Each Nylas IAM permission allows one action on one resource type. For example, messages.read allows reading messages. You assign permissions to a principal through roles, direct permissions, or both. The principal’s resource binding decides which permissions apply.
The tables below list every direct permission in the Dashboard, in the same groups the Dashboard uses.
How permission IDs work
Section titled “How permission IDs work”Permission IDs use the format resource.action, such as calendars.update. IAM permissions start with iam., such as iam.credentials.create. Most resources have 4 actions: read, create, update, and delete. Some resources have other actions, such as send or cancel.
You use the same IDs in the Dashboard and in the direct_permissions field when you create or update a principal with the API. If a principal calls an endpoint without the permission it needs, Nylas returns a 403 error. For how roles, permissions, and bindings work together, see Nylas IAM.
Which binding a permission needs
Section titled “Which binding a permission needs”A permission only applies if the principal’s resource binding supports it. When you create a principal, the Dashboard only shows the direct permissions that work with the binding you chose. It marks role permissions that don’t apply as ignored.
| Binding | Direct permission groups the Dashboard offers |
|---|---|
| Organization | Domains, IAM (2 groups, 12 permissions) |
| Application | The 21 groups in Application permissions |
A principal with an Organization binding can manage domains and IAM, but it can’t read messages. A principal with an Application binding can read messages, but it can’t manage domains or IAM. If a service needs both, create 2 principals with a key for each.
Organization permissions
Section titled “Organization permissions”Organization permissions apply to things that belong to your whole Nylas organization, not to one application. They only work for a principal with an Organization binding. No system role includes the Domains permissions, so add them as direct permissions or with a custom role.
| Group | Permission IDs | Used by |
|---|---|---|
| Domains | domains.read, domains.create, domains.update, domains.delete | Manage Domains API |
| IAM | iam.principals.read, iam.principals.create, iam.principals.update, iam.principals.delete, iam.credentials.read, iam.credentials.create, iam.credentials.update, iam.credentials.delete | IAM principals and IAM credentials APIs |
With only domains.read, a principal can list and get domains. To register, verify, rename, and delete domains, assign all 4 Domains permissions. For setup steps, see Create an IAM API key for domains.
The IAM Admin system role includes all 8 IAM permissions. The IAM Auditor role includes the 2 read permissions.
Application permissions
Section titled “Application permissions”Application permissions apply to an application and its grants, workspaces, and other resources. The Dashboard shows these 21 groups for a principal with an Application binding.
| Group | Permission IDs |
|---|---|
| Applications | applications.read, applications.update, callback_uris.read, callback_uris.create, callback_uris.update, callback_uris.delete |
| Attachments | attachments.read, attachment_uploads.create, attachment_uploads.complete |
| Calendars | calendars.read, calendars.create, calendars.update, calendars.delete, availability.read, free_busy.read, room_resources.read |
| Commerce | orders.read, shipments.read, returns.read |
| Connectors | connectors.read, connectors.create, connectors.update, connectors.delete, connector_credentials.read, connector_credentials.create, connector_credentials.update, connector_credentials.delete, providers.detect |
| Contacts | contacts.read, contacts.create, contacts.update, contacts.delete, contact_groups.read |
| Custom hostnames | certificates.read, certificates.create, certificates.update, certificates.delete, certificates.validate |
| Drafts | drafts.read, drafts.create, drafts.update, drafts.delete, drafts.send |
| Events | events.read, events.create, events.update, events.delete, events.import, events.rsvp |
| Folders | folders.read, folders.create, folders.update, folders.delete |
| Grants | grants.create, grants.read, grants.update, grants.delete |
| Inbox | policies.read, policies.create, policies.update, policies.delete, rules.read, rules.create, rules.update, rules.delete, rule_evaluations.read, lists.read, lists.create, lists.update, lists.delete |
| Messages | messages.read, messages.update, messages.delete, messages.clean, messages.send, scheduled_messages.read, scheduled_messages.delete, signatures.read, signatures.create, signatures.update, signatures.delete |
| Notetakers | notetakers.read, notetakers.create, notetakers.update, notetakers.delete, notetakers.cancel, notetakers.remove, standalone_notetakers.read, standalone_notetakers.create, standalone_notetakers.update, standalone_notetakers.delete, standalone_notetakers.cancel, standalone_notetakers.remove |
| Notifications | webhook_destinations.read, webhook_destinations.create, webhook_destinations.update, webhook_destinations.delete, webhook_destinations.rotate_secret, webhook_destinations.mock, webhook_destinations.test, pubsub_channels.read, pubsub_channels.create, pubsub_channels.update, pubsub_channels.delete, sns_channels.read, sns_channels.create, sns_channels.update, sns_channels.delete, dataconnectors.read, dataconnectors.create, dataconnectors.update, dataconnectors.delete |
| Scheduling | configurations.read, configurations.create, configurations.update, configurations.delete, sessions.create, sessions.delete, bookings.create, bookings.read, bookings.update, bookings.confirm, bookings.reschedule, bookings.delete, group_events.read, group_events.create, group_events.update, group_events.delete, group_events.import, group_events.validate_slot |
| Smart Compose | smart_compose.create |
| Templates | templates.read, templates.create, templates.update, templates.delete, templates.render |
| Threads | threads.read, threads.update, threads.delete |
| Transactional email | transactional_emails.send |
| Workflows | workflows.read, workflows.create, workflows.update, workflows.delete |
| Workspaces | workspaces.read, workspaces.create, workspaces.update, workspaces.delete, workspaces.auto_group, workspaces.assign |
Workspace and Grant bindings limit these permissions to one workspace or one grant. Choose the narrowest binding that covers what the caller does, and only assign the permissions it uses. For example, a service that processes one mailbox only needs a Grant binding with messages.read, plus messages.update if it changes messages.