Operations to permissions mapping
The tables below list each PubNub API operation, the resource it targets, and the permission flag it requires when Access Manager is enabled on a keyset.
Chat SDK
For Chat SDK method to Access Manager permission mappings, see Security and permissions.
Pub/Sub
Pub/Sub sends and receives messages on channels. These operations need permissions on the channel or channel group they target.
| Operation | Resource | Permission |
|---|---|---|
| Publish on channel | Channel | write |
| Signal on channel | Channel | write |
| Subscribe to channel | Channel | read |
| Subscribe to presence channel | Presence channel (-pnpres) | read |
| Subscribe to channel group | Channel group | read |
| Subscribe to presence channel group | Presence channel group (-pnpres) | read |
| Unsubscribe from channel | Channel | None required |
| Unsubscribe from channel group | Channel group | None required |
Presence
Presence tracks which users are connected to a channel and their state. These operations need permissions on the channel.
| Operation | Resource | Permission |
|---|---|---|
| Here Now | Channel | read |
| Where Now | Channel | None required |
| Get State | Channel | read |
| Set State | Channel | read |
Message Persistence
Message Persistence stores published messages so clients can fetch them later. These operations need permissions on the channel that holds the messages.
| Operation | Resource | Permission |
|---|---|---|
| Fetch messages | Channel | read |
| Message counts | Channel | read |
| Delete messages | Channel | delete |
File sharing
Files lets clients send and download files on a channel. These operations need permissions on that channel.
| Operation | Resource | Permission |
|---|---|---|
| Send file on channel | Channel | write |
| List files | Channel | read |
| Download file | Channel | read |
| Delete file | Channel | delete |
Channel groups
A channel group lets a client subscribe to many channels as one unit. These operations need permissions on the channel group.
| Operation | Resource | Permission |
|---|---|---|
| Add channels to channel group | Channel group | manage |
| Remove channels from channel group | Channel group | manage |
| List channels in channel group | Channel group | read |
| Remove channel group | Channel group | manage |
App Context
App Context stores user metadata, channel metadata, and memberships. These operations need permissions on the UUID, the channel, or both.
| Operation | Resource | Permission |
|---|---|---|
| Set user metadata | UUID | update |
| Delete user metadata | UUID | delete |
| Get user metadata | UUID | get |
| Get all user metadata | UUID | Managed by the Disallow Get All User Metadata option in App Context configuration on the Admin Portal. When this option is unchecked and Access Manager is enabled, you can get metadata of all users without a permission grant. |
| Set channel metadata | Channel | update |
| Delete channel metadata | Channel | delete |
| Get channel metadata | Channel | get |
| Get all channel metadata | Channel | Managed by the Disallow Get All Channel Metadata option in App Context configuration on the Admin Portal. When this option is unchecked and Access Manager is enabled, you can get metadata of all channels without a permission grant. |
| Set channel members | Channel | manage |
| Remove channel members | Channel | manage |
| Get channel members | Channel | get |
| Set channel memberships | Channel and UUID | Channel: join. UUID: update. |
| Remove channel memberships | Channel and UUID | Channel: join. UUID: update. |
| Get channel memberships | UUID | get |
Mobile Push Notifications
Mobile Push Notifications delivers channel messages to devices through Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs). Only registering a channel needs a channel permission.
| Operation | Resource | Permission |
|---|---|---|
| Register channel for push | Channel | read on each added channel |
| Remove channel push registration | None | None |
| List channels for a device (FCM and APNs2) | None | None |
| List devices for a channel | None | Server only. Sign the request with the secret key. |
Removing a registration and listing a device's channels still check the token if the request includes one. A token that is expired, revoked, or issued for a different User ID returns 403.
Message Actions
Message Actions attach reactions, receipts, and other metadata to a published message. These operations need permissions on the channel that holds the message.
| Operation | Resource | Permission |
|---|---|---|
| Add message action | Channel | write |
| Remove message action | Channel | delete |
| Get message actions | Channel | read |
| Get history with actions | Channel | read |
Related pages
- Permission model. What each permission flag permits.
- Grant, change, and revoke permissions. Issue tokens with these permissions from your server.