--- source_url: https://www.pubnub.com/docs/security/access-control/operations-permissions-mapping title: Operations to permissions mapping updated_at: 2026-09-30T07:20:08.000Z --- # Operations to permissions mapping > For AI agents: documentation index at https://www.pubnub.com/llms-full.txt The tables below list each PubNub API operation, the resource it targets, and the permission flag it requires when Access Manager is enabled on a keyset. :::tip Chat SDK For Chat SDK method to Access Manager permission mappings, see [Security and permissions](https://www.pubnub.com/docs/chat/security.md#operations-to-permissions-mapping). ::: ## Pub/Sub [Pub/Sub](https://www.pubnub.com/docs/pub-sub/overview.md) sends and receives messages on channels. These operations need permissions on the channel or channel group they target. | Operation | Resource | Permission | | --- | --- | --- | | Publish on channel | Channel | `write` | | Signal on channel | Channel | `write` | | Subscribe to channel | Channel | `read` | | Subscribe to presence channel | Presence channel (`-pnpres`) | `read` | | Subscribe to channel group | Channel group | `read` | | Subscribe to presence channel group | Presence channel group (`-pnpres`) | `read` | | Unsubscribe from channel | Channel | None required | | Unsubscribe from channel group | Channel group | None required | ## Presence [Presence](https://www.pubnub.com/docs/presence/overview.md) tracks which users are connected to a channel and their state. These operations need permissions on the channel. | Operation | Resource | Permission | | --- | --- | --- | | Here Now | Channel | `read` | | Where Now | Channel | None required | | Get State | Channel | `read` | | Set State | Channel | `read` | ## Message Persistence [Message Persistence](https://www.pubnub.com/docs/data-storage/message-history/overview.md) stores published messages so clients can fetch them later. These operations need permissions on the channel that holds the messages. | Operation | Resource | Permission | | --- | --- | --- | | Fetch messages | Channel | `read` | | Message counts | Channel | `read` | | Delete messages | Channel | `delete` | ## File sharing [Files](https://www.pubnub.com/docs/data-storage/files/overview.md) lets clients send and download files on a channel. These operations need permissions on that channel. | Operation | Resource | Permission | | --- | --- | --- | | Send file on channel | Channel | `write` | | List files | Channel | `read` | | Download file | Channel | `read` | | Delete file | Channel | `delete` | ## Channel groups A [channel group](https://www.pubnub.com/docs/architecture/core-concepts.md#channel) lets a client subscribe to many channels as one unit. These operations need permissions on the channel group. | Operation | Resource | Permission | | --- | --- | --- | | Add channels to channel group | Channel group | `manage` | | Remove channels from channel group | Channel group | `manage` | | List channels in channel group | Channel group | `read` | | Remove channel group | Channel group | `manage` | ## App Context [App Context](https://www.pubnub.com/docs/data-storage/metadata/overview.md) stores user metadata, channel metadata, and memberships. These operations need permissions on the UUID, the channel, or both. | Operation | Resource | Permission | | --- | --- | --- | | Set user metadata | UUID | `update` | | Delete user metadata | UUID | `delete` | | Get user metadata | UUID | `get` | | Get all user metadata | UUID | Managed by the **Disallow Get All User Metadata** option in [App Context configuration](https://www.pubnub.com/docs/data-storage/metadata/overview.md) on the Admin Portal. When this option is unchecked and Access Manager is enabled, you can get metadata of all users without a permission grant. | | Set channel metadata | Channel | `update` | | Delete channel metadata | Channel | `delete` | | Get channel metadata | Channel | `get` | | Get all channel metadata | Channel | Managed by the **Disallow Get All Channel Metadata** option in [App Context configuration](https://www.pubnub.com/docs/data-storage/metadata/overview.md) on the Admin Portal. When this option is unchecked and Access Manager is enabled, you can get metadata of all channels without a permission grant. | | Set channel members | Channel | `manage` | | Remove channel members | Channel | `manage` | | Get channel members | Channel | `get` | | Set channel memberships | Channel and UUID | Channel: `join`. UUID: `update`. | | Remove channel memberships | Channel and UUID | Channel: `join`. UUID: `update`. | | Get channel memberships | UUID | `get` | ## Mobile Push Notifications [Mobile Push Notifications](https://www.pubnub.com/docs/integrations/mobile-push-notifications/overview.md) delivers channel messages to devices through Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs). Only registering a channel needs a channel permission. | Operation | Resource | Permission | | --- | --- | --- | | Register channel for push | Channel | `read` on each added channel | | Remove channel push registration | None | None | | List channels for a device (FCM and APNs2) | None | None | | List devices for a channel | None | Server only. Sign the request with the secret key. | Removing a registration and listing a device's channels still check the token if the request includes one. A token that is expired, revoked, or issued for a different User ID returns `403`. ## Message Actions [Message Actions](https://www.pubnub.com/docs/pub-sub/message-actions/overview.md) attach reactions, receipts, and other metadata to a published message. These operations need permissions on the channel that holds the message. | Operation | Resource | Permission | | --- | --- | --- | | Add message action | Channel | `write` | | Remove message action | Channel | `delete` | | Get message actions | Channel | `read` | | Get history with actions | Channel | `read` | ## Related pages * [Permission model](https://www.pubnub.com/docs/security/access-control/permission-model.md). What each permission flag permits. * [Grant, change, and revoke permissions](https://www.pubnub.com/docs/security/access-control/manage-permissions.md). Issue tokens with these permissions from your server. Last updated at: 2026-09-30T07:20:08.000Z