Operations to permissions mapping
The tables below list each PubNub API operation, the resource it targets, and the permission flag it requires when Access Manager is enabled on a keyset.
Chat SDK
For Chat SDK method to Access Manager permission mappings, see Security and permissions.
Pub/Sub
Pub/Sub sends and receives messages on channels. These operations need permissions on the channel or channel group they target.
| Operation | Resource | Permission |
|---|---|---|
| Publish on channel | Channel | write |
| Signal on channel | Channel | write |
| Subscribe to channel | Channel | read |
| Subscribe to presence channel | Presence channel (-pnpres) | read |
| Subscribe to channel group | Channel group | read on the group only |
| Subscribe to presence channel group | Presence channel group (-pnpres) | read |
| Unsubscribe from channel | Channel | None required |
| Unsubscribe from channel group | Channel group | None required |
Presence
Presence tracks which users are connected to a channel and their state. These operations need permissions on the channel.
| Operation | Resource | Permission |
|---|---|---|
| Here Now | Channel | read |
| Where Now | Channel | None required |
| Get State | Channel | read |
| Set State | Channel | read |
Message Persistence
Message Persistence stores published messages so clients can fetch them later. These operations need permissions on the channel that holds the messages.
| Operation | Resource | Permission |
|---|---|---|
| Fetch messages | Channel | read |
| Message counts | Channel | read |
| Delete messages | Channel | delete |
File sharing
Files lets clients send and download files on a channel. These operations need permissions on that channel.
| Operation | Resource | Permission |
|---|---|---|
| Send file on channel | Channel | write |
| List files | Channel | read |
| Download file | Channel | read |
| Delete file | Channel | delete |
Channel groups
A channel group lets a client subscribe to many channels as one unit. These operations need permissions on the channel group.
Grant channel group manage permission only to server-side code
Access Manager treats manage on a channel group as an administrative permission. Grant it only in tokens used by server-side code and administrators.
A client token with manage and read on a channel group can add any channel name on the keyset to the group and read that channel's messages through the group.
When a client subscribes to a channel group, or includes a channel group in a presence call such as Here Now, Access Manager checks read on the channel group and does not check read on the channels in the group. See Channel groups and channel permissions.
| Operation | Resource | Permission |
|---|---|---|
| Add channels to channel group | Channel group | manage |
| Remove channels from channel group | Channel group | manage |
| List channels in channel group | Channel group | read |
| Remove channel group | Channel group | manage |
App Context
App Context stores user metadata, channel metadata, and memberships. These operations need permissions on the UUID, the channel, or both.
| Operation | Resource | Permission |
|---|---|---|
| Set user metadata | UUID | update |
| Delete user metadata | UUID | delete |
| Get user metadata | UUID | get |
| Get all user metadata | UUID | Managed by the Disallow Get All User Metadata option in App Context configuration on the Admin Portal. When this option is unchecked and Access Manager is enabled, you can get metadata of all users without a permission grant. |
| Set channel metadata | Channel | update |
| Delete channel metadata | Channel | delete |
| Get channel metadata | Channel | get |
| Get all channel metadata | Channel | Managed by the Disallow Get All Channel Metadata option in App Context configuration on the Admin Portal. When this option is unchecked and Access Manager is enabled, you can get metadata of all channels without a permission grant. |
| Set channel members | Channel | manage |
| Remove channel members | Channel | manage |
| Get channel members | Channel | get |
| Set channel memberships | Channel and UUID | Channel: join. UUID: update. |
| Remove channel memberships | Channel and UUID | Channel: join. UUID: update. |
| Get channel memberships | UUID | get |
DataSync
DataSync stores entities, relationships, users, channels, and memberships as typed objects. These operations need permissions on the resource type that matches the object kind:
| Object kind | Resource type |
|---|---|
| Generic entity | datasync:entities |
| Relationship | datasync:relationships |
| Membership | datasync:memberships |
| User entity | users |
| Channel entity | channels |
| Operation | Resource | Permission |
|---|---|---|
| Get object | Resource type of the object kind | get |
| Create object | Resource type of the object kind | create |
| Replace object | Resource type of the object kind | update |
| Partial update (patch) object | Resource type of the object kind | update |
| Delete object | Resource type of the object kind | delete |
| Subscribe to an object's ID channel or projection channel | Channel | read |
DataSync user entities use the users resource type, not uuids. A token that grants only uuids permissions doesn't authorize DataSync operations on users. Refer to DataSync access control for credentials and field-level projection grants.
Mobile Push Notifications
Mobile Push Notifications delivers channel messages to devices through Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs). Only registering a channel needs a channel permission.
| Operation | Resource | Permission |
|---|---|---|
| Register channel for push | Channel | read on each added channel |
| Remove channel push registration | None | None |
| List channels for a device (FCM and APNs2) | None | None |
| List devices for a channel | None | Server only. Sign the request with the secret key. |
Removing a registration and listing a device's channels still check the token if the request includes one. A token that is expired, revoked, or issued for a different User ID returns 403.
Message Actions
Message Actions attach reactions, receipts, and other metadata to a published message. These operations need permissions on the channel that holds the message.
| Operation | Resource | Permission |
|---|---|---|
| Add message action | Channel | write |
| Remove message action | Channel | delete |
| Get message actions | Channel | read |
| Get history with actions | Channel | read |
Related pages
- Permission model. What each permission flag permits.
- Grant, change, and revoke permissions. Issue tokens with these permissions from your server.