Fine-grained permissions for CI/CD job tokens
- Tier: Free, Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Status: Experiment
Available API endpoints
The following endpoints are available for CI/CD job tokens. You can use fine-grained permissions to explicitly allow access to a limited set of the following API endpoints.
None means fine-grained permissions cannot control access to this endpoint.
| Permissions | Permission Names | Path | Description |
|---|---|---|---|
| Deployments: Read and write | ADMIN_DEPLOYMENTS |
DELETE /projects/:id/deployments/:deployment_id |
Delete a specific deployment |
| Deployments: Read and write | ADMIN_DEPLOYMENTS |
POST /projects/:id/deployments/:deployment_id/approval |
Approve or reject a blocked deployment |
| Deployments: Read and write | ADMIN_DEPLOYMENTS |
PUT /projects/:id/deployments/:deployment_id |
Update a deployment |
| Deployments: Read and write, Environments: Read and write | ADMIN_DEPLOYMENTS, ADMIN_ENVIRONMENTS |
POST /projects/:id/deployments |
Create a deployment |
| Deployments: Read | READ_DEPLOYMENTS |
GET /projects/:id/deployments/:deployment_id/merge_requests |
List of merge requests associated with a deployment |
| Deployments: Read | READ_DEPLOYMENTS |
GET /projects/:id/deployments/:deployment_id |
Get a specific deployment |
| Deployments: Read | READ_DEPLOYMENTS |
GET /projects/:id/deployments |
List project deployments |
| Environments: Read and write | ADMIN_ENVIRONMENTS |
DELETE /projects/:id/environments/:environment_id |
Delete an environment |
| Environments: Read and write | ADMIN_ENVIRONMENTS |
DELETE /projects/:id/environments/review_apps |
Delete multiple stopped review apps |
| Environments: Read and write | ADMIN_ENVIRONMENTS |
POST /projects/:id/environments/:environment_id/stop |
Stop an environment |
| Environments: Read and write | ADMIN_ENVIRONMENTS |
POST /projects/:id/environments/stop_stale |
Stop stale environments |
| Environments: Read and write | ADMIN_ENVIRONMENTS |
POST /projects/:id/environments |
Create a new environment |
| Environments: Read and write | ADMIN_ENVIRONMENTS |
PUT /projects/:id/environments/:environment_id |
Update an existing environment |
| Environments: Read | READ_ENVIRONMENTS |
GET /projects/:id/environments/:environment_id |
Get a specific environment |
| Environments: Read | READ_ENVIRONMENTS |
GET /projects/:id/environments |
List environments |
| Jobs: Read and write | ADMIN_JOBS |
PUT /projects/:id/pipelines/:pipeline_id/metadata |
Updates pipeline metadata |
| Jobs: Read | READ_JOBS |
GET /jobs/:id/artifacts |
Download the artifacts file for job |
| Jobs: Read | READ_JOBS |
GET /projects/:id/jobs/:job_id/artifacts/*artifact_path |
Download a specific file from artifacts archive |
| Jobs: Read | READ_JOBS |
GET /projects/:id/jobs/:job_id/artifacts |
Download the artifacts archive from a job |
| Jobs: Read | READ_JOBS |
GET /projects/:id/jobs/artifacts/:ref_name/download |
Download the artifacts archive from a job |
| Jobs: Read | READ_JOBS |
GET /projects/:id/jobs/artifacts/:ref_name/raw/*artifact_path |
Download a specific file from artifacts archive from a ref |
| None | DELETE /projects/:id/registry/repositories/:repository_id/tags/:tag_name |
Delete repository tag | |
| None | DELETE /projects/:id/registry/repositories/:repository_id/tags |
Delete repository tags (in bulk) | |
| None | DELETE /projects/:id/registry/repositories/:repository_id |
Delete repository | |
| None | GET /group/:id/-/packages/composer/*package_name |
Composer packages endpoint at group level for package versions metadata | |
| None | GET /group/:id/-/packages/composer/p/:sha |
Composer packages endpoint at group level for packages list | |
| None | GET /group/:id/-/packages/composer/p2/*package_name |
Composer v2 packages p2 endpoint at group level for package versions metadata | |
| None | GET /group/:id/-/packages/composer/packages |
Composer packages endpoint at group level | |
| None | GET /groups/:id/-/packages/pypi/simple/*package_name |
The PyPi Simple Group Package Endpoint | |
| None | GET /groups/:id/-/packages/pypi/simple |
The PyPi Simple Group Index Endpoint | |
| None | GET /job/allowed_agents |
Get current agents | |
| None | GET /job |
Get current job using job token | |
| None | GET /packages/conan/v1/conans/search |
Search for packages | |
| None | GET /packages/conan/v1/ping |
Ping the Conan API | |
| None | GET /packages/conan/v1/users/authenticate |
Authenticate user against conan CLI | |
| None | GET /packages/conan/v1/users/check_credentials |
Check for valid user credentials per conan CLI | |
| None | GET /projects/:id/packages/conan/v1/conans/search |
Search for packages | |
| None | GET /projects/:id/packages/conan/v1/ping |
Ping the Conan API | |
| None | GET /projects/:id/packages/conan/v1/users/authenticate |
Authenticate user against conan CLI | |
| None | GET /projects/:id/packages/conan/v1/users/check_credentials |
Check for valid user credentials per conan CLI | |
| None | GET /projects/:id/packages/conan/v2/conans/search |
Search for packages | |
| None | GET /projects/:id/packages/conan/v2/users/check_credentials |
Check for valid user credentials per conan CLI | |
| None | GET /projects/:id/registry/repositories/:repository_id/tags/:tag_name |
Get details about a repository tag | |
| None | GET /projects/:id/registry/repositories/:repository_id/tags |
List tags of a repository | |
| None | GET /projects/:id/registry/repositories |
List container repositories within a project | |
| None | POST /internal/dast/site_validations/:id/transition |
Transitions a DAST site validation to a new state. | |
| Packages: Read and write | ADMIN_PACKAGES |
DELETE /groups/:id/-/packages/npm/-/package/*package_name/dist-tags/:tag |
Deletes the given tag |
| Packages: Read and write | ADMIN_PACKAGES |
DELETE /packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel |
Delete Package |
| Packages: Read and write | ADMIN_PACKAGES |
DELETE /packages/npm/-/package/*package_name/dist-tags/:tag |
Deletes the given tag |
| Packages: Read and write | ADMIN_PACKAGES |
DELETE /projects/:id/packages/:package_id/package_files/:package_file_id |
Delete a package file |
| Packages: Read and write | ADMIN_PACKAGES |
DELETE /projects/:id/packages/:package_id |
Delete a project package |
| Packages: Read and write | ADMIN_PACKAGES |
DELETE /projects/:id/packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel |
Delete Package |
| Packages: Read and write | ADMIN_PACKAGES |
DELETE /projects/:id/packages/npm/-/package/*package_name/dist-tags/:tag |
Deletes the given tag |
| Packages: Read and write | ADMIN_PACKAGES |
POST /projects/:id/packages/composer |
Composer packages endpoint for registering packages |
| Packages: Read and write | ADMIN_PACKAGES |
POST /projects/:id/packages/pypi/authorize |
Authorize the PyPi package upload from workhorse |
| Packages: Read and write | ADMIN_PACKAGES |
POST /projects/:id/packages/pypi |
The PyPi Package upload endpoint |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /groups/:id/-/packages/npm/-/package/*package_name/dist-tags/:tag |
Create or Update the given tag for the given NPM package and version |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/export/:file_name/authorize |
Workhorse authorize the conan recipe file |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/export/:file_name |
Upload recipe package files |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/package/:conan_package_reference/:package_revision/:file_name/authorize |
Workhorse authorize the conan package file |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/package/:conan_package_reference/:package_revision/:file_name |
Upload package files |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /packages/npm/-/package/*package_name/dist-tags/:tag |
Create or Update the given tag for the given NPM package and version |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /projects/:id/packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/export/:file_name/authorize |
Workhorse authorize the conan recipe file |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /projects/:id/packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/export/:file_name |
Upload recipe package files |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /projects/:id/packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/package/:conan_package_reference/:package_revision/:file_name/authorize |
Workhorse authorize the conan package file |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /projects/:id/packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/package/:conan_package_reference/:package_revision/:file_name |
Upload package files |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /projects/:id/packages/generic/:package_name/*package_version/(*path/):file_name/authorize |
Workhorse authorize generic package file |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /projects/:id/packages/generic/:package_name/*package_version/(*path/):file_name |
Upload package file |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /projects/:id/packages/maven/*path/:file_name/authorize |
Workhorse authorize the maven package file upload |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /projects/:id/packages/maven/*path/:file_name |
Upload the maven package file |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /projects/:id/packages/npm/-/package/*package_name/dist-tags/:tag |
Create or Update the given tag for the given NPM package and version |
| Packages: Read and write | ADMIN_PACKAGES |
PUT /projects/:id/packages/npm/:package_name |
Create or deprecate NPM package |
| Packages: Read | READ_PACKAGES |
GET /groups/:id/-/packages/maven/*path/:file_name |
Download the maven package file at a group level |
| Packages: Read | READ_PACKAGES |
GET /groups/:id/-/packages/npm/*package_name |
NPM registry metadata endpoint |
| Packages: Read | READ_PACKAGES |
GET /groups/:id/-/packages/npm/-/package/*package_name/dist-tags |
Get all tags for a given an NPM package |
| Packages: Read | READ_PACKAGES |
GET /groups/:id/-/packages/pypi/files/:sha256/*file_identifier |
Download a package file from a group |
| Packages: Read | READ_PACKAGES |
GET /packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/digest |
Recipe Digest |
| Packages: Read | READ_PACKAGES |
GET /packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/download_urls |
Recipe Download Urls |
| Packages: Read | READ_PACKAGES |
GET /packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/packages/:conan_package_reference/digest |
Package Digest |
| Packages: Read | READ_PACKAGES |
GET /packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/packages/:conan_package_reference/download_urls |
Package Download Urls |
| Packages: Read | READ_PACKAGES |
GET /packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/packages/:conan_package_reference |
Package Snapshot |
| Packages: Read | READ_PACKAGES |
GET /packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel |
Recipe Snapshot |
| Packages: Read | READ_PACKAGES |
GET /packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/export/:file_name |
Download recipe files |
| Packages: Read | READ_PACKAGES |
GET /packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/package/:conan_package_reference/:package_revision/:file_name |
Download package files |
| Packages: Read | READ_PACKAGES |
GET /packages/maven/*path/:file_name |
Download the maven package file at instance level |
| Packages: Read | READ_PACKAGES |
GET /packages/npm/*package_name |
NPM registry metadata endpoint |
| Packages: Read | READ_PACKAGES |
GET /packages/npm/-/package/*package_name/dist-tags |
Get all tags for a given an NPM package |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/:package_id/package_files |
List package files |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/:package_id/pipelines |
Get the pipelines for a single project package |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/:package_id |
Get a single project package |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/composer/archives/*package_name |
Composer package endpoint to download a package archive |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/digest |
Recipe Digest |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/download_urls |
Recipe Download Urls |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/packages/:conan_package_reference/digest |
Package Digest |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/packages/:conan_package_reference/download_urls |
Package Download Urls |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/packages/:conan_package_reference |
Package Snapshot |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel |
Recipe Snapshot |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/export/:file_name |
Download recipe files |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/conan/v1/files/:package_name/:package_version/:package_username/:package_channel/:recipe_revision/package/:conan_package_reference/:package_revision/:file_name |
Download package files |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/conan/v2/conans/:package_name/:package_version/:package_username/:package_channel/revisions/:recipe_revision/files/:file_name |
Download recipe files |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/generic/:package_name/*package_version/(*path/):file_name |
Download package file |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/go/*module_name/@v/:module_version.info |
Version metadata |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/go/*module_name/@v/:module_version.mod |
Download module file |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/go/*module_name/@v/:module_version.zip |
Download module source |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/go/*module_name/@v/list |
List |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/maven/*path/:file_name |
Download the maven package file at a project level |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/npm/*package_name/-/*file_name |
Download the NPM tarball |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/npm/*package_name |
NPM registry metadata endpoint |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/npm/-/package/*package_name/dist-tags |
Get all tags for a given an NPM package |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/pypi/files/:sha256/*file_identifier |
The PyPi package download endpoint |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/pypi/simple/*package_name |
The PyPi Simple Project Package Endpoint |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages/pypi/simple |
The PyPi Simple Project Index Endpoint |
| Packages: Read | READ_PACKAGES |
GET /projects/:id/packages |
Get a list of project packages |
| Packages: Read | READ_PACKAGES |
POST /groups/:id/-/packages/npm/-/npm/v1/security/advisories/bulk |
NPM registry bulk advisory endpoint |
| Packages: Read | READ_PACKAGES |
POST /groups/:id/-/packages/npm/-/npm/v1/security/audits/quick |
NPM registry quick audit endpoint |
| Packages: Read | READ_PACKAGES |
POST /packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/packages/:conan_package_reference/upload_urls |
Package Upload Urls |
| Packages: Read | READ_PACKAGES |
POST /packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/upload_urls |
Recipe Upload Urls |
| Packages: Read | READ_PACKAGES |
POST /packages/npm/-/npm/v1/security/advisories/bulk |
NPM registry bulk advisory endpoint |
| Packages: Read | READ_PACKAGES |
POST /packages/npm/-/npm/v1/security/audits/quick |
NPM registry quick audit endpoint |
| Packages: Read | READ_PACKAGES |
POST /projects/:id/packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/packages/:conan_package_reference/upload_urls |
Package Upload Urls |
| Packages: Read | READ_PACKAGES |
POST /projects/:id/packages/conan/v1/conans/:package_name/:package_version/:package_username/:package_channel/upload_urls |
Recipe Upload Urls |
| Packages: Read | READ_PACKAGES |
POST /projects/:id/packages/npm/-/npm/v1/security/advisories/bulk |
NPM registry bulk advisory endpoint |
| Packages: Read | READ_PACKAGES |
POST /projects/:id/packages/npm/-/npm/v1/security/audits/quick |
NPM registry quick audit endpoint |
| Releases: Read and write | ADMIN_RELEASES |
DELETE /projects/:id/releases/:tag_name/assets/links/:link_id |
Delete a release link |
| Releases: Read and write | ADMIN_RELEASES |
DELETE /projects/:id/releases/:tag_name |
Delete a release |
| Releases: Read and write | ADMIN_RELEASES |
POST /projects/:id/catalog/publish |
Publish a new component project release as version to the CI/CD catalog |
| Releases: Read and write | ADMIN_RELEASES |
POST /projects/:id/releases/:tag_name/assets/links |
Create a release link |
| Releases: Read and write | ADMIN_RELEASES |
POST /projects/:id/releases/:tag_name/evidence |
Collect release evidence |
| Releases: Read and write | ADMIN_RELEASES |
POST /projects/:id/releases |
Create a release |
| Releases: Read and write | ADMIN_RELEASES |
PUT /projects/:id/releases/:tag_name/assets/links/:link_id |
Update a release link |
| Releases: Read and write | ADMIN_RELEASES |
PUT /projects/:id/releases/:tag_name |
Update a release |
| Releases: Read | READ_RELEASES |
GET /projects/:id/releases/:tag_name/assets/links/:link_id |
Get a release link |
| Releases: Read | READ_RELEASES |
GET /projects/:id/releases/:tag_name/assets/links |
List links of a release |
| Releases: Read | READ_RELEASES |
GET /projects/:id/releases/:tag_name/downloads/*direct_asset_path |
Download a project release asset file |
| Releases: Read | READ_RELEASES |
GET /projects/:id/releases/:tag_name |
Get a release by a tag name |
| Releases: Read | READ_RELEASES |
GET /projects/:id/releases/permalink/latest(/)(*suffix_path) |
Get the latest project release |
| Releases: Read | READ_RELEASES |
GET /projects/:id/releases |
List Releases |
| Releases: Read | READ_RELEASES |
GET /projects/:id/repository/changelog |
Generates a changelog section for a release and returns it |
| Secure files: Read and write | ADMIN_SECURE_FILES |
DELETE /projects/:id/secure_files/:secure_file_id |
Remove a secure file |
| Secure files: Read and write | ADMIN_SECURE_FILES |
POST /projects/:id/secure_files |
Create a secure file |
| Secure files: Read | READ_SECURE_FILES |
GET /projects/:id/secure_files/:secure_file_id/download |
Download secure file |
| Secure files: Read | READ_SECURE_FILES |
GET /projects/:id/secure_files/:secure_file_id |
Get the details of a specific secure file in a project |
| Secure files: Read | READ_SECURE_FILES |
GET /projects/:id/secure_files |
Get list of secure files in a project |
| Terraform state: Read and write | ADMIN_TERRAFORM_STATE |
DELETE /projects/:id/terraform/state/:name/lock |
Unlock a Terraform state of a certain name |
| Terraform state: Read and write | ADMIN_TERRAFORM_STATE |
DELETE /projects/:id/terraform/state/:name/versions/:serial |
Delete a Terraform state version |
| Terraform state: Read and write | ADMIN_TERRAFORM_STATE |
DELETE /projects/:id/terraform/state/:name |
Delete a Terraform state of a certain name |
| Terraform state: Read and write | ADMIN_TERRAFORM_STATE |
POST /projects/:id/terraform/state/:name/lock |
Lock a Terraform state of a certain name |
| Terraform state: Read and write | ADMIN_TERRAFORM_STATE |
POST /projects/:id/terraform/state/:name |
Add a new Terraform state or update an existing one |
| Terraform state: Read | READ_TERRAFORM_STATE |
GET /projects/:id/terraform/state/:name/versions/:serial |
Get a Terraform state version |
| Terraform state: Read | READ_TERRAFORM_STATE |
GET /projects/:id/terraform/state/:name |
Get a Terraform state by its name |
Docs
Edit this page to fix an error or add an improvement in a merge request.
Create an issue to suggest an improvement to this page.
Product
Create an issue if there's something you don't like about this feature.
Propose functionality by submitting a feature request.
Feature availability and product trials
View pricing to see all GitLab tiers and features, or to upgrade.
Try GitLab for free with access to all features for 30 days.
Get help
If you didn't find what you were looking for, search the docs.
If you want help with something specific and could use community support, post on the GitLab forum.
For problems setting up or using this feature (depending on your GitLab subscription).
Request support