For AI agents: this page in Markdown: https://www.pubnub.com/docs/security/access-control/permission-model.md. Documentation index: https://www.pubnub.com/llms-full.txt.
Access Manager permission model
Access Manager permissions set what your app's clients can do on channels, channel groups, and user metadata. Your server grants them in a token. For what members of your organization can do in the Admin Portal, see Admin Portal roles.
Access Manager grants permissions per resource. Each token lists the resources the bearer can access and the flags that apply to each one.
Resource types and permission flags
| Resource | Permission flags |
|---|---|
| Channel | read, write, delete, get, update, manage, join |
| Channel group | read, manage |
| UUID metadata | get, update, delete |
What each flag permits
| Flag | Operations |
|---|---|
read | Subscribe to a channel or channel group. Fetch messages. List and download files. Manage push notification registrations. |
write | Publish and signal on a channel. Send a file to a channel. Add a message action. |
delete | Delete messages from history. Delete a file. Delete metadata. Remove a message action. |
get | Read channel or UUID metadata. List channel members or memberships. |
update | Write channel or UUID metadata. |
manage | Add or remove channels in a channel group. Delete a channel group. Set or remove channel members. |
join | Set or remove channel memberships (UUID resource side). |
Permissions do not cascade. A read grant on a channel group does not grant read on the individual channels in that group.
Authorized UUID
| Field | Description |
|---|---|
authorized_uuid | Optional. Binds the token to one User ID. PubNub rejects requests using the token from any other User ID. Must match an existing User ID set during SDK initialization. |
Scope
| Scope type | Description |
|---|---|
| Exact name | Grants permission for one named resource. |
| RE2 pattern | Grants permission for all resources whose names match the pattern. Evaluated server-side. Backreferences and lookaround assertions are not supported. |
Related pages
- Access Manager. How the authorization flow works.
- Grant, change, and revoke permissions. Issue and manage tokens from your server.
- Operations to permissions mapping. Which permission each PubNub API operation requires.
- Admin Portal roles. What organization members can do in the Admin Portal.