Repository Storage Move: Read at instance
storage_move.retrieve_all_snippet	Repository Storage Move: Read at instance
storage_move.retrieve_group	Repository Storage Move: Read at group
storage_move.retrieve_project	Repository Storage Move: Read at project
storage_move.retrieve_snippet	Repository Storage Move: Read at instance
storage_move.schedule_all_group	Repository Storage Move: Create at instance
storage_move.schedule_all_project	Repository Storage Move: Create at instance
storage_move.schedule_all_snippet	Repository Storage Move: Create at instance
storage_move.schedule_group	Repository Storage Move: Create at group
storage_move.schedule_project	Repository Storage Move: Create at project
storage_move.schedule_snippet	Repository Storage Move: Create at instance

tag

Action	Needs	Served empty
tag.create	Repository Tag: Create at project
tag.delete	Repository Tag: Delete at project
tag.get	Repository Tag: Read at project
tag.get_protected	Protected Tag: Read at project
tag.get_signature	Repository Tag: Read at project
tag.list	Repository Tag: Read at project
tag.list_protected	Protected Tag: Read at project
tag.protect	Tag: Protect at project
tag.unprotect	Tag: Protect at project

template

Action	Needs	Served empty
template.ci_yml_get	a request GitLab does not judge by the grant
template.ci_yml_list	a request GitLab does not judge by the grant
template.dockerfile_get	a request GitLab does not judge by the grant
template.dockerfile_list	a request GitLab does not judge by the grant
template.gitignore_get	a request GitLab does not judge by the grant
template.gitignore_list	a request GitLab does not judge by the grant
template.license_get	a request GitLab does not judge by the grant
template.license_list	a request GitLab does not judge by the grant
template.lint	CI Config: Validate at project
template.lint_project	CI Config: Read at project
template.project_template_get	Template: Read at project
template.project_template_list	Template: Read at project

user

Action	Needs	Served empty
user.activate	User: Activate at instance
user.activities	Activity: Read at user
user.add_email	Email: Create at user
user.add_email_for_user	Email: Create at instance
user.add_gpg_key	GPG Key: Create at user
user.add_gpg_key_for_user	GPG Key: Create at instance
user.add_ssh_key	SSH Key: Create at user
user.add_ssh_key_for_user	SSH Key: Create at instance
user.approve	User: Approve at instance
user.associations_count	Association: Read at user
user.avatar_get	Avatar: Read at user
user.ban	User: Ban at instance
user.block	User: Block at instance
user.contribution_events	Event: Read at user
user.create	User: Create at instance
user.create_current_user_pat	Personal Access Token: Create at user
user.create_impersonation_token	Impersonation Token: Create at instance
user.create_personal_access_token	Personal Access Token: Create at instance
user.create_runner	Runner: Create at user
user.create_service_account	Service Account: Create at instance
user.current	User: Read at user
user.current_user_status	Status: Read at user
user.deactivate	User: Deactivate at instance
user.delete	User: Delete at instance
user.delete_email	Email: Delete at user
user.delete_email_for_user	Email: Delete at instance
user.delete_gpg_key	GPG Key: Delete at user
user.delete_gpg_key_for_user	GPG Key: Delete at instance
user.delete_identity	Identity: Delete at instance
user.delete_ssh_key	SSH Key: Delete at user
user.delete_ssh_key_for_user	SSH Key: Delete at instance
user.disable_two_factor	User: Disable Two Factor at instance
user.emails	Email: Read at user
user.emails_for_user	Email: Read at instance
user.event_list_contributions	Event: Read at user
user.event_list_project	Event: Read at project
user.get	User: Read at user
user.get_email	Email: Read at user
user.get_gpg_key	GPG Key: Read at user
user.get_gpg_key_for_user	GPG Key: Read at user
user.get_impersonation_token	Impersonation Token: Read at instance
user.get_ssh_key	SSH Key: Read at user
user.get_ssh_key_for_user	SSH Key: Read at user
user.get_status	Status: Read at user
user.gpg_keys	GPG Key: Read at user
user.gpg_keys_for_user	GPG Key: Read at user
user.key_get_by_fingerprint	SSH Key: Read at instance
user.key_get_with_user	SSH Key: Read at instance
user.list	User: Read at instance
user.list_impersonation_tokens	Impersonation Token: Read at instance
user.list_service_accounts	Service Account: Read at instance
user.me	User: Read at user
user.memberships	User: Read at instance
user.modify	User: Update at instance
user.namespace_exists	Namespace: Read at user
user.namespace_get	Namespace: Read at user
user.namespace_list	Namespace: Read at user
user.namespace_search	Namespace: Read at user
user.notification_global_get	Notification Setting: Read at user
user.notification_global_update	Notification Setting: Update at user
user.notification_group_get	Notification Setting: Read at user
user.notification_group_update	Notification Setting: Update at user
user.notification_project_get	Notification Setting: Read at user
user.notification_project_update	Notification Setting: Update at user
user.reject	User: Reject at instance
user.revoke_impersonation_token	Impersonation Token: Revoke at instance
user.set_status	Status: Update at user
user.ssh_keys	SSH Key: Read at user
user.ssh_keys_for_user	SSH Key: Read at user
user.todo_list	Todo: Read at user
user.todo_mark_all_done	Todo: Update at user
user.todo_mark_done	Todo: Update at user
user.unban	User: Unban at instance
user.unblock	User: Unblock at instance
user.update_service_account	Service Account: Update at instance
user.upload_avatar	Avatar: Update at user

vulnerability

Action	Needs	Served empty
vulnerability.confirm	Vulnerability: Update at project; Vulnerability: Read at project	vulnerabilityConfirm { vulnerability { findingTokenStatus } } (always), vulnerabilityConfirm { vulnerability { location { kubernetesResource } } } (always), vulnerabilityConfirm { vulnerability { issueLinks { nodes } } } (always), vulnerabilityConfirm { vulnerability { dismissedBy } } (without User: Read at user), vulnerabilityConfirm { vulnerability { resolvedBy } } (without User: Read at user), vulnerabilityConfirm { vulnerability { confirmedBy } } (without User: Read at user), vulnerabilityConfirm { vulnerability { scanner } } (without Vulnerability: Read at project), vulnerabilityConfirm { vulnerability { location { kubernetesResource { agent } } } } (without Cluster Agent: Read at project), vulnerabilityConfirm { vulnerability { project } } (without Project: Read at project), vulnerabilityConfirm { vulnerability { issueLinks { nodes { issue } } } } (without Work Item: Read at project), vulnerabilityConfirm { vulnerability { mergeRequest } } (without Merge Request: Read at project)
vulnerability.dismiss	Vulnerability: Update at project; Vulnerability: Read at project	vulnerabilityDismiss { vulnerability { findingTokenStatus } } (always), vulnerabilityDismiss { vulnerability { location { kubernetesResource } } } (always), vulnerabilityDismiss { vulnerability { issueLinks { nodes } } } (always), vulnerabilityDismiss { vulnerability { dismissedBy } } (without User: Read at user), vulnerabilityDismiss { vulnerability { resolvedBy } } (without User: Read at user), vulnerabilityDismiss { vulnerability { confirmedBy } } (without User: Read at user), vulnerabilityDismiss { vulnerability { scanner } } (without Vulnerability: Read at project), vulnerabilityDismiss { vulnerability { location { kubernetesResource { agent } } } } (without Cluster Agent: Read at project), vulnerabilityDismiss { vulnerability { project } } (without Project: Read at project), vulnerabilityDismiss { vulnerability { issueLinks { nodes { issue } } } } (without Work Item: Read at project), vulnerabilityDismiss { vulnerability { mergeRequest } } (without Merge Request: Read at project)
vulnerability.get	Vulnerability: Read at project	vulnerability { findingTokenStatus } (always), vulnerability { location { kubernetesResource } } (always), vulnerability { issueLinks { nodes } } (always), vulnerability { dismissedBy } (without User: Read at user), vulnerability { resolvedBy } (without User: Read at user), vulnerability { confirmedBy } (without User: Read at user), vulnerability { scanner } (without Vulnerability: Read at project), vulnerability { location { kubernetesResource { agent } } } (without Cluster Agent: Read at project), vulnerability { project } (without Project: Read at project), vulnerability { issueLinks { nodes { issue } } } (without Work Item: Read at project), vulnerability { mergeRequest } (without Merge Request: Read at project)
vulnerability.list	Project: Read at project; Vulnerability: Read at project	project { vulnerabilities { nodes { findingTokenStatus } } } (always), project { vulnerabilities { nodes { location { kubernetesResource } } } } (always), project { vulnerabilities { nodes { issueLinks { nodes } } } } (always), project { vulnerabilities { nodes { dismissedBy } } } (without User: Read at user), project { vulnerabilities { nodes { resolvedBy } } } (without User: Read at user), project { vulnerabilities { nodes { confirmedBy } } } (without User: Read at user), project { vulnerabilities { nodes { scanner } } } (without Vulnerability: Read at project), project { vulnerabilities { nodes { location { kubernetesResource { agent } } } } } (without Cluster Agent: Read at project), project { vulnerabilities { nodes { project } } } (without Project: Read at project), project { vulnerabilities { nodes { issueLinks { nodes { issue } } } } } (without Work Item: Read at project), project { vulnerabilities { nodes { mergeRequest } } } (without Merge Request: Read at project)
vulnerability.pipeline_security_summary	Not reachable at this release: GitLab declares no fine-grained permission for SecurityReportSummary, which the answer is made of
vulnerability.resolve	Vulnerability: Update at project; Vulnerability: Read at project	vulnerabilityResolve { vulnerability { findingTokenStatus } } (always), vulnerabilityResolve { vulnerability { location { kubernetesResource } } } (always), vulnerabilityResolve { vulnerability { issueLinks { nodes } } } (always), vulnerabilityResolve { vulnerability { dismissedBy } } (without User: Read at user), vulnerabilityResolve { vulnerability { resolvedBy } } (without User: Read at user), vulnerabilityResolve { vulnerability { confirmedBy } } (without User: Read at user), vulnerabilityResolve { vulnerability { scanner } } (without Vulnerability: Read at project), vulnerabilityResolve { vulnerability { location { kubernetesResource { agent } } } } (without Cluster Agent: Read at project), vulnerabilityResolve { vulnerability { project } } (without Project: Read at project), vulnerabilityResolve { vulnerability { issueLinks { nodes { issue } } } } (without Work Item: Read at project), vulnerabilityResolve { vulnerability { mergeRequest } } (without Merge Request: Read at project)
vulnerability.revert	Vulnerability: Update at project; Vulnerability: Read at project	vulnerabilityRevertToDetected { vulnerability { findingTokenStatus } } (always), vulnerabilityRevertToDetected { vulnerability { location { kubernetesResource } } } (always), vulnerabilityRevertToDetected { vulnerability { issueLinks { nodes } } } (always), vulnerabilityRevertToDetected { vulnerability { dismissedBy } } (without User: Read at user), vulnerabilityRevertToDetected { vulnerability { resolvedBy } } (without User: Read at user), vulnerabilityRevertToDetected { vulnerability { confirmedBy } } (without User: Read at user), vulnerabilityRevertToDetected { vulnerability { scanner } } (without Vulnerability: Read at project), vulnerabilityRevertToDetected { vulnerability { location { kubernetesResource { agent } } } } (without Cluster Agent: Read at project), vulnerabilityRevertToDetected { vulnerability { project } } (without Project: Read at project), vulnerabilityRevertToDetected { vulnerability { issueLinks { nodes { issue } } } } (without Work Item: Read at project), vulnerabilityRevertToDetected { vulnerability { mergeRequest } } (without Merge Request: Read at project)
vulnerability.severity_count	Not reachable at this release: GitLab declares no fine-grained permission for VulnerabilitySeveritiesCount, which the answer is made of

wiki

Action	Needs	Served empty
wiki.create	Wiki: Create at project
wiki.delete	Wiki: Delete at project
wiki.get	Wiki: Read at project
wiki.list	Wiki: Read at project
wiki.update	Wiki: Update at project
wiki.upload_attachment	Wiki: Update at project