# Nylas IAM permissions reference Source: https://developer.nylas.com/docs/v3/auth/nylas-iam/permissions/ Each Nylas IAM permission allows one action on one resource type. For example, `messages.read` allows reading messages. You assign permissions to a principal through roles, direct permissions, or both. The principal's resource binding decides which permissions apply. The tables below list every direct permission in the Dashboard, in the same groups the Dashboard uses. ## How permission IDs work Permission IDs use the format `resource.action`, such as `calendars.update`. IAM permissions start with `iam.`, such as `iam.credentials.create`. Most resources have 4 actions: `read`, `create`, `update`, and `delete`. Some resources have other actions, such as `send` or `cancel`. You use the same IDs in the Dashboard and in the `direct_permissions` field when you [create](/docs/reference/api/iam-principals/create-iam-principal/) or [update](/docs/reference/api/iam-principals/update-iam-principal/) a principal with the API. If a principal calls an endpoint without the permission it needs, Nylas returns a `403` error. For how roles, permissions, and bindings work together, see [Nylas IAM](/docs/v3/auth/nylas-iam/#configure-roles-and-permissions). ## Which binding a permission needs A permission only applies if the principal's resource binding supports it. When you create a principal, the Dashboard only shows the direct permissions that work with the binding you chose. It marks role permissions that don't apply as ignored. | Binding | Direct permission groups the Dashboard offers | | ------------ | ---------------------------------------------------------------- | | Organization | Domains, IAM (2 groups, 12 permissions) | | Application | The 21 groups in [Application permissions](#application-permissions) | A principal with an Organization binding can manage domains and IAM, but it can't read messages. A principal with an Application binding can read messages, but it can't manage domains or IAM. If a service needs both, create 2 principals with a key for each. ## Organization permissions Organization permissions apply to things that belong to your whole Nylas organization, not to one application. They only work for a principal with an Organization binding. No system role includes the Domains permissions, so add them as direct permissions or with a custom role. | Group | Permission IDs | Used by | | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | | Domains | `domains.read`, `domains.create`, `domains.update`, `domains.delete` | [Manage Domains API](/docs/reference/api/manage-domains/) | | IAM | `iam.principals.read`, `iam.principals.create`, `iam.principals.update`, `iam.principals.delete`, `iam.credentials.read`, `iam.credentials.create`, `iam.credentials.update`, `iam.credentials.delete` | [IAM principals](/docs/reference/api/iam-principals/) and [IAM credentials](/docs/reference/api/iam-credentials/) APIs | With only `domains.read`, a principal can list and get domains. To register, verify, rename, and delete domains, assign all 4 Domains permissions. For setup steps, see [Create an IAM API key for domains](/docs/v3/email/domains/#create-an-iam-api-key-for-domains). The IAM Admin system role includes all 8 IAM permissions. The IAM Auditor role includes the 2 read permissions. ## Application permissions Application permissions apply to an application and its grants, workspaces, and other resources. The Dashboard shows these 21 groups for a principal with an Application binding. | Group | Permission IDs | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Applications | `applications.read`, `applications.update`, `callback_uris.read`, `callback_uris.create`, `callback_uris.update`, `callback_uris.delete` | | Attachments | `attachments.read`, `attachment_uploads.create`, `attachment_uploads.complete` | | Calendars | `calendars.read`, `calendars.create`, `calendars.update`, `calendars.delete`, `availability.read`, `free_busy.read`, `room_resources.read` | | Commerce | `orders.read`, `shipments.read`, `returns.read` | | Connectors | `connectors.read`, `connectors.create`, `connectors.update`, `connectors.delete`, `connector_credentials.read`, `connector_credentials.create`, `connector_credentials.update`, `connector_credentials.delete`, `providers.detect` | | Contacts | `contacts.read`, `contacts.create`, `contacts.update`, `contacts.delete`, `contact_groups.read` | | Custom hostnames | `certificates.read`, `certificates.create`, `certificates.update`, `certificates.delete`, `certificates.validate` | | Drafts | `drafts.read`, `drafts.create`, `drafts.update`, `drafts.delete`, `drafts.send` | | Events | `events.read`, `events.create`, `events.update`, `events.delete`, `events.import`, `events.rsvp` | | Folders | `folders.read`, `folders.create`, `folders.update`, `folders.delete` | | Grants | `grants.create`, `grants.read`, `grants.update`, `grants.delete` | | Inbox | `policies.read`, `policies.create`, `policies.update`, `policies.delete`, `rules.read`, `rules.create`, `rules.update`, `rules.delete`, `rule_evaluations.read`, `lists.read`, `lists.create`, `lists.update`, `lists.delete` | | Messages | `messages.read`, `messages.update`, `messages.delete`, `messages.clean`, `messages.send`, `scheduled_messages.read`, `scheduled_messages.delete`, `signatures.read`, `signatures.create`, `signatures.update`, `signatures.delete` | | Notetakers | `notetakers.read`, `notetakers.create`, `notetakers.update`, `notetakers.delete`, `notetakers.cancel`, `notetakers.remove`, `standalone_notetakers.read`, `standalone_notetakers.create`, `standalone_notetakers.update`, `standalone_notetakers.delete`, `standalone_notetakers.cancel`, `standalone_notetakers.remove` | | Notifications | `webhook_destinations.read`, `webhook_destinations.create`, `webhook_destinations.update`, `webhook_destinations.delete`, `webhook_destinations.rotate_secret`, `webhook_destinations.mock`, `webhook_destinations.test`, `pubsub_channels.read`, `pubsub_channels.create`, `pubsub_channels.update`, `pubsub_channels.delete`, `sns_channels.read`, `sns_channels.create`, `sns_channels.update`, `sns_channels.delete`, `dataconnectors.read`, `dataconnectors.create`, `dataconnectors.update`, `dataconnectors.delete` | | Scheduling | `configurations.read`, `configurations.create`, `configurations.update`, `configurations.delete`, `sessions.create`, `sessions.delete`, `bookings.create`, `bookings.read`, `bookings.update`, `bookings.confirm`, `bookings.reschedule`, `bookings.delete`, `group_events.read`, `group_events.create`, `group_events.update`, `group_events.delete`, `group_events.import`, `group_events.validate_slot` | | Smart Compose | `smart_compose.create` | | Templates | `templates.read`, `templates.create`, `templates.update`, `templates.delete`, `templates.render` | | Threads | `threads.read`, `threads.update`, `threads.delete` | | Transactional email | `transactional_emails.send` | | Workflows | `workflows.read`, `workflows.create`, `workflows.update`, `workflows.delete` | | Workspaces | `workspaces.read`, `workspaces.create`, `workspaces.update`, `workspaces.delete`, `workspaces.auto_group`, `workspaces.assign` | Workspace and Grant bindings limit these permissions to one workspace or one grant. Choose the narrowest binding that covers what the caller does, and only assign the permissions it uses. For example, a service that processes one mailbox only needs a Grant binding with `messages.read`, plus `messages.update` if it changes messages. ## What's next - [Nylas IAM](/docs/v3/auth/nylas-iam/) - [Manage IAM principals with the API](/docs/v3/auth/nylas-iam/manage-principals-with-api/) - [Manage email domains with the Domains API](/docs/v3/email/domains/) - [IAM principals API reference](/docs/reference/api/iam-principals/) - [IAM credentials API reference](/docs/reference/api/iam-credentials/)