---
schema_version: "1"
id: e8a60b07076635d2c3add83d3b67d3cf6287c44f0ff6689d1de5908b020ee8ba
title: Permissions by Product in Anypoint Platform
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/access-management/permissions-by-product.md
canonical_url: https://docs.mulesoft.com/access-management/permissions-by-product
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 2f0e015d7cc4cd44cd8f836fa48a44dabf49c60720ef852ffdf60e226dd94728
description: MuleSoft Documentation Site
latest: true
---
---
product: Access Management
version: master
---

# Permissions by Product in Anypoint Platform

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Find and assign Anypoint Platform permissions by product for teams and users. Review cross‑product
dependencies and where to grant each permission. Make sure users have the exact access required for
their roles.

Some products require permissions from other products to use them properly. For example, Anypoint
Monitoring requires users to have certain Runtime Manager permissions in addition to Anypoint
Monitoring-related permissions. See each product’s documentation to determine which permissions your
users need and how to set them.

Depending on your organization’s licensing and entitlements, not all of these permissions are
available during configuration.

## Access Management

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Organization Administrator</p></div></div></td><td><div><div><ul><li><p>Perform most Anypoint Platform tasks, including but not limited to secrets management, network administration, and other view, modify, execute, and delete permissions.</p></li><li><p>Access the Organization Administration page.</p></li><li><p>Add and manage users and permissions.</p></li><li><p>View and edit organization details, access <strong>API Manager &gt; Client Applications</strong>, access the client ID and client secret for the organization, and customize the theme of the Developer Portal.</p></li><li><p>Edit all versions of all APIs, all registered applications, and all API Portals in Anypoint Platform.</p></li></ul></div></div></td><td><div><div><p>For security reasons, assign this permission to as few users as possible.</p></div></div></td></tr><tr><td><div><div><p>Audit Log Config Manager</p></div></div></td><td><div><div><p>Configure the retention period for audit logs across the organization.</p></div></div></td><td><div><div><p>This permission can be added only by an organization administrator at the root organization level.</p></div><div><p>This permission appears only if the organization has the modern UI enabled in access management.</p></div></div></td></tr><tr><td><div><div><p>Audit Log Viewer</p></div></div></td><td><div><div><p>View audit logs in Access Management.</p></div></div></td><td><div></div></td></tr></tbody></table>

## Agent Visualizer

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Anypoint Monitoring: Monitoring Viewer</p></div></div></td><td><div><div><p>View monitoring data for agentic assets.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Exchange: Exchange Viewer</p></div></div></td><td><div><div><p>View agentic assets.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>API Manager: View APIs Configuration</p></div></div></td><td><div><div><p>View API nodes and relationships.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>API Manager: View Policies</p></div></div></td><td><div><div><p>View policies for assets.</p></div></div></td><td><div></div></td></tr></tbody></table>

## Anypoint Code Builder

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Anypoint Code Builder Developer</p></div></div></td><td><div><div><p>Create and use cloud IDE instances of Anypoint Code Builder.</p></div></div></td><td><div><div><p>This permission does not apply to Anypoint Code Builder for Desktop.</p></div><div><p>This permission can be added only by an organization administrator at the root organization level.</p></div></div></td></tr><tr><td><div><div><p>Mule Developer Generative AI User</p></div></div></td><td><div><div><p>Use natural language prompts to develop and generate flows using generative AI for MuleSoft Vibes.</p></div></div></td><td><div><div><p>This permission can be added only by an organization administrator at the root organization level.</p></div></div></td></tr></tbody></table>

## API Catalog

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>API Catalog Contributor</p></div></div></td><td><div><div><p>Catalog assets and other resources using API Catalog.</p></div></div></td><td><div></div></td></tr></tbody></table>

## API Experience Hub

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>API Experience Hub Admin</p></div></div></td><td><div><div><p>View, create, modify, and delete content in API Experience Hub.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>API Experience Hub Users Approver</p></div></div></td><td><div><div><p>Approve or reject new user access requests and manage existing members' access.</p></div></div></td><td><div></div></td></tr></tbody></table>

## API Governance

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Governance Administrator</p></div></div></td><td><div><div><p>Manage profiles and view reports.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Governance Viewer</p></div></div></td><td><div><div><p>View reports.</p></div></div></td><td><div></div></td></tr></tbody></table>

## API Manager

Depending on your organization, you might see one of these sets of permissions available for API
Manager.

<table><caption>Table 1. Post-Crowd</caption> <colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>API Manager Environment Administrator</p></div></div></td><td><div><div><p>View, create, modify, and delete APIs in the specified environment.</p></div></div></td><td><div><div><p>Users can also execute any actions related to API configurations, groups, proxies, alerts, contracts, tiers, policies, automated policies, and other settings in the specified API Manager environment.</p></div></div></td></tr><tr><td><div><div><p>API Group Administrator</p></div></div></td><td><div><div><p>View, create, modify, deprecate, and delete API groups and API group instances in the specified environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Deploy API Proxies</p></div></div></td><td><div><div><p>Deploy API proxies in the specified environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage API Alerts</p></div></div></td><td><div><div><p>View, create, modify, and delete API alerts in the specified environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage APIs Configuration</p></div></div></td><td><div><div><p>View and modify API configurations in the specified environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Client Applications</p></div></div></td><td><div><div><p>Create and manage client applications in the root organization.</p></div></div></td><td><div><div><p>Users with this permission can view and modify application credentials and can add and remove client owners.</p></div><div><p>This permission can be added only by an organization administrator at the root organization level.</p></div></div></td></tr><tr><td><div><div><p>Manage Contracts</p></div></div></td><td><div><div><p>View, accept, reject, and delete contracts and tiers in the specified environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Policies</p></div></div></td><td><div><div><p>View, create, modify, and delete API policies in the specified environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>View API Alerts</p></div></div></td><td><div><div><p>View the API alerts in the specified environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>View APIs Configuration</p></div></div></td><td><div><div><p>View API configurations in the specified environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>View Client Applications</p></div></div></td><td><div><div><p>View client applications in the root organization.</p></div></div></td><td><div><div><p>This permission can be added only by an organization administrator at the root organization level. Users with this credential can’t view application secrets and can’t modify applications.</p></div></div></td></tr><tr><td><div><div><p>View Contracts</p></div></div></td><td><div><div><p>View contracts and tiers in the specified environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>View Policies</p></div></div></td><td><div><div><p>View API policies in the specified environment.</p></div></div></td><td><div></div></td></tr></tbody></table>

<table><caption>Table 2. Pre-Crowd</caption> <colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>API Creator</p></div></div></td><td><div><div><p>Create an API in the specified environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>API Versions Owner</p></div></div></td><td><div><div><p>View, modify, delete, and deprecate all API versions in the specified business group.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Portals Viewer</p></div></div></td><td><div><div><p>View all portals in the specified business group.</p></div></div></td><td><div></div></td></tr></tbody></table>

## API Visualizer

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Visualizer Editor</p></div></div></td><td><div><div><p>View, create, modify, and delete content in Anypoint Visualizer.</p></div></div></td><td><div><div><p>This permission can be added only by an organization administrator at the root organization level.</p></div></div></td></tr></tbody></table>

## Data Gateway

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Data Gateway Administrator</p></div></div></td><td><div><div><p>Full access to Data Gateway Designer.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Data Gateway Viewer</p></div></div></td><td><div><div><p>Read-only access to Data Gateway Designer.</p></div></div></td><td><div></div></td></tr></tbody></table>

## DataGraph

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Contribute</p></div></div></td><td><div><div><ul><li><p>Add source APIs to the unified schema.</p></li><li><p>Edit any source API schema added to the unified schema.</p></li><li><p>Request access to run queries.</p></li><li><p>Promote API schemas to an environment.</p></li><li><p>View query traces in real-time while running queries from the UI.</p></li><li><p>Download a copy of the unified schema from the query editor.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Consume</p></div></div></td><td><div><div><ul><li><p>View and explore the unified schema.</p></li><li><p>Request access to run queries and make data requests from the UI.</p></li><li><p>Download a copy of the unified schema from the query editor.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Operate</p></div></div></td><td><div><div><ul><li><p>View customer-facing logs.</p></li><li><p>Set a dedicated load balancer URL for Anypoint Datagraph.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>DataGraph Admin</p></div></div></td><td><div><div><ul><li><p>Contribute, consume, and operate the unified schema.</p></li><li><p>View usage metrics.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>DataGraph Project - Contributor</p></div></div></td><td><div><div><ul><li><p>Add source APIs to the unified schema.</p></li><li><p>Edit any source API schema added to the unified schema.</p></li><li><p>Request access to run queries.</p></li><li><p>Promote API schemas to an environment.</p></li><li><p>View query traces in real-time while running queries from the UI.</p></li><li><p>Download a copy of the unified schema from the query editor in a specific project.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>DataGraph Project - Operator</p></div></div></td><td><div><div><p>View customer-facing logs and set a dedicated load balancer URL for Anypoint Datagraph in a specific project.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>DataGraph Project - Admin</p></div></div></td><td><div><div><ul><li><p>Contribute, consume, and operate the unified schema.</p></li><li><p>View usage metrics in a specific project.</p></li></ul></div></div></td><td><div></div></td></tr></tbody></table>

## Design Center

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Design Center Developer</p></div></div></td><td><div><div><p>View, create, and manage all projects within a business group.</p></div></div></td><td><div><div><p>Use this permission to set up administrators for all projects within a specific business group.</p></div></div></td></tr><tr><td><div><div><p>Design Center Creator</p></div></div></td><td><div><div><p>Create projects in Design Center from the navigation panel and view all projects created or shared with the user.</p></div></div></td><td><div><div><p>Use this permission to invite users to create, edit, and maintain your projects.</p></div></div></td></tr><tr><td><div><div><p>Design Center Viewer</p></div></div></td><td><div><div><p>View all Design Center projects within a business group and test projects with the Mocking Service.</p></div></div></td><td><div><div><p>Users with this permission can’t create new projects, edit or rename existing projects, or share projects with another user.</p></div><div><p>Assign this permission to those who consume your project in a specific business group.</p></div></div></td></tr></tbody></table>

### Design Center Project-level Permissions

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Project Administrator</p></div></div></td><td><div><div><p>Manage and share a Design Center project within a business group.</p></div></div></td><td><div><div><p>Use this permission to set up administrators for all the projects within a specific business group.</p></div></div></td></tr><tr><td><div><div><p>Project Editor</p></div></div></td><td><div><div><p>Edit a Design Center project within a business group.</p></div></div></td><td><div><div><p>Use this permission to invite users to create, edit, and maintain your projects.</p></div></div></td></tr><tr><td><div><div><p>Project Viewer</p></div></div></td><td><div><div><p>View a Design Center project within a business group and test projects with the Mocking Service.</p></div></div></td><td><div><div><p>Users with this permission can’t create a new project, edit or rename the existing project, or share the project with another user.</p></div><div><p>Assign this permission to those who consume your project in a specific business group.</p></div></div></td></tr></tbody></table>

## Enhanced MuleSoft Experience

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Any of these permissions:</p></div><div><ul><li><p>Exchange: Exchange Viewer</p></li><li><p>Exchange: Exchange Contributor</p></li><li><p>Exchange: Exchange Administrator</p></li></ul></div></div></td><td><p>View services</p></td><td><div><div><p>View services in the portfolio and open the catalog overview in Anypoint Exchange.</p></div></div></td></tr><tr><td><div><div><p>One of these Exchange permissions:</p></div><div><ul><li><p>Exchange: Exchange Contributor</p></li><li><p>Exchange: Exchange Administrator</p></li><li><p>Exchange: Exchange Creator</p></li></ul></div></div></td><td><p>Create services</p></td><td><div><div><p>Register MCP servers, agents, LLMs, or APIs. To create an MCP server, you also need the API Manager: Manage APIs Configuration permission on at least one environment.</p></div></div></td></tr><tr><td><div><div><p>API Manager: API Creator</p></div></div></td><td><p>Create instances</p></td><td><div><div><p>Create or add instances.</p></div></div></td></tr><tr><td><div><div><p>API Manager: View APIs Configuration</p></div></div></td><td><p>View instances</p></td><td><div><div><p>View instances for services and open the <strong>Instances</strong> tab.</p></div></div></td></tr><tr><td><div><div><p>API Manager: Edit APIs Configuration</p></div></div></td><td><p>Edit instances</p></td><td><div><div><p>Edit instances for services.</p></div></div></td></tr><tr><td><div><div><p>Exchange: Exchange Administrator</p></div></div></td><td><p>Create scanners</p></td><td><div><div><p>Create scanners from <strong>Providers</strong> using <strong>Add MCP Server</strong>, <strong>Add Agent</strong>, or <strong>Add API</strong> if your organization enables matching scanner capabilities.</p></div><div><p>To view the <strong>Providers</strong> section, you need these permissions or the required scanner entitlements for API, MCP, or agent scanners.</p></div></div></td></tr><tr><td><div><div><p>Any of these permissions:</p></div><div><ul><li><p>Secrets Manager: View Vault Integrations</p></li><li><p>Secrets Manager: Manage Vault Integrations</p></li></ul></div></div></td><td><p>View vaults</p></td><td><div><div><p>List and view external vaults under <strong>Platform</strong> &gt; <strong>Providers</strong>, including sync activity and health checks.</p></div></div></td></tr><tr><td><div><div><p>Secrets Manager: Manage Vault Integrations</p></div></div></td><td><p>Manage vaults</p></td><td><div><div><p>Register, edit, delete, test, and sync external vaults under <strong>Platform</strong> &gt; <strong>Providers</strong>. This permission includes View Vault Integrations.</p></div></div></td></tr><tr><td><div><div><p>Any of these permissions:</p></div><div><ul><li><p>Anypoint Monitoring: Monitoring Viewer</p></li><li><p>Anypoint Monitoring: Monitoring Administrator</p></li></ul></div></div></td><td><p>View monitoring</p></td><td><div><div><p>Open the <strong>Monitoring</strong> tab at the service and instance levels, and view <strong>Monitoring</strong> in the navigation bar.</p></div></div></td></tr><tr><td><div><div><p>API Manager: View Policies</p></div></div></td><td><p>View policies</p></td><td><div><div><p>View and apply policies on instances, and access policies from the <strong>Governance</strong> tab.</p></div></div></td></tr><tr><td><div><div><p>API Manager: Manage Policies</p></div></div></td><td><p>Apply policies</p></td><td><div><div><p>Edit policy configurations and add policies.</p></div></div></td></tr><tr><td><div><div><p>These permissions:</p></div><div><ul><li><p>API Manager: Manage Policies</p></li><li><p>API Manager: View APIs Configuration</p></li><li><p>API Manager: View Policies</p></li><li><p>Anypoint Monitoring: Monitoring Viewer</p></li><li><p>Exchange: Exchange Viewer</p></li><li><p>Anypoint Code Builder: Mule Developer Generative AI User (Optional)</p></li></ul></div></div></td><td><p>Use the Cost Management experience</p></td><td><div><div><p>Apply optimization strategies using policies, view policies, view Exchange assets, and query metrics. The Mule Developer Generative AI User permission is required to enable AI features.</p></div></div></td></tr><tr><td><div><div><p>Anypoint Code Builder: Mule Developer Generative AI User</p></div></div></td><td><p>Use AI features in Anypoint Code Builder</p></td><td><div><div><p>Use AI-powered features in Anypoint Code Builder, including MuleSoft Vibes and Diagnostics Agent.</p></div></div></td></tr><tr><td><div><div><p>Any of these permissions:</p></div><div><ul><li><p>API Governance: Governance Administrator</p></li><li><p>API Manager: Manage Policies</p></li></ul></div></div></td><td><p>Create governance strategies</p></td><td><div><div><p>Create governance strategies.</p></div><div><p>To view and create governance strategies, you need the Governance Administrator permission for <strong>Control</strong> types, or the Manage Policies permission for <strong>Automated Policy</strong> types.</p></div></div></td></tr><tr><td><div><div><p>Any of these permissions:</p></div><div><ul><li><p>API Governance: Governance Viewer</p></li><li><p>API Governance: Governance Administrator</p></li></ul></div></div></td><td><p>View governance reports</p></td><td><div><div><p>View governance reports at the service and governance strategy levels.</p></div><div><p>To see the conformance badge and whether rulesets passed or failed, you need the Exchange Viewer permission. To view or export detailed governance reports, including violations, warnings, and rule breakdowns, you need the Governance Viewer permission.</p></div></div></td></tr><tr><td><div><div><p>Any of these permissions:</p></div><div><ul><li><p>API Manager: View API Alerts</p></li><li><p>Runtime Manager: Read Alerts</p></li></ul></div></div></td><td><p>View alerts</p></td><td><div><div><p>View API alerts in API Manager and read alerts in Runtime Manager.</p></div></div></td></tr><tr><td><div><div><p>Any of these permissions:</p></div><div><ul><li><p>API Manager: Manage API Alerts</p></li><li><p>Runtime Manager: Manage Alerts</p></li></ul></div></div></td><td><p>Manage alerts</p></td><td><div><div><p>Manage API alerts in API Manager and alerts in Runtime Manager.</p></div></div></td></tr><tr><td><div><div><p>MuleSoft Agent AI User</p></div></div></td><td><p>Use MuleSoft Agent functionality</p></td><td><div><div><p>Access MuleSoft Agent functionality in the enhanced experience.</p></div></div></td></tr></tbody></table>

## Exchange

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Exchange Administrator</p></div></div></td><td><div><div><ul><li><p>View, create, and download assets within a business group.</p></li><li><p>Edit asset portal content in an existing asset version.</p></li></ul></div></div></td><td><div><div><p>Users with this permission have the same access as users with the Exchange contributor and Exchange viewer permissions, and access to share an asset with another user, deprecate an asset, and delete an asset.</p></div><div><p>Use this permission to set up Exchange administrators for all assets within a specific business group.</p></div></div></td></tr><tr><td><div><div><p>Exchange Contributor</p></div></div></td><td><div><div><p>View, create, and download assets within a business group.</p></div><div><p>Users with this permission can edit asset portal content in an existing asset version.</p></div></div></td><td><div><div><p>Use this permission to invite users to edit and maintain your asset portal descriptions.</p></div></div></td></tr><tr><td><div><div><p>Exchange Viewer</p></div></div></td><td><div><div><p>View and download assets within a business group.</p></div></div></td><td><div><div><p>Users with this permission can’t add new assets, edit asset portal content, or share an asset with another user.</p></div><div><p>Assign this permission to those who consume your assets in a specific business group.</p></div></div></td></tr><tr><td><div><div><p>Exchange Creator</p></div></div></td><td><div><div><p>Create new assets within a business group’s catalog.</p></div></div></td><td><div><div><p>A user with this permission can’t modify assets or asset versions created by other users in the business group.</p></div><div><p>Once the users with this permission create an asset, the Asset Administrator permission is automatically assigned for the assets they create. The Asset Administrator permission allows these users to modify only the assets that they create.</p></div><div><p>Use this permission to restrict the modification of assets except for assets created by this user while allowing all developers across all teams in a business group to create new assets in Exchange.</p></div></div></td></tr><tr><td><div><div><p>Asset Viewer</p></div></div></td><td><div><div><p>View and download an asset.</p></div></div></td><td><div><div><p>Users with this permission can’t edit asset portal content or share an asset with another user.</p></div><div><p>Use this permission to invite a user outside your business group to view and download an asset.</p></div></div></td></tr><tr><td><div><div><p>Asset Contributor</p></div></div></td><td><div><div><p>View, add a new version, and download an asset.</p></div></div></td><td><div><div><p>Use this permission to invite a user outside of your business group to view, download, and add edit portal content for an asset.</p></div></div></td></tr><tr><td><div><div><p>Asset Administrator</p></div></div></td><td><div><div><p>View, create, download, deprecate, and delete an asset.</p></div></div></td><td><div><div><p>Users with this permission have the same access as users with the Exchange Administrator permission, but on only a single asset. This permission is assigned by default to an asset creator.</p></div><div><p>Use this permission to extend administrator permissions for an asset to an additional user.</p></div></div></td></tr><tr><td><div><div><p>Generate Asset Documentation with AI</p></div></div></td><td><div><div><p>Generates documentation for existing asset versions within a business group using generative AI features.</p></div></div></td><td><div></div></td></tr></tbody></table>

## IDP

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Manage Actions</p></div></div></td><td><div><div><p>Complete access to IDP and assigns reviewer permission by default for every document action.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Build Actions</p></div></div></td><td><div><div><p>Create, edit, and publish document actions and assign reviewers to the actions.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Execute Published Actions</p></div></div></td><td><div><div><p>Execute a published document action and retrieve the results of the execution.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Configure Connected Apps</p></div></div></td><td><div><div><p>Configure a connected app to communicate with IDP.</p></div></div></td><td><div></div></td></tr></tbody></table>

## Monitoring

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Monitoring Administrator</p></div></div></td><td><div><div><p>View, create, modify, and delete content in Anypoint Monitoring.</p></div></div></td><td><div><div><p>&nbsp;</p></div></div></td></tr><tr><td><div><div><p>Monitoring Viewer</p></div></div></td><td><div><div><p>View but not modify content in Anypoint Monitoring.</p></div></div></td><td><div><div><p>&nbsp;</p></div></div></td></tr><tr><td><div><div><p>Telemetry Exporter Administrator</p></div></div></td><td><div><div><ul><li><p>View connections and configurations in Telemetry Exporter.</p></li><li><p>Create, modify, and delete connections in Telemetry Exporter.</p></li><li><p>Create, modify, and delete configurations in Telemetry Exporter.</p></li></ul></div></div></td><td><div><div><p>Assign this permission at the root organization level.</p></div><div><p>Availability of this permission depends on your organization’s subscription tier.</p></div></div></td></tr><tr><td><div><div><p>Telemetry Exporter Configurations Manager</p></div></div></td><td><div><div><ul><li><p>View connections and configurations in Telemetry Exporter.</p></li><li><p>Create, modify, and delete configurations in Telemetry Exporter.</p></li></ul></div></div></td><td><div><div><p>Availability of this permission depends on your organization’s subscription tier.</p></div></div></td></tr></tbody></table>

## MQ

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>View clients</p></div></div></td><td><div><div><p>View all client apps, including client app IDs and client secrets for each client app.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>View destinations</p></div></div></td><td><div><div><ul><li><p>View all destinations and each destination’s settings (<strong>ID</strong>, <strong>Type</strong>, <strong>Message TTL</strong>, and <strong>Message Lock Default TTL</strong>).</p></li><li><p>View <strong>In Queue</strong> message stats.</p></li><li><p>View <strong>In Flight</strong> message stats.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Clear destinations</p></div></div></td><td><div><div><ul><li><p>View all destinations and each destination’s settings (<strong>ID</strong>, <strong>Type</strong>, <strong>Message TTL</strong>, and <strong>Message Lock Default TTL</strong>).</p></li><li><p>View <strong>In Queue</strong> message stats.</p></li><li><p>View <strong>In Flight</strong> message stats.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage clients</p></div></div></td><td><div><div><ul><li><p>View all client apps, including client app IDs and client secrets for each client app.</p></li><li><p>Create client apps.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Administer destinations</p></div></div></td><td><div><div><ul><li><p>View all destinations and each destination’s settings (<strong>ID</strong>, <strong>Type</strong>, <strong>Message TTL</strong>, and <strong>Message Lock Default TTL</strong>).</p></li><li><p>View <strong>In Queue</strong> message stats.</p></li><li><p>View <strong>In Flight</strong> message stats.</p><div><ul><li><p>Create new queues, message exchanges, and bindings.</p></li><li><p>Edit existing queues, message exchanges, and bindings.</p></li><li><p>Purge messages from queues.</p></li></ul></div></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage destinations (deprecated)</p></div></div></td><td><div><div><ul><li><p>View all destinations and each destination’s settings (<strong>ID</strong>, <strong>Type</strong>, <strong>Message TTL</strong>, and <strong>Message Lock Default TTL</strong>).</p></li><li><p>View <strong>In Queue</strong> message stats.</p></li><li><p>View <strong>In Flight</strong> message stats.</p></li><li><p>Create new queues and message exchanges.</p></li><li><p>Edit existing queues and message exchange settings.</p></li><li><p>Access <strong>Message Sender</strong> and <strong>Browser</strong> pages.</p></li><li><p>Delete messages.</p></li><li><p>Purge messages from queues.</p></li></ul></div></div></td><td><div><div><p>This permission is deprecated. Assign these permissions instead:</p></div><div><ul><li><p>Administer destinations</p></li><li><p>Destination subscriber for a given environment</p></li><li><p>Destination publisher for a given environment</p></li></ul></div></div></td></tr><tr><td><div><div><p>Destination subscriber for a given environment</p></div></div></td><td><div><div><ul><li><p>Consume messages from a destination.</p></li><li><p>Delete messages from a destination.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Destination publisher for a given environment</p></div></div></td><td><div><div><ul><li><p>Send messages to a destination.</p></li><li><p>Update message TTL on a destination.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Read MQ stats</p></div></div></td><td><div><div><p>View organization and environment statistics.</p></div></div></td><td><div></div></td></tr></tbody></table>

## Object Store v2

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Manage stores</p></div></div></td><td><div><div><p>Create, read, update, and delete stores.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage stores data</p></div></div></td><td><div><div><p>Perform all store operations including data, partition, and confirmation APIs.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>View stores</p></div></div></td><td><div><div><p>Read store details.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage store clients</p></div></div></td><td><div><div><p>Manage all clients of a cloud store.</p></div></div></td><td><div><div><p>This permission doesn’t apply to Object Store v2.</p></div></div></td></tr><tr><td><div><div><p>View store clients (object store only)</p></div></div></td><td><div><div><p>View all clients of a cloud store.</p></div></div></td><td><div><div><p>This permission doesn’t apply to Object Store v2.</p></div></div></td></tr></tbody></table>

## Partner Manager

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Partner Manager Administrator</p></div></div></td><td><div><div><p>Have complete access to the host, partner, message flow configurations, and transaction activity.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>View Host, Partners and Message Flows</p></div></div></td><td><div><div><p>Have view-only access to the host, partner, and message flow configurations.</p></div></div></td><td><div><div><p>This user can’t view transaction activity.</p></div></div></td></tr><tr><td><div><div><p>Manage Partners and Message Flows</p></div></div></td><td><div><div><ul><li><p>Create, modify, and delete partners or message flow configurations.</p></li><li><p>View partner configurations.</p></li></ul></div></div></td><td><div><div><p>This user can’t view and manage transaction activity.</p></div></div></td></tr><tr><td><div><div><p>Manage Activity</p></div></div></td><td><div><div><p>View and manage transaction activity.</p></div></div></td><td><div><div><p>This user can’t view or modify either partner or message flow configurations.</p></div></div></td></tr><tr><td><div><div><p>Manage Host</p></div></div></td><td><div><div><p>Create, modify, and delete host configurations.</p></div></div></td><td><div><div><p>This user can’t view or modify partner configurations or transaction activity. This access applies even if the user has the Organization Administrator permission.</p></div></div></td></tr><tr><td><div><div><p>View Activity</p></div></div></td><td><div><div><p>Have view-only access to transaction activity.</p></div></div></td><td><div><div><p>This user can’t view or modify either partner or message flow configurations.</p></div></div></td></tr></tbody></table>

## RPA

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>RPA Administrator</p></div></div></td><td><div><div><p>Perform all tasks, except those provided by the RPA Project Manager permission.</p></div></div></td><td><div><div><p>A user with this permission can only view or administer automation projects if the user is part of the process team.</p></div></div></td></tr><tr><td><div><div><p>RPA Automations Designer</p></div></div></td><td><div><div><p>RPA developer, citizen technologist, or knowledge source (such as a business analyst or process owner):</p></div><div><p>In RPA Manager:</p></div><div><ul><li><p>Create automation projects.</p></li><li><p>Record or design models of business processes that a process manager or center of excellence approved for automation.</p></li><li><p>Document and edit the applications required for performing the processes.</p></li></ul></div></div></td><td><div><details><summary>Replaces these permissions</summary><div><div><ul><li><p>Application Create</p></li><li><p>Application Edit</p></li><li><p>Process Automation Open</p></li><li><p>Process Create</p></li><li><p>Process Recording</p></li></ul></div></div></details></div></td></tr><tr><td><div><div><p>RPA Automations Contributor</p></div></div></td><td><div><div><p>RPA developer, citizen technologist, or knowledge source (such as a business analyst or process owner):</p></div><div><ul><li><p>In RPA Manager:</p><div><ul><li><p>Create automation projects.</p></li><li><p>Record or design models of business processes that a process manager or center of excellence approved for automation.</p></li><li><p>Document and edit the applications required for performing the processes.</p></li><li><p>Create and edit global variables to link to activity parameters created with RPA Builder.</p></li></ul></div></li><li><p>In RPA Builder:</p><div><ul><li><p>Build the automation based on the model.</p></li><li><p>Reuse activities from the Activity Library.</p></li></ul></div></li></ul></div></div></td><td><div><details><summary>Replaces these permissions</summary><div><div><ul><li><p>Activity Library Open</p></li><li><p>Application Create</p></li><li><p>Application Edit</p></li><li><p>Builder Usage</p></li><li><p>Global Variables Create for Productionphase</p></li><li><p>Global Variables Create for Testphase</p></li><li><p>Global Variables Edit for Productionphase</p></li><li><p>Global Variables Edit for Testphase</p></li><li><p>Process Automation Open</p></li><li><p>Process Create</p></li><li><p>Process Recording</p></li></ul></div></div></details></div></td></tr><tr><td><div><div><p>RPA Automations Manager</p></div></div></td><td><div><div><p>RPA developer, citizen technologist, or knowledge source (such as a business analyst or process owner):</p></div><div><ul><li><p>In RPA Manager:</p><div><ul><li><p>Create automation projects.</p></li><li><p>Record or design models of business processes that a process manager or center of excellence approved for automation.</p></li><li><p>Document and manage the applications required for performing the processes.</p></li><li><p>Create and manage global variables to link to activity parameters created with RPA Builder.</p></li><li><p>Change the owners and managers of processes.</p></li><li><p>Reassign unprocessed user tasks</p></li></ul></div></li><li><p>In RPA Builder:</p><div><ul><li><p>Build the automation based on the model.</p></li><li><p>Reuse and manage activities from the Activity Library.</p></li></ul></div></li></ul></div></div></td><td><div><details><summary>Replaces these permissions</summary><div><div><ul><li><p>Activity Library Administration</p></li><li><p>Activity Library Open</p></li><li><p>Application Create</p></li><li><p>Application Delete</p></li><li><p>Application Edit</p></li><li><p>Builder Usage</p></li><li><p>Change Process Owner</p></li><li><p>Change Project Manager</p></li><li><p>Global Variables Create for Productionphase</p></li><li><p>Global Variables Create for Testphase</p></li><li><p>Global Variables Edit for Productionphase</p></li><li><p>Global Variables Edit for Testphase</p></li><li><p>Global Variables Delete</p></li><li><p>Process Automation Open</p></li><li><p>Process Create</p></li><li><p>Process Recording</p></li><li><p>Unprocessed Task List Edit</p></li><li><p>Unprocessed Task List Open</p></li></ul></div></div></details></div></td></tr><tr><td><div><div><p>RPA Bots Manager</p></div></div></td><td><div><div><p>In RPA Manager:</p></div><div><ul><li><p>Monitor and manage all RPA Bots, including:</p><div><ul><li><p>Manage service times.</p></li><li><p>View session queues.</p></li></ul></div></li><li><p>Manage the applications required for performing the processes, including downtimes.</p></li></ul></div></div></td><td><div><details><summary>Replaces these permissions</summary><div><div><ul><li><p>Application Create</p></li><li><p>Application Delete</p></li><li><p>Application Edit</p></li><li><p>Process Monitoring Open</p></li><li><p>Robot Management Administration</p></li><li><p>Robot Management Open</p></li><li><p>Robot State and Operation Open</p></li><li><p>Service Time Create</p></li><li><p>Service Time Delete</p></li><li><p>Service Time Edit</p></li></ul></div></div></details></div></td></tr><tr><td><div><div><p>RPA Evaluations Viewer</p></div></div></td><td><div><div><p>In RPA Manager:</p></div><div><ul><li><p>View all process evaluations, regardless of whether the user belongs to the process team.</p></li><li><p>View:</p><div><ul><li><p>Evaluation criteria</p></li><li><p>Evaluation templates</p></li></ul></div></li></ul></div></div></td><td><div><details><summary>Replaces these permissions</summary><div><div><ul><li><p>Evaluation Criteria Open</p></li><li><p>Evaluation Templates Open</p></li><li><p>Global Process Evaluation View</p></li><li><p>Process Evaluation Open</p></li></ul></div></div></details></div></td></tr><tr><td><div><div><p>RPA Evaluations Contributor</p></div></div></td><td><div><div><p>In RPA Manager:</p></div><div><ul><li><p>View all process evaluations, regardless of whether the user belongs to the process team.</p></li><li><p>View, create, and edit:</p><div><ul><li><p>Evaluation criteria</p></li><li><p>Evaluation templates</p></li></ul></div></li><li><p>View, create, edit, and delete process evaluations.</p></li></ul></div></div></td><td><div><details><summary>Replaces these permissions</summary><div><div><ul><li><p>Evaluation Criteria Create</p></li><li><p>Evaluation Criteria Edit</p></li><li><p>Evaluation Criteria Open</p></li><li><p>Evaluation Templates Create</p></li><li><p>Evaluation Templates Edit</p></li><li><p>Evaluation Templates Open</p></li><li><p>Global Process Evaluation View</p></li><li><p>Process Evaluation Administration</p></li><li><p>Process Evaluation Open</p></li></ul></div></div></details></div></td></tr><tr><td><div><div><p>RPA Evaluations Manager</p></div></div></td><td><div><div><p>In RPA Manager:</p></div><div><ul><li><p>View all process evaluations, regardless of whether the user belongs to the process team.</p></li><li><p>View, create, edit, and delete:</p><div><ul><li><p>Evaluation criteria</p></li><li><p>Evaluation templates</p></li></ul></div></li><li><p>Process evaluations</p></li><li><p>Approve evaluated processes to a center of excellence or a project manager for automation.</p></li></ul></div></div></td><td><div><details><summary>Replaces these permissions</summary><div><div><ul><li><p>Evaluation Criteria Create</p></li><li><p>Evaluation Criteria Delete</p></li><li><p>Evaluation Criteria Edit</p></li><li><p>Evaluation Criteria Open</p></li><li><p>Evaluation Templates Create</p></li><li><p>Evaluation Templates Delete</p></li><li><p>Evaluation Templates Edit</p></li><li><p>Evaluation Templates Open</p></li><li><p>Global Process Evaluation View</p></li><li><p>Process Evaluation Administration</p></li><li><p>Process Evaluation Approval to a CoE</p></li><li><p>Process Evaluation Approval to a Project manager</p></li><li><p>Process Evaluation Open</p></li></ul></div></div></details></div></td></tr><tr><td><div><div><p>RPA Operations Viewer</p></div></div></td><td><div><div><p>In RPA Manager:</p></div><div><ul><li><p>View all aspects of these RPA assets:</p><div><ul><li><p>Alerts</p></li><li><p>Bots</p></li><li><p>Dashboards</p></li></ul></div></li><li><p>View this information for processes for which the user belongs to the process team:</p><div><ul><li><p>Deployment maps</p></li><li><p>Execution plans</p></li><li><p>Session queues</p></li></ul></div></li><li><p>Watch the bot at work via process streaming.</p></li></ul></div></div></td><td><div><details><summary>Replaces these permissions</summary><div><div><ul><li><p>Alerting Open</p></li><li><p>Dashboard Open</p></li><li><p>Process Deployment Map Open</p></li><li><p>Process Execution Plans Open</p></li><li><p>Process Monitoring Open</p></li><li><p>Process Streaming Open</p></li><li><p>Robot Management Open</p></li><li><p>Robot State and Operation Open</p></li></ul></div></div></details></div></td></tr><tr><td><div><div><p>RPA Operations Manager</p></div></div></td><td><div><div><p>In RPA Manager:</p></div><div><ul><li><p>View and manage these RPA assets:</p><div><ul><li><p>Alerts</p></li><li><p>Bots</p></li><li><p>Dashboards</p></li><li><p>Unprocessed user tasks</p></li><li><p>Upcoming process changes</p></li></ul></div></li><li><p>Analyze finance aspects and billing reports</p></li><li><p>View this information for processes for which the user belongs to the process team:</p><div><ul><li><p>Deployment maps</p></li><li><p>Execution plans</p></li><li><p>Session queues</p></li></ul></div></li><li><p>Watch the bot at work via process streaming.</p></li></ul></div></div></td><td><div><details><summary>Replaces these permissions</summary><div><div><ul><li><p>Alerting Administration</p></li><li><p>Alerting Open</p></li><li><p>Dashboard Open</p></li><li><p>Process Deployment Map Open</p></li><li><p>Process Execution Plans Open</p></li><li><p>Process Monitoring Open</p></li><li><p>Process Streaming Open</p></li><li><p>Robot Management Open</p></li><li><p>Robot State and Operation Open</p></li><li><p>Billing Report Open</p></li><li><p>Dashboard Administration</p></li><li><p>Finance Analysis Edit</p></li><li><p>Finance Analysis Open</p></li><li><p>Global Finance Analysis View</p></li><li><p>Global Process Execution Plans View</p></li><li><p>Unprocessed Task List Edit</p></li><li><p>Unprocessed Task List Open</p></li><li><p>Upcoming Process Changes Administration</p></li><li><p>Upcoming Process Changes Open</p></li></ul></div></div></details></div></td></tr><tr><td><div><div><p>RPA Performance Analyzer</p></div></div></td><td><div><div><p>In RPA Manager:</p></div><div><ul><li><p>Analyze the financial aspects (such as the break-even point) of all processes.</p></li><li><p>View the billing reports.</p></li></ul></div></div></td><td><div><details><summary>Replaces these permissions</summary><div><div><ul><li><p>Billing Report Open</p></li><li><p>Finance Analysis Edit</p></li><li><p>Finance Analysis Open</p></li><li><p>Global Finance Analysis View</p></li></ul></div></div></details></div></td></tr><tr><td><div><div><p>RPA Project Manager</p></div></div></td><td><div><div><p>Be assigned as a project manager of automation projects in RPA Manager. For a user to function as a project manager, the user must also have one of these permissions:</p></div><div><ul><li><p>RPA Automations Designer</p></li><li><p>RPA Automations Contributor</p></li><li><p>RPA Automations Manager</p></li><li><p>RPA Administrator</p></li></ul></div></div></td><td><div><div><p>Replaces the RPA Project Management permissions.</p></div></div></td></tr></tbody></table>

## Runtime Manager

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>CloudHub Network Administrator</p></div></div></td><td><div><div><p>Manage CloudHub and CloudHub 2.0 network resources.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>CloudHub Network Viewer</p></div></div></td><td><div><div><p>View CloudHub and CloudHub 2.0 network resources.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Delete Applications</p></div></div></td><td><div><div><p>Delete applications in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Download Applications</p></div></div></td><td><div><div><p>Download application files in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Alerts</p></div></div></td><td><div><div><p>Create, update, and delete application alerts in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Application Data</p></div></div></td><td><div><div><p>Create and delete application data in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Queues</p></div></div></td><td><div><div><p>Clear application queues in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Read Runtime Fabric</p></div></div></td><td><div><div><p>Query Runtime Fabric instances in the organization.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Runtime Fabrics</p></div></div></td><td><div><div><p>read, create, update, and delete Runtime Fabric resources.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Runtime Fabric</p></div></div></td><td><div><div><p>Read, create, update, and delete Runtime Fabric resources.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Schedules</p></div></div></td><td><div><div><p>Run and update application schedules in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Settings</p></div></div></td><td><div><div><p>Update application settings in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Tenants</p></div></div></td><td><div><div><p>Create, update, and delete application tenants in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Read Alerts</p></div></div></td><td><div><div><p>View alerts in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Read Applications</p></div></div></td><td><div><div><p>View applications in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Servers</p></div></div></td><td><div><div><p>Create, update, and delete server and Omni Gateway resources.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Read Servers</p></div></div></td><td><div><div><p>View server and Omni Gateway resources.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Application Flows</p></div></div></td><td><div><div><p>Update flows.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Create Applications</p></div></div></td><td><div><div><p>Create applications in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Restart Applications</p></div></div></td><td><div><div><p>Restart applications deployed to Runtime Fabric in a specific environment.</p></div></div></td><td><div></div></td></tr></tbody></table>

## Secrets Manager

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Grant access to secrets</p></div></div></td><td><div><div><p>Browse, read metadata and grant access to secrets in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage secret groups</p></div></div></td><td><div><div><ul><li><p>Create, modify, delete, read, and clone secret groups in a specific environment.</p></li><li><p>Check if the user can initiate a new clone or restore operation.</p></li></ul></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Read secrets metadata</p></div></div></td><td><div><div><p>Browse and read metadata of secrets in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Write secrets</p></div></div></td><td><div><div><p>Upload, create, modify secrets in a specific environment.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>View Vault Integrations</p></div></div></td><td><div><div><p>List and view external vault integrations and their sync activity and health checks in a specific environment.</p></div></div></td><td><div><div><p>This permission applies only to the enhanced experience.</p></div></div></td></tr><tr><td><div><div><p>Manage Vault Integrations</p></div></div></td><td><div><div><p>Create, edit, delete, test, and sync external vault integrations in a specific environment. Extends the View Vault Integrations permission.</p></div></div></td><td><div><div><p>This permission applies only to the enhanced experience.</p></div></div></td></tr></tbody></table>

## Tokenization

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Manage Tokenization Services</p></div></div></td><td><div><div><p>View, create, edit, and delete tokenization resources.</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Manage Tokenization Formats</p></div></div></td><td><div><div><p>View, create, edit, and delete tokenization formats.</p></div></div></td><td><div></div></td></tr></tbody></table>

## Usage

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Required Permissions</th><th>Grants the Ability to</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Usage Viewer</p></div></div></td><td><div><div><p>View usage reports.</p></div></div></td><td><div><div><p>This permission can be added only by an organization administrator at the root organization level.</p></div></div></td></tr></tbody></table>