Permissions
API key permissions and session tokens.
An API key holds exactly the permissions it was minted with, in its own workspace. Grant the narrowest set that works.
| Permission | Allows |
|---|---|
workspace.read |
Reading the workspace |
agent.read |
Listing and reading agents, their versions, and their CORS origins |
agent.publish |
Creating and renaming agents, publishing versions, setting CORS origins |
agent.delete |
Deleting an agent, with its versions and sessions |
session.create |
Creating sessions |
session.read |
Listing and reading sessions, their events and stream, images, sandboxes and archives, and volume files |
session.manage |
Sending input, cancelling, renaming, deleting, minting session tokens, approvals, forms, clients, deleting sandbox archives, and writing volume files |
vault.read / vault.manage |
Reading / creating, updating, and deleting vaults |
credential.read |
Listing credentials — never their secrets |
credential.manage |
Adding, connecting, testing, reconnecting, and deleting credentials |
skill.read / skill.manage |
Reading / creating, pushing, renaming, and deleting skills |
function.read / function.manage |
Reading / creating, pushing, renaming, and deleting function packages |
model_provider.read / model_provider.manage |
Reading / connecting, updating, and deleting model providers |
usage.read |
Reading the workspace’s usage |
subako api-key permissions lists what the server grants.
Never on a key
Some things only a person does: renaming or deleting a workspace, managing its members, minting and revoking API keys, and everything at the organization’s level — its members, invitations, plan, and credit. No key can hold a permission for these, so a leaked key cannot mint another or let someone in.
People
A person’s role decides what they may do:
- Any workspace member may do everything above in that workspace, and manage its API keys.
- A workspace admin may also rename or delete it, and change who is in it.
- An organization admin may do everything in every workspace, and manage the organization.
Session tokens
A session token carries no permissions. It reaches every route of its own session — reading and following it, input, cancel, approvals, forms, clients, renaming and deleting it, its sandboxes and its volume — and nothing outside it. See Session tokens.