Reference
Permission Actions
Complete list of permission actions used across the Arke API.
Actions follow the resource:verb pattern. Each API endpoint requires a specific action, embedded in the OpenAPI spec as x-arke-action.
| Action | Description | Used By |
|---|
entity:create | Create new entities | POST /entities |
entity:view | Read entity content | GET /entities/:id |
entity:tip | Get entity tip CID | GET /entities/:id/tip |
entity:update | Modify existing entity | PUT /entities/:id |
entity:delete | Soft-delete entity | DELETE /entities/:id |
entity:restore | Restore deleted entity | POST /entities/:id/restore |
| Action | Description | Used By |
|---|
file:create | Create file metadata | POST /files |
file:view | View file metadata | GET /files/:id |
file:upload | Upload file content | POST /files/:id/upload |
file:download | Download file content | GET /files/:id/download |
file:update | Update file metadata | PUT /files/:id |
file:reupload | Replace file content | POST /files/:id/reupload |
| Action | Description | Used By |
|---|
user:create | Create new user | POST /auth/register |
user:view | View user profile | GET /users/:id |
user:update | Update user profile | PUT /users/:id |
user:credentials | Manage API keys | GET/POST/DELETE /users/:id/api-keys |
| Action | Description | Used By |
|---|
collection:create | Create collection | POST /collections |
collection:view | View collection | GET /collections/:id |
collection:update | Update collection properties | PUT /collections/:id |
collection:manage | Manage roles and membership | POST /collections/:id/roles, members |
| Action | Description | Used By |
|---|
folder:create | Create folder | POST /folders |
folder:view | View folder | GET /folders/:id |
folder:update | Update folder, add/remove items | PUT /folders/:id |
| Action | Description | Used By |
|---|
agent:create | Create agent | POST /agents |
agent:view | View agent details | GET /agents/:id |
agent:update | Update agent configuration | PUT /agents/:id |
agent:invoke | Trigger agent processing | POST /agents/:id/invoke |
agent:manage | Manage agent keys | POST/DELETE /agents/:id/keys |
| Action | Description | Used By |
|---|
search:query | Execute search queries | POST /search/query |
search:similar | Find similar entities | POST /search/similar |
search:execute | Execute user searches | POST /users/:id/search |
| Action | Description | Used By |
|---|
query:execute | Execute Argo query | POST /query |
| Action | Description | Used By |
|---|
graph:query | Query entity graph | GET/POST /graph |
| Action | Description | Used By |
|---|
chat:send | Send chat message | POST /chat |
chat:view | View chat history | GET /chat |
chat:delete | Delete chat message | DELETE /chat/:id |
| Action | Description | Used By |
|---|
attestation:view | View attestation records | GET /attestations/:id |
attestation:verify | Verify attestation | POST /attestations/verify |
| Action | Description | Used By |
|---|
permissions:read | Read permission metadata | GET /permissions |
events:list | List API events | GET /events |
There are two types of wildcard patterns:
Matches any resource type with the specified verb:
| Pattern | Matches |
|---|
*:view | entity:view, file:view, user:view, etc. |
*:update | entity:update, file:update, user:update, etc. |
*:create | entity:create, file:create, etc. |
Security restriction: Verb wildcards do NOT match collection operations (except *:view which matches collection:view). This prevents editors with *:update from modifying collection settings.
Matches any verb for the specified type:
| Pattern | Matches |
|---|
file:* | file:view, file:download, file:update, file:reupload |
entity:* | entity:view, entity:update, entity:create, etc. |
Security restriction: collection:* is not allowed. Use explicit collection actions instead.
Certain verbs automatically grant additional permissions:
| Verb | Implies |
|---|
view | download |
update | reupload, upload, delete |
manage | view, download, create, update, reupload, upload, delete |
Examples:
file:view automatically grants file:download*:view automatically grants *:download (any type)file:update automatically grants file:reupload, file:upload, file:delete
The entity type is the base type that implies all specific entity types:
| Base Action | Implies |
|---|
entity:view | file:view, user:view, folder:view, agent:view, etc. |
entity:update | file:update, user:update, folder:update, etc. |
entity:create | file:create, user:create, etc. |
Security restriction: entity:* only implies collection:view. Other collection operations (collection:update, collection:create, collection:delete, collection:manage) require explicit permission.
Collections are created with these default roles:
| Role | Actions |
|---|
owner | *:view, *:update, *:create, collection:update, collection:manage |
editor | *:view, *:update, *:create |
viewer | *:view |
public | *:view |
Note: The public role is required for collections (platform rule). Users with subscriptions can create private collections without this role.