--- title: Actions reference description: Every action you can allow in a policy for identity and access, the API calls that check it, and the product actions in managed policies. url: https://hexelstudio.com/docs/identity/actions --- An action is named `::`. Put action names, or patterns, in the `Action` field of a policy statement. See [Policies](https://hexelstudio.com/docs/identity/policies) for the document language. ## Wildcards | Pattern | Matches | | --- | --- | | `*` | Every action | | `org:*`, `iam:*`, `workspace:*` | Every action of that service | | `iam:policy:*` | Every action on that resource | | An exact name | That action only | Only a trailing `*` is a wildcard, and names are case-sensitive. `iam:*:read` does not match `iam:policy:read`. Calls marked "any member" in the tables below check no action: any member or service user of the organization can make them with a valid token. ## Organization (`org:`) | Action | Allows | Checked by | | --- | --- | --- | | `org:org:read` | Read the organization, its members and the export | `GET /v1/organizations`, `GET /v1/organizations/`, `GET .../members`, `GET .../members/enriched`, `GET .../members/check`, `GET .../export`, `GET .../provisioning` | | `org:org:update` | Change the organization's details | `PATCH /v1/organizations/`, `POST .../provisioning/retry` | | `org:org:delete` | Delete or restore the organization | `DELETE /v1/organizations/`, `POST .../restore` | | `org:member:invite` | Add members, and create, list, revoke and resend invitations | `POST .../members`, `POST` and `GET .../invitations`, `POST .../invitations//revoke`, `POST .../invitations//resend` | | `org:member:manage` | Remove members and change their member role | `DELETE .../members/`, `PATCH .../members/` | | `org:settings:read` | Read organization settings | `GET .../settings` | | `org:settings:write` | Change organization settings | `PATCH .../settings` | | `org:audit:read` | Read the organization's audit log | `GET .../audit-logs` | The person who created the organization can read and retry its provisioning status without `org:org:read` or `org:org:update`. Creating an organization, listing your own organizations (`GET /v1/organizations/by-user`) and accepting an invitation check no action. Member roles also limit who can add or change which members; see [Members](https://hexelstudio.com/docs/identity/members). ## Workspaces (`workspace:`) | Action | Allows | Checked by | | --- | --- | --- | | `workspace:workspace:create` | Create workspaces | `POST /v1/workspaces`. Checked at organization level only: a grant placed on a workspace does not count. | | `workspace:workspace:read` | List and read workspaces | `GET /v1/workspaces`, `GET /v1/workspaces/default`, `GET /v1/workspaces/` | | `workspace:workspace:update` | Change a workspace | `PATCH /v1/workspaces/` | | `workspace:workspace:delete` | Delete a workspace | `DELETE /v1/workspaces/` | | `workspace:member:manage` | List, add and remove workspace members | `GET`, `POST /v1/workspaces//members`, `DELETE .../members/` | Calls on one workspace are checked in that workspace, so grants placed on the workspace count. ## Environments (`env:`) | Action | Allows | Checked by | | --- | --- | --- | | `env:env:create` | Create environments | `POST /v1/environments`, checked in the target workspace | | `env:env:read` | List and read environments | `GET /v1/environments`, `GET /v1/environments/default`, `GET /v1/environments/` | | `env:env:update` | Change an environment | `PATCH /v1/environments/` | | `env:env:delete` | Delete an environment | `DELETE /v1/environments/` | Calls on one environment are checked in that environment and its workspace. ## Service users (`directory:service_account:`) | Action | Allows | Checked by | | --- | --- | --- | | `directory:service_account:create` | Create service users | `POST /v1/service-users` | | `directory:service_account:read` | List and read service users, their API keys, OAuth clients and attached policies | `GET /v1/service-users`, `GET /v1/service-users/`, `GET .../api-keys`, `GET .../oauth-clients`, `GET .../policies` | | `directory:service_account:update` | Change a service user, including disabling it | `PATCH /v1/service-users/` | | `directory:service_account:delete` | Delete a service user | `DELETE /v1/service-users/` | | `directory:service_account:manage_keys` | Create and revoke API keys; create, rotate and revoke OAuth clients | `POST .../api-keys`, `DELETE .../api-keys/`, `POST .../oauth-clients`, `POST .../oauth-clients//rotate`, `DELETE .../oauth-clients/` | Attaching policies to a service user through its own route needs `iam:policy:attach` (below), not a `directory:` action. ## IAM (`iam:`) ### Policies | Action | Allows | Checked by | | --- | --- | --- | | `iam:policy:write` | Create, change and delete policies; create versions; attach and detach any policy to any principal; read role templates | `POST /v1/policies`, `PATCH` and `DELETE /v1/policies/`, `POST .../versions`, `POST .../attachments`, `DELETE .../attachments/`, `GET /v1/role-templates`, `GET /v1/role-templates/` | | `iam:policy:read` | List a policy's versions and attachments | `GET /v1/policies//versions`, `GET /v1/policies//attachments` | | `iam:policy:attach` | Attach and detach policies through a service user's own route | `POST /v1/service-users//policies`, `DELETE /v1/service-users//policies/` | | Any member | List and read policies | `GET /v1/policies`, `GET /v1/policies/` | `iam:policy:attach` is not needed for `POST /v1/policies//attachments`, and `iam:policy:write` is not enough for the service user route. Attaching also requires that you hold the policy's actions; see [Nobody grants what they don't hold](https://hexelstudio.com/docs/identity/policies#nobody-grants-what-they-dont-hold). ### Groups | Action | Allows | Checked by | | --- | --- | --- | | `iam:group:write` | Create, change and delete groups | `POST /v1/groups`, `PATCH` and `DELETE /v1/groups/` | | `iam:group:manage_members` | Add and remove group members | `POST /v1/groups//members`, `DELETE .../members/` | | Any member | List and read groups, members and membership history | `GET /v1/groups`, `GET /v1/groups/`, `GET .../members`, `GET .../audit-logs` | ### Roles | Action | Allows | Checked by | | --- | --- | --- | | `iam:role:write` | Create, change and delete roles; revoke all sessions of a role | `POST /v1/roles`, `PATCH`, `PUT` and `DELETE /v1/roles/`, `POST .../revoke-sessions` | | `iam:role:write_trust` | Set a role's trust policy | `PUT /v1/roles//trust-policy`, and `POST /v1/roles` when the body has a `trust_policy` | | `iam:role:read` | Read a role's policies and trust policy; simulate its trust policy | `GET /v1/roles//policies`, `GET .../trust-policy`, `POST .../trust-policy/simulate` | | Any member | List and read roles | `GET /v1/roles`, `GET /v1/roles/` | Attaching a policy to a role is done with `iam:policy:write`. A policy attached to a role grants only to sessions of that role. See [Roles](https://hexelstudio.com/docs/identity/roles). ### Permission sets | Action | Allows | Checked by | | --- | --- | --- | | `iam:permission_set:read` | List and read permission sets and their assignments | `GET /v1/permission-sets`, `GET /v1/permission-sets/`, `GET .../assignments` | | `iam:permission_set:write` | Create, change and delete permission sets; assign and unassign them | `POST /v1/permission-sets`, `PATCH` and `DELETE /v1/permission-sets/`, `POST .../assignments`, `DELETE .../assignments/` | ### Testing access and the action catalog | Action | Allows | Checked by | | --- | --- | --- | | `iam:authz:simulate` | Test access and validate policy documents | `POST /v1/authz/evaluate`, `POST /v1/authz/explain`, `POST /v1/authz/simulate`, `GET /v1/authz/expand`, `POST /v1/authz/validate-policy` | | `iam:permission:read` | Read one entry of the action catalog | `GET /v1/permissions/` | | Any member | List the action catalog | `GET /v1/permissions` | The action catalog is descriptive. Access is decided only by the action names in your policies, and the catalog does not list every action on this page. ### Audit logs | Action | Allows | Checked by | | --- | --- | --- | | `iam:audit:read` | Read audit log entries and retention policies | `GET /v1/audit/logs`, `GET /v1/audit/logs/`, `GET /v1/audit/retention` | See [Audit logs](https://hexelstudio.com/docs/identity/audit-logs). ### Preview features These actions guard Preview APIs. The calls work, but most of what they configure does not change access decisions yet. See each page. | Action | Guards | Page | | --- | --- | --- | | `iam:scp:read`, `iam:scp:write` | `/v1/scps` | [Guardrails](https://hexelstudio.com/docs/identity/guardrails) | | `iam:rcp:read`, `iam:rcp:write` | `/v1/rcps` | [Guardrails](https://hexelstudio.com/docs/identity/guardrails) | | `iam:boundary:read`, `iam:boundary:write` | `/v1/boundaries` | [Guardrails](https://hexelstudio.com/docs/identity/guardrails) | | `iam:policy:write` | `/v1/resource-policies` (all calls, including reads) | [Fine-grained access](https://hexelstudio.com/docs/identity/fine-grained-access) | | `iam:abac:read` | Read ABAC policies | [Fine-grained access](https://hexelstudio.com/docs/identity/fine-grained-access) | | `iam:abac:write` | Write ABAC policies, and read, set and delete ABAC attributes | [Fine-grained access](https://hexelstudio.com/docs/identity/fine-grained-access) | | `iam:relation:read` | Read namespaces, tags and session policies | [Fine-grained access](https://hexelstudio.com/docs/identity/fine-grained-access), [Session policies](https://hexelstudio.com/docs/identity/session-policies) | | `iam:relation:write` | Write namespaces, tags and session policies; write, read, check and look up relationship tuples | [Fine-grained access](https://hexelstudio.com/docs/identity/fine-grained-access), [Session policies](https://hexelstudio.com/docs/identity/session-policies) | | `iam:workload_identity_provider:read`, `iam:workload_identity_provider:write` | `/v1/workload-identity-providers` | [Workload identity](https://hexelstudio.com/docs/identity/workload-identity) | | `iam:jit:read`, `iam:jit:write`, `iam:jit:approve` | `/v1/jit` | [Just-in-time access](https://hexelstudio.com/docs/identity/just-in-time-access) | | `iam:approval:read`, `iam:approval:write`, `iam:approval:manage` | `/v1/approvals` | [Just-in-time access](https://hexelstudio.com/docs/identity/just-in-time-access) | | `iam:review:read`, `iam:review:write`, `iam:review:manage` | `/v1/reviews` | [Access reviews](https://hexelstudio.com/docs/identity/access-reviews) | | `iam:audit:write` | Create audit reports and scans, resolve findings, manage retention policies | [SIEM export](https://hexelstudio.com/docs/identity/siem-export) | | `iam:audit:siem` | Read and write SIEM configurations | [SIEM export](https://hexelstudio.com/docs/identity/siem-export) | ## Trust policy actions (`sts:`) `sts:role:assume` and the `sts:role:assume_with_*` actions go in a role's **trust policy**, not in a policy you attach. They say who may assume the role. See [Roles](https://hexelstudio.com/docs/identity/roles). ## Product actions in managed policies The managed policies also grant actions of other Hexel Studio products. Each product checks its own actions; see the product's documentation for which call needs which action. | Service | Actions | Managed policies | | --- | --- | --- | | Atlas | `atlas:connector:read`, `atlas:connector:write`, `atlas:connector:admin`, `atlas:channel:read`, `atlas:channel:write`, `atlas:tool:read`, `atlas:tool:write`, `atlas:knowledge:read`, `atlas:knowledge:write`, `atlas:memory:read`, `atlas:memory:write`, `atlas:graph:read`, `atlas:placement:read`, `atlas:placement:write` | `pol_data_full` (`atlas:*`), `pol_data_readonly` (the `:read` actions) | | Hexel Managed Memory | `storage:memory:store:create`, `storage:memory:store:read`, `storage:memory:store:update`, `storage:memory:store:delete` (stores); `storage:memory:memory:read`, `storage:memory:memory:write`, `storage:memory:memory:delete` (memories); `storage:memory:job:read`; `storage:memory:export:create` | `pol_memory_full` (`storage:memory:*`), `pol_memory_user` (read stores; read, write and delete memories; read jobs), `pol_memory_readonly` (read stores, memories and jobs) | | Skills Registry | `storage:skills:skill:read` (resolve, fetch, list, search), `storage:skills:skill:publish` (publish versions), `storage:skills:tag:write` (move and delete tags), `storage:skills:version:yank` (deprecate, yank, restore versions), `storage:skills:registry:admin` (namespaces, publisher keys, audit, webhooks) | `pol_skills_full` (`storage:skills:*`), `pol_skills_publisher`, `pol_skills_readonly` | | Support | `support:ticket:create` (open tickets), `support:ticket:read` and `support:ticket:reply` (tickets you requested or are copied on), `support:ticket:read-org` (every ticket of the organization) | `pol_support_customer`, `pol_support_org_admin` | | Billing | `org:billing:read`, `org:billing:manage` | `pol_billing_full`, `pol_billing_readonly`, `pol_org_member`, `pol_org_readonly` | | Other products | `compute:*`, `tool-gateway:*`, `deployment:*`, `monitoring:*` | `pol_compute_full`, `pol_compute_readonly`, `pol_tool_full`, `pol_tool_execute`, `pol_deploy_full`, `pol_deploy_readonly`, `pol_monitoring` | Atlas actions were renamed from `data-platform:` to `atlas:`. Policy documents carry both names for now, so a policy that allows `data-platform:knowledge:read` also allows `atlas:knowledge:read`. Write new policies with `atlas:` names. Hexel Managed Memory and Skills Registry actions moved under `storage:`: `memory::` is now `storage:memory::`, and `skills::` is now `storage:skills::`. `storage:*` allows both products. Policy documents carry both names for now, so a policy that allows `memory:store:read` also allows `storage:memory:store:read`. Write new policies with `storage:` names. ## Actions that no call checks Some managed policies also list actions that no Hexel Studio API checks today, for example `iam:group:read`, `iam:tag:manage`, `iam:binding:read`, `iam:trust:read`, `iam:role_template:read`, `directory:user:read` and `directory:session:read`. Allowing them has no effect. The routes for your own account, such as `GET /v1/users/me`, check no action and work only on your own account.