Access Manager permission model

Access Manager permissions set what your app's clients can do on channels, channel groups, and user metadata. Your server grants them in a token. For what members of your organization can do in the Admin Portal, see Admin Portal roles.

Access Manager grants permissions per resource. Each token lists the resources the bearer can access and the flags that apply to each one.

Resource types and permission flags

Resource	Permission flags
Channel	read, write, delete, get, update, manage, join
Channel group	read, manage
UUID metadata	get, update, delete

What each flag permits

Flag	Operations
read	Subscribe to a channel or channel group. Fetch messages. List and download files. Manage push notification registrations.
write	Publish and signal on a channel. Send a file to a channel. Add a message action.
delete	Delete messages from history. Delete a file. Delete metadata. Remove a message action.
get	Read channel or UUID metadata. List channel members or memberships.
update	Write channel or UUID metadata.
manage	Add or remove channels in a channel group. Delete a channel group. Set or remove channel members.
join	Set or remove channel memberships (UUID resource side).

Channel groups and channel permissions

A token with read on a channel group lets the client subscribe to that group. When a client subscribes to a channel group, or includes a channel group in a presence call such as Here Now, Access Manager checks read on the channel group and does not check read on the channels in the group. PubNub delivers every channel in the group through that one subscribe request, including buffered messages the request catches up on.

• A client without read on a channel can't subscribe to it directly. The same client receives that channel's messages through a channel group it has read on.
• Adding a channel to a channel group requires manage on the group. Access Manager checks no permission on the channel being added. A token with manage on a group can add any channel name on the keyset to that group.
• A token without read on a channel still receives that channel's messages while the channel is in a channel group the token can read. Delivery stops when the channel is removed from the group or when the token that grants read on the group is revoked. Token revocation needs the keyset's token revocation option enabled. See Enable token revocation.

Grant channel group manage permission only to server-side code

Access Manager treats manage on a channel group as an administrative permission. Grant it only in tokens used by server-side code and administrators.

A client token with manage and read on a channel group can add any channel name on the keyset to the group and read that channel's messages through the group.

To remove a channel from a group, use the channel group operations in your server SDK, initialized as described in Initialize a server SDK with a secret key. To revoke a token, see Revoke a token.

Authorized UUID

Field	Description
authorized_uuid	Optional. Binds the token to one User ID. SDKs name this parameter authorizedUserId or authorizedUuid. PubNub rejects requests using the token from any other User ID. Must match an existing User ID set during SDK initialization.

Scope

Scope type	Description
Exact name	Grants permission for one named resource.
RE2 pattern	Grants permission for all resources whose names match the pattern. Evaluated server-side. Backreferences and lookaround assertions are not supported.

Related pages

• Access Manager. How the authorization flow works.
• Grant, change, and revoke permissions. Issue and manage tokens from your server.
• Operations to permissions mapping. Which permission each PubNub API operation requires.
• Admin Portal roles. What organization members can do in the Admin Portal.