generated: '2026-09-12' method: searched source: https://developer.harness.io/harness-platform/use-harness-platform/automation/api/api-permissions-reference.md + probed OpenID discovery at https://id.harness.io docs: https://developer.harness.io/harness-platform/use-harness-platform/automation/api/api-permissions-reference provider: Harness providerId: harness model: rbac-permissions description: Harness REST authorization is RBAC, not OAuth scopes. An API key or service-account token inherits the permissions of the user or service account it belongs to; the authorization unit is a permission ID like core_pipeline_execute, evaluated at a scope (account / organization / project). OAuth scopes DO exist on the platform, but only on the identity provider that fronts sign-in and the hosted MCP server — they are recorded separately below. summary: permission_count: 194 domains: 28 oauth_scopes: 4 oauth: applies_to: Harness Platform sign-in and the hosted MCP server at https://mcp.harness.io/mcp — NOT the REST API issuer: https://id.harness.io/idp/realms/HarnessIDP discovery: https://id.harness.io/idp/realms/HarnessIDP/.well-known/openid-configuration file: well-known/harness-id-harnessidp-openid-configuration.json scopes_supported: - openid - profile - email - offline_access grant_types_supported: - authorization_code - client_credentials - implicit - password - refresh_token - urn:ietf:params:oauth:grant-type:device_code - urn:ietf:params:oauth:grant-type:jwt-bearer - urn:ietf:params:oauth:grant-type:token-exchange - urn:ietf:params:oauth:grant-type:uma-ticket - urn:openid:params:grant-type:ciba code_challenge_methods_supported: - plain - S256 root_profile: discovery: https://id.harness.io/.well-known/openid-configuration file: well-known/harness-id-openid-configuration.json scopes_supported: - organization - profile - email grant_types_supported: - authorization_code - refresh_token permission_scopes: - account - organization - project permission_scope_note: Most permissions are available at any scope; core_account_view, core_account_edit and the CCM permissions are account-scope only. domains: - domain: Account permissions: - id: core_account_edit description: Edit account - id: core_account_view description: View account - id: core_license_edit description: Edit license - id: core_license_view description: View license - id: core_setting_edit description: Edit account [settings](/harness-platform/use-harness-platform/settings.md) - id: core_setting_view description: View account [settings](/harness-platform/use-harness-platform/settings.md) - domain: Audits permissions: - id: core_audit_view description: null - domain: CCM permissions: - id: ccm_budget_delete description: Delete CCM Budgets - id: ccm_budget_edit description: Edit CCM Budgets - id: ccm_budget_view description: View CCM Budgets - id: ccm_folder_delete description: Delete CCM Folders - id: ccm_folder_edit description: Create/Edit CCM Folders - id: ccm_folder_view description: View CCM Folders - id: ccm_overview_view description: View CCM Overview page - id: ccm_perspective_delete description: Delete CCM Perspective - id: ccm_perspective_edit description: Edit CCM Perspective - id: ccm_perspective_view description: View CCM Perspective - domain: Chaos Engineering permissions: - id: chaos_chaosexperiment_delete description: Delete Chaos Experiments - id: chaos_chaosexperiment_edit description: Edit Chaos Experiments - id: chaos_chaosexperiment_execute description: Execute Chaos Experiments - id: chaos_chaosexperiment_executepipeline description: Execute a Chaos Experiment via Pipeline - id: chaos_chaosexperiment_view description: View Chaos Experiments - id: chaos_chaosgameday_delete description: Delete Chaos GameDay - id: chaos_chaosgameday_edit description: Edit Chaos GameDay - id: chaos_chaosgameday_view description: View Chaos GameDay - id: chaos_chaoshub_delete description: Delete Chaos Hubs - id: chaos_chaoshub_edit description: Edit Chaos Hubs - id: chaos_chaoshub_view description: View Chaos Hubs - id: chaos_chaosinfrastructure_delete description: Delete Chaos Infrastructures - id: chaos_chaosinfrastructure_edit description: Edit Chaos Infrastructures - id: chaos_chaosinfrastructure_view description: View Chaos Infrastructures - id: chaos_chaossecuritygovernance_delete description: Delete a Chaos Security Governance - id: chaos_chaossecuritygovernance_edit description: Edit a Chaos Security Governance - id: chaos_chaossecuritygovernance_view description: View a Chaos Security Governance - domain: Code Repository permissions: - id: code_repository_create description: Create repositories - id: code_repository_delete description: Delete repositories - id: code_repository_edit description: Update repository settings, such as descriptions, webhooks, and rules. - id: code_repository_push description: Repository contributor permissions, such as committing, pushing, creating/deleting branches, creating/deleting tags. - id: code_repository_view description: View repositories - domain: Connectors permissions: - id: core_connector_access description: Access connectors - id: core_connector_delete description: Delete connectors - id: core_connector_edit description: Create/edit connectors - id: core_connector_view description: View connectors - domain: Dashboards permissions: - id: core_dashboards_edit description: Edit dashboards - id: core_dashboards_view description: View dashboards - domain: Delegates permissions: - id: core_delegate_delete description: Delete Delegates - id: core_delegate_edit description: Create or Edit Delegates - id: core_delegate_view description: View Delegates - id: core_delegateconfiguration_delete description: Delete Delegate Configurations - id: core_delegateconfiguration_edit description: Create/Edit Delegate Configurations - id: core_delegateconfiguration_view description: View Delegate Configurations - domain: Deployment freeze permissions: - id: core_deploymentfreeze_global description: Apply global deployment freeze - id: core_deploymentfreeze_manage description: Manage deployment freezes - id: core_deploymentfreeze_override description: Override deployment freezes - domain: Environments permissions: - id: core_environment_access description: Runtime access to Environments - id: core_environment_delete description: Delete Environments - id: core_environment_edit description: Create/Edit Environments - id: core_environment_view description: View Environments - id: core_environmentgroup_access description: Runtime access to Environment Groups - id: core_environmentgroup_delete description: Delete Environment Groups - id: core_environmentgroup_edit description: Create/Edit Environment Groups - id: core_environmentgroup_view description: View Environment Groups - domain: Feature Flag permissions: - id: ff_environment_edit description: Edit Feature Flag Environment Configuration - id: ff_environment_view description: View Feature Flag Environment Configuration - id: ff_featureflag_delete description: Delete Feature Flags - id: ff_featureflag_edit description: Create/Edit Feature Flags - id: ff_featureflag_toggle description: Toggle a Feature Flag on/off - id: ff_featureflag_view description: View Feature Flags - id: ff_target_view description: View Targets - id: ff_targetgroup_delete description: Delete Target Groups - id: ff_targetgroup_edit description: Create/Edit Target Groups - id: ff_targetgroup_view description: View Target Groups - domain: Files permissions: - id: core_file_access description: Access files - id: core_file_delete description: Delete files - id: core_file_edit description: Edit files - id: core_file_view description: View files - domain: GitOps permissions: - id: gitops_agent_delete description: Delete GitOps Agents - id: gitops_agent_edit description: Edit GitOps Agents - id: gitops_agent_view description: View GitOps Agents - id: gitops_application_delete description: Delete GitOps Applications - id: gitops_application_edit description: Edit GitOps Applications - id: gitops_application_sync description: Syns GitOps Applications - id: gitops_application_view description: View GitOps Applications - id: gitops_cert_delete description: Delete GitOps Certificate - id: gitops_cert_edit description: Edit GitOps Certificate - id: gitops_cert_view description: View GitOps Certificate - id: gitops_cluster_delete description: Delete GitOps Clusters - id: gitops_cluster_edit description: Edit GitOps Clusters - id: gitops_cluster_view description: View GitOps Clusters - id: gitops_gpgkey_delete description: Delete GitOps GPG keys - id: gitops_gpgkey_edit description: Edit GitOps GPG keys - id: gitops_gpgkey_view description: View GitOps GPG keys - id: gitops_repository_delete description: Delete GitOps Repositories - id: gitops_repository_edit description: Edit GitOps Repositories - id: gitops_repository_view description: View GitOps Repositories - domain: Infrastructure as Code Management permissions: - id: iac_workspace_accessstate description: Access Infrastructure Workspace State - id: iac_workspace_approve description: Approve Infrastructure Workspace - id: iac_workspace_delete description: Delete Infrastructure Workspace - id: iac_workspace_deletevariable description: Delete Infrastructure Workspace Variable - id: iac_workspace_edit description: Create/Edit Infrastructure Workspace - id: iac_workspace_editvariable description: Create/Edit Infrastructure Workspace Variable - id: iac_workspace_view description: View Infrastructure Workspace - domain: Internal Developer Portal permissions: - id: idp_advancedconfiguration_delete description: Delete IDP Advanced Configurations - id: idp_advancedconfiguration_edit description: Create or Edit IDP Advanced Configurations - id: idp_advancedconfiguration_view description: View IDP Advanced Configurations - id: idp_catalogaccesspolicy_create description: Create IDP Catalog Access Control Policies - id: idp_catalogaccesspolicy_delete description: Delete IDP Catalog Access Control Policies - id: idp_catalogaccesspolicy_edit description: Edit IDP Catalog Access Control Policies - id: idp_catalogaccesspolicy_view description: View IDP Catalog Access Control Policies - id: idp_integration_create description: Create IDP Integrations - id: idp_integration_delete description: Delete IDP Integrations - id: idp_integration_edit description: Edit IDP Integrations - id: idp_integration_view description: View IDP Integrations - id: idp_layout_edit description: Create or Edit IDP Layout Configurations - id: idp_layout_view description: View IDP Layout Configurations - id: idp_plugin_delete description: Delete IDP custom plugins - id: idp_plugin_edit description: Create or Edit IDP custom plugins - id: idp_plugin_toggle description: Enable or Disable an IDP Plugin - id: idp_plugin_view description: View IDP custom plugins - id: idp_scorecard_delete description: Delete IDP Scorecards - id: idp_scorecard_edit description: Create or Edit IDP Scorecards - id: idp_scorecard_view description: View IDP Scorecards - domain: Input Sets permissions: - id: core_inputset_delete description: Delete input sets - id: core_inputset_edit description: Create/edit input sets - id: core_inputset_view description: View input sets - domain: Organizations permissions: - id: core_organization_create description: Create organizations - id: core_organization_delete description: Delete organizations - id: core_organization_edit description: Edit organizations - id: core_organization_view description: View organizations - domain: Pipelines permissions: - id: core_pipeline_delete description: Delete pipelines - id: core_pipeline_edit description: Create/edit pipelines - id: core_pipeline_execute description: Run pipelines - id: core_pipeline_view description: View pipelines - domain: Projects permissions: - id: core_project_create description: Create projects - id: core_project_delete description: Delete projects - id: core_project_edit description: Edit projects - id: core_project_view description: View projects - domain: RBAC and authorization permissions: - id: core_authsetting_delete description: Delete authorization settings - id: core_authsetting_edit description: Edit authorization settings - id: core_authsetting_view description: View authorization settings - id: core_resourcegroup_delete description: Delete resource groups - id: core_resourcegroup_edit description: Create/edit resource groups - id: core_resourcegroup_view description: View resource groups - id: core_role_delete description: Delete roles - id: core_role_edit description: Create/edit roles - id: core_role_view description: View roles - id: core_serviceaccount_delete description: Delete service accounts - id: core_serviceaccount_edit description: Create/edit service accounts - id: core_serviceaccount_manageapikey description: null - id: core_serviceaccount_view description: View service accounts - id: core_user_invite description: Invite users - id: core_user_manage description: Manage users - id: core_user_view description: View users - id: core_usergroup_manage description: Manage user groups - id: core_usergroup_view description: View user groups - domain: Secrets permissions: - id: core_secret_access description: Access secrets - id: core_secret_delete description: Delete secrets - id: core_secret_edit description: Create/edit secrets - id: core_secret_view description: View secrets - domain: Services permissions: - id: core_service_access description: Access services at runtime - id: core_service_delete description: Delete services - id: core_service_edit description: Create/edit services - id: core_service_view description: View services - domain: SMTP permissions: - id: core_smtp_delete description: Delete SMTP config - id: core_smtp_edit description: Create/edit SMTP config - id: core_smtp_view description: View SMTP config - domain: SRM permissions: - id: chi_monitoredservice_delete description: Delete Monitored Services - id: chi_monitoredservice_edit description: Create/Edit Monitored Services - id: chi_monitoredservice_toggle description: Toggle Monitored Services on/off - id: chi_monitoredservice_view description: View Monitored Services - id: chi_slo_delete description: Delete SLOs - id: chi_slo_edit description: Create/Edit SLOs - id: chi_slo_view description: View SLOs - domain: STO permissions: - id: sto_exemption_approve description: Approve Exemptions - id: sto_exemption_create description: Create Exemptions - id: sto_exemption_view description: View Exemptions - id: sto_issue_view description: View Security Issues - id: sto_scan_view description: View Security Scans - id: sto_testtarget_edit description: Edit Test Targets - id: sto_testtarget_view description: View Test Targets - domain: Templates permissions: - id: core_template_access description: Access Templates - id: core_template_copy description: Copy Templates - id: core_template_delete description: Delete Templates - id: core_template_edit description: Edit Templates - id: core_template_view description: View Templates - domain: Variables permissions: - id: core_variable_delete description: Delete variables - id: core_variable_edit description: Create/edit variables - id: core_variable_view description: View variables - domain: Database DevOps permissions: - id: dbops_instance_delete description: Delete Instances - id: dbops_instance_edit description: Create or Edit Instances - id: dbops_instance_view description: View Instances - id: dbops_schema_delete description: Delete Schemas - id: dbops_schema_edit description: Create or Edit Schemas - id: dbops_schema_view description: View Schemas scopes: method: none note: No explicit scopes list provided.