Fine-grained permissions for personal access tokens in the GraphQL API
- Tier: Free, Premium, Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
- Status: Beta
Fine-grained personal access tokens scope access to specific permissions in the GraphQL API. To create a fine-grained personal access token, see Fine-grained permissions for personal access tokens.
Available fine-grained permissions
Fine-grained personal access tokens can access the following GraphQL types, mutations, and fields:
Application Security resources
Dependency
Grants the ability to read dependencies.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Project | Type | DependencyLocation |
Vulnerability
Grants the ability to create, read, and update vulnerabilities.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | VulnerabilityCreate |
| Read | Project | Type | CountableVulnerability |
| Read | Project | Type | Vulnerability |
| Update | Project | Mutation | VulnerabilityConfirm |
| Update | Project | Mutation | VulnerabilityDismiss |
| Update | Project | Mutation | VulnerabilityResolve |
| Update | Project | Mutation | VulnerabilityRevertToDetected |
CI/CD resources
CI Config
Grants the ability to read and validate CI/CD configuration.
| Action | Access | Kind | Name |
|---|---|---|---|
| Validate | Project | Mutation | CiLint |
CI/CD Setting
Grants the ability to update CI/CD settings.
| Action | Access | Kind | Name |
|---|---|---|---|
| Update | Project | Mutation | ProjectCiCdSettingsUpdate |
| Update | Group | Mutation | SafeDisablePipelineVariables |
Catalog Resource
Grants the ability to create and delete CI catalog resources.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | CatalogResourcesCreate |
| Delete | Project | Mutation | CatalogResourcesDestroy |
Cd Application
Grants the ability to create and read cd applications.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Group | Mutation | CdApplicationCreate |
| Create | Instance | Mutation | CdApplicationCreate |
| Read | Group | Type | CdApplication |
| Read | Instance | Type | CdApplication |
Cd Environment
Grants the ability to create and read cd environments.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Group | Mutation | CdEnvironmentCreate |
| Create | Instance | Mutation | CdEnvironmentCreate |
| Read | Group | Type | CdEnvironment |
| Read | Instance | Type | CdEnvironment |
Cluster Agent
Grants the ability to create, delete, and read cluster agents.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | CreateClusterAgent |
| Delete | Project | Mutation | ClusterAgentDelete |
| Read | Project | Type | ClusterAgent |
Cluster Agent Token
Grants the ability to create, read, and revoke cluster agent tokens.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | ClusterAgentTokenCreate |
Cluster Agent URL Configuration
Grants the ability to create, delete, and read cluster agent URL configurations.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | ClusterAgentUrlConfigurationCreate |
| Delete | Project | Mutation | ClusterAgentUrlConfigurationDelete |
Deployment
Grants the ability to approve, create, delete, read, and update deployments.
| Action | Access | Kind | Name |
|---|---|---|---|
| Approve | Project | Mutation | ApproveDeployment |
Environment
Grants the ability to create, delete, read, stop, and update environments.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | EnvironmentCreate |
| Delete | Project | Mutation | EnvironmentDelete |
| Read | Project | Type | Environment |
| Stop | Project | Mutation | EnvironmentStop |
| Update | Project | Mutation | EnvironmentUpdate |
Freeze Period
Grants the ability to create, delete, read, and update freeze periods.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Project | Type | CiFreezePeriod |
Job
Grants the ability to delete, read, run, and update jobs.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Project | Type | CiJob |
| Run | Project | Mutation | JobPlay |
| Run | Project | Mutation | JobRetry |
| Update | Project | Mutation | JobCancel |
| Update | Project | Mutation | JobUnschedule |
Job Artifact
Grants the ability to delete, read, and update job artifacts.
| Action | Access | Kind | Name |
|---|---|---|---|
| Delete | Project | Mutation | ArtifactDestroy |
| Delete | Project | Mutation | BulkDestroyJobArtifacts |
| Delete | Project | Mutation | JobArtifactsDestroy |
| Read | Project | Type | CiJobArtifact |
Pipeline
Grants the ability to create, delete, read, and update pipelines.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | PipelineCreate |
| Delete | Project | Mutation | PipelineDestroy |
| Read | Project | Type | CiStage |
| Read | Project | Type | Pipeline |
| Update | Project | Mutation | PipelineCancel |
| Update | Project | Mutation | PipelineRetry |
Pipeline Schedule
Grants the ability to create, delete, read, and update pipeline schedules.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | PipelineScheduleCreate |
| Delete | Project | Mutation | PipelineScheduleDelete |
| Read | Project | Type | PipelineSchedule |
| Read | Project | Field | Project.pipelineSchedules |
| Update | Project | Mutation | PipelineSchedulePlay |
| Update | Project | Mutation | PipelineScheduleTakeOwnership |
| Update | Project | Mutation | PipelineScheduleUpdate |
Runner
Grants the ability to assign, create, delete, read, and update runners.
| Action | Access | Kind | Name |
|---|---|---|---|
| Assign | Project | Mutation | RunnerAssignToProject |
| Assign | Project | Mutation | RunnerUnassignFromProject |
| Create | Project | Mutation | RunnerCreate |
| Create | Group | Mutation | RunnerCreate |
| Create | Instance | Mutation | RunnerCreate |
| Delete | Project | Mutation | RunnerDelete |
| Delete | Group | Mutation | RunnerDelete |
| Delete | Instance | Mutation | RunnerDelete |
| Read | Project | Type | CiRunner |
| Read | Project | Field | Project.runners |
| Read | Project | Field | Query.runner |
| Read | Group | Type | CiRunner |
| Read | Group | Field | Group.runners |
| Read | Group | Field | Query.runner |
| Read | Instance | Type | CiRunner |
| Read | Instance | Field | Query.runner |
| Read | Instance | Field | Query.runners |
| Update | Project | Mutation | RunnerCacheClear |
| Update | Project | Mutation | RunnerUpdate |
| Update | Group | Mutation | RunnerUpdate |
| Update | Instance | Mutation | RunnerUpdate |
Terraform State
Grants the ability to create, delete, lock, read, and update Terraform state.
| Action | Access | Kind | Name |
|---|---|---|---|
| Delete | Project | Mutation | TerraformStateDelete |
| Lock | Project | Mutation | TerraformStateLock |
| Lock | Project | Mutation | TerraformStateUnlock |
| Read | Project | Type | TerraformState |
| Read | Project | Type | TerraformStateProtectionRule |
| Read | Project | Type | TerraformStateVersion |
| Update | Project | Mutation | UpdateTerraformStateProtectionRule |
Terraform State Protection Rule
Grants the ability to create and delete Terraform state protection rules.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | CreateTerraformStateProtectionRule |
| Delete | Project | Mutation | DeleteTerraformStateProtectionRule |
Trigger
Grants the ability to create, delete, read, and update triggers.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | PipelineTriggerCreate |
| Delete | Project | Mutation | PipelineTriggerDelete |
| Read | Project | Type | PipelineTrigger |
| Update | Project | Mutation | PipelineTriggerUpdate |
Duo resources
Model Selection Allowlist
Grants the ability to read model selection allowlists.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Group | Type | AiModelSelectionAllowList |
| Read | Group | Type | AiModelSelectionAllowListModel |
| Read | Instance | Type | AiModelSelectionAllowList |
| Read | Instance | Type | AiModelSelectionAllowListModel |
Groups resources
Admin Member Role
Grants the ability to create, delete, read, and update admin member roles.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Instance | Mutation | MemberRoleAdminCreate |
| Delete | Instance | Mutation | MemberRoleAdminDelete |
| Read | Instance | Type | AdminMemberRole |
| Update | Instance | Mutation | MemberRoleAdminUpdate |
Group
Grants the ability to archive, create, delete, read, share, transfer, and update groups.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Group | Type | Group |
| Read | Group | Field | Query.group |
| Update | Group | Mutation | GroupUpdate |
LDAP Admin Role Link
Grants the ability to create, delete, and read LDAP admin role links
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Instance | Mutation | AdminRolesLdapSync |
| Create | Instance | Mutation | LdapAdminRoleLinkCreate |
| Delete | Instance | Mutation | LdapAdminRoleLinkDestroy |
| Read | Instance | Type | LdapAdminRoleLink |
Member Role
Grants the ability to create, delete, and read member roles.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Group | Mutation | MemberRoleCreate |
| Create | Instance | Mutation | MemberRoleCreate |
Preference
Grants the ability to read and update preferences.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | User | Type | UserPreferences |
| Update | User | Mutation | UserPreferencesUpdate |
Topic
Grants the ability to create, delete, merge, read, and update topics.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Instance | Type | Topic |
Organizations resources
Organization
Grants the ability to create, read, and update organizations.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Instance | Mutation | OrganizationCreate |
| Read | Instance | Type | Organization |
| Read | Instance | Type | OrganizationUser |
| Read | Instance | Field | Query.organization |
| Read | Instance | Field | Query.organizations |
| Update | Instance | Mutation | OrganizationUpdate |
| Update | Instance | Mutation | OrganizationUserUpdate |
Packages And Registry resources
Container Registry Protection Tag Rule
Grants the ability to create, delete, read, and update container registry protection tag rules.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | createContainerProtectionTagRule |
| Delete | Project | Mutation | DeleteContainerProtectionTagRule |
| Update | Project | Mutation | UpdateContainerProtectionTagRule |
Container Repository
Grants the ability to delete and read container repositories.
| Action | Access | Kind | Name |
|---|---|---|---|
| Delete | Project | Mutation | DestroyContainerRepository |
| Delete | Project | Mutation | DestroyContainerRepositoryTags |
Container Repository Protection Rule
Grants the ability to create, delete, read, and update container repository protection rules.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | CreateContainerProtectionRepositoryRule |
| Delete | Project | Mutation | DeleteContainerProtectionRepositoryRule |
| Update | Project | Mutation | UpdateContainerProtectionRepositoryRule |
Dependency Proxy
Grants the ability to update dependency proxies.
| Action | Access | Kind | Name |
|---|---|---|---|
| Update | Group | Mutation | UpdateDependencyProxyImageTtlGroupPolicy |
| Update | Group | Mutation | UpdateDependencyProxySettings |
Package
Grants the ability to create, delete, read, and update packages.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | CreatePackagesProtectionRule |
| Delete | Project | Mutation | DeletePackagesProtectionRule |
| Delete | Project | Mutation | DestroyPackage |
| Delete | Project | Mutation | DestroyPackageFile |
| Delete | Project | Mutation | DestroyPackageFiles |
| Update | Project | Mutation | UpdatePackagesCleanupPolicy |
| Update | Project | Mutation | UpdatePackagesProtectionRule |
Project Features resources
Badge
Grants the ability to create, delete, read, and update badges.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Instance | Type | OrganizationUserBadge |
Release
Grants the ability to create, delete, read, and update releases.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | ReleaseAssetLinkCreate |
| Create | Project | Mutation | ReleaseCreate |
| Delete | Project | Mutation | ReleaseDelete |
| Update | Project | Mutation | ReleaseUpdate |
Snippet
Grants the ability to create, delete, read, and update snippets.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | CreateSnippet |
| Create | User | Mutation | CreateSnippet |
| Delete | Project | Mutation | DestroySnippet |
| Delete | User | Mutation | DestroySnippet |
| Update | Project | Mutation | UpdateSnippet |
| Update | User | Mutation | UpdateSnippet |
Project Model Registry And Experiments resources
Model Version
Grants the ability to create, delete, and update model versions.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | MlModelVersionCreate |
| Delete | Project | Mutation | MlModelVersionDelete |
| Update | Project | Mutation | MlModelVersionEdit |
Project Planning resources
Custom Attribute
Grants the ability to delete, read, and update custom attributes.
| Action | Access | Kind | Name |
|---|---|---|---|
| Delete | Project | Mutation | DeleteProjectCustomAttribute |
| Delete | Group | Mutation | DeleteGroupCustomAttribute |
| Update | Project | Mutation | ProjectCustomAttributeSet |
| Update | Group | Mutation | SetGroupCustomAttribute |
Label
Grants the ability to create, delete, promote, read, and update labels.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | LabelCreate |
| Create | Group | Mutation | LabelCreate |
| Read | Project | Type | Label |
| Read | Group | Type | Label |
| Update | Project | Mutation | LabelUpdate |
| Update | Group | Mutation | LabelUpdate |
Work Item
Grants the ability to create, delete, read, and update work items such as epics and issues.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | CreateIssue |
| Create | Project | Field | EpicIssue.createNoteEmail |
| Create | Project | Field | Issue.createNoteEmail |
| Create | Project | Field | WorkItem.createNoteEmail |
| Create | Group | Mutation | IterationCadenceCreate |
| Delete | Group | Mutation | IterationCadenceDestroy |
| Delete | Group | Mutation | IterationDelete |
| Read | Project | Type | EpicIssue |
| Read | Project | Type | Issue |
| Read | Project | Type | Milestone |
| Read | Project | Type | WorkItem |
| Read | Group | Type | Iteration |
| Read | Group | Type | IterationCadence |
| Read | Group | Type | Milestone |
| Update | Project | Mutation | IssueLinkAlerts |
| Update | Project | Mutation | IssueMove |
| Update | Project | Mutation | IssueSetAssignees |
| Update | Project | Mutation | IssueSetConfidential |
| Update | Project | Mutation | IssueSetCrmContacts |
| Update | Project | Mutation | IssueSetDueDate |
| Update | Project | Mutation | IssueSetEpic |
| Update | Project | Mutation | IssueSetEscalationPolicy |
| Update | Project | Mutation | IssueSetEscalationStatus |
| Update | Project | Mutation | IssueSetIteration |
| Update | Project | Mutation | IssueSetLocked |
| Update | Project | Mutation | IssueSetSeverity |
| Update | Project | Mutation | IssueSetWeight |
| Update | Project | Mutation | IssueUnlinkAlert |
| Update | Project | Mutation | UpdateIssue |
| Update | Group | Mutation | IterationCadenceUpdate |
| Update | Group | Mutation | UpdateIteration |
Projects resources
Markdown Upload
Grants the ability to create, delete, and read Markdown uploads.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | UploadCreate |
| Create | Group | Mutation | UploadCreate |
| Delete | Project | Mutation | UploadDelete |
| Delete | Group | Mutation | UploadDelete |
Page
Grants the ability to delete, read, and update pages.
| Action | Access | Kind | Name |
|---|---|---|---|
| Delete | Project | Mutation | DeletePagesDeployment |
| Delete | Project | Mutation | RestorePagesDeployment |
| Read | Project | Type | PagesDeployment |
| Update | Project | Mutation | PagesMarkOnboardingComplete |
| Update | Project | Mutation | SetPagesForceHttps |
| Update | Project | Mutation | SetPagesUseUniqueDomain |
Project
Grants the ability to archive, create, delete, fork, read, share, transfer, and update projects.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Project | Type | Project |
| Read | Project | Type | RepositoryLanguage |
| Read | Project | Field | Query.project |
| Update | Project | Mutation | ProjectSettingsUpdate |
| Update | Project | Mutation | StarProject |
Repository resources
Approval Rule
Grants the ability to create, delete, read, and update approval rules.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | branchRuleApprovalProjectRuleCreate |
| Delete | Project | Mutation | approvalProjectRuleDelete |
| Read | Project | Type | ApprovalProjectRule |
| Read | Project | Type | ApprovalRule |
| Update | Project | Mutation | MergeRequestUpdateApprovalRule |
| Update | Project | Mutation | approvalProjectRuleUpdate |
Branch
Grants the ability to create, delete, protect, and read branches.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | CreateBranch |
| Delete | Project | Mutation | BranchDelete |
| Read | Project | Type | Branch |
Branch Rule
Grants the ability to create and update branch rules.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | BranchRuleCreate |
| Update | Project | Mutation | BranchRuleUpdate |
Code
Grants the ability to download, push, and read code via Git.
| Action | Access | Kind | Name |
|---|---|---|---|
| Push | Project | Mutation | CommitCreate |
| Push | Project | Mutation | ProjectSyncFork |
| Read | Project | Type | Commit |
| Read | Project | Type | Repository |
Merge Request
Grants the ability to approve, create, delete, merge, read, and update merge requests.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Project | Type | MergeRequestApprovalState |
Push Rule
Grants the ability to create, delete, read, and update push rules.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Project | Type | PushRules |
Repository
Grants the ability to create, delete, read, and update repositories.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Project | Type | Blob |
| Read | Project | Type | RepositoryBlob |
| Read | Project | Type | Tree |
Repository Tag
Grants the ability to create, delete, and read repository tags.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | TagCreate |
| Delete | Project | Mutation | TagDelete |
| Read | Project | Type | Tag |
System Access resources
Grants the ability to create, delete, and read emails.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | User | Type | Email |
Job Token Scope
Grants the ability to read and update job token scopes.
| Action | Access | Kind | Name |
|---|---|---|---|
| Update | Project | Mutation | CiJobTokenScopeUpdatePolicies |
Job Token Scope Allowlist
Grants the ability to create, delete, and read job token scope allowlists.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | Project | Mutation | CiJobTokenScopeAddGroupOrProject |
| Create | Project | Mutation | CiJobTokenScopeAddProject |
| Delete | Project | Mutation | CiJobTokenScopeRemoveGroup |
| Delete | Project | Mutation | CiJobTokenScopeRemoveProject |
Member
Grants the ability to create, delete, read, and update members.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Project | Type | ProjectMember |
| Read | Group | Type | GroupMember |
| Update | Project | Mutation | ProjectMemberBulkUpdate |
| Update | Group | Mutation | GroupMemberBulkUpdate |
Metadata
Grants the ability to read instance metadata.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | Instance | Type | GitlabInstanceFeatureFlag |
| Read | Instance | Type | Kas |
| Read | Instance | Type | Metadata |
Personal Access Token
Grants the ability to create, read, revoke, and rotate personal access tokens.
| Action | Access | Kind | Name |
|---|---|---|---|
| Create | User | Mutation | PersonalAccessTokenCreate |
| Revoke | User | Mutation | PersonalAccessTokenRevoke |
| Rotate | User | Mutation | PersonalAccessTokenRotate |
User
Grants the ability to follow, read, and unfollow users.
| Action | Access | Kind | Name |
|---|---|---|---|
| Read | User | Type | AddOnUser |
| Read | User | Type | AutocompletedUser |
| Read | User | Type | CurrentUser |
| Read | User | Type | MergeRequestAssignee |
| Read | User | Type | MergeRequestAuthor |
| Read | User | Type | MergeRequestParticipant |
| Read | User | Type | MergeRequestReviewer |
| Read | User | Type | UserCore |