From d0dc671a10ceefbe00d1cd878ec8e55cea4c05a0 Mon Sep 17 00:00:00 2001 From: Robin Roy <66296664+robin-rrt@users.noreply.github.com> Date: Tue, 13 Oct 2026 18:28:39 +0530 Subject: [PATCH 01/15] inital structure --- src/components/LeftSidebar/LeftSidebar.astro | 22 +++++++++ src/config/sidebar.ts | 2 + src/config/sidebar/chainlink-platform.ts | 48 +++++++++++++++++++ src/content.config.ts | 9 ++++ src/content/chainlink-platform/api-keys.mdx | 22 +++++++++ .../creating-an-account.mdx | 26 ++++++++++ .../inviting-team-members.mdx | 22 +++++++++ src/content/chainlink-platform/rbac.mdx | 22 +++++++++ src/pages/chainlink-platform/[...id].astro | 29 +++++++++++ 9 files changed, 202 insertions(+) create mode 100644 src/config/sidebar/chainlink-platform.ts create mode 100644 src/content/chainlink-platform/api-keys.mdx create mode 100644 src/content/chainlink-platform/creating-an-account.mdx create mode 100644 src/content/chainlink-platform/inviting-team-members.mdx create mode 100644 src/content/chainlink-platform/rbac.mdx create mode 100644 src/pages/chainlink-platform/[...id].astro diff --git a/src/components/LeftSidebar/LeftSidebar.astro b/src/components/LeftSidebar/LeftSidebar.astro index c9e87b7f806..7446dab28e9 100644 --- a/src/components/LeftSidebar/LeftSidebar.astro +++ b/src/components/LeftSidebar/LeftSidebar.astro @@ -4,6 +4,10 @@ import { SIDEBAR_WITH_SUNSET_PRODUCTS, CCIP_SIDEBARS } from "../../config" import type { SectionEntry, SectionContent } from "../../config" import { SIDEBAR_SECTIONS } from "../../config/sidebarSections.ts" import { AI_AGENT_RESOURCES_SECTION, withParentQuery } from "../../config/sidebar/ai-agent-resources.ts" +import { + CHAINLINK_PLATFORM_SECTION, + withParentQuery as withPlatformParentQuery, +} from "../../config/sidebar/chainlink-platform.ts" import { getSolutionsSection } from "../../config/sidebar/solutions.ts" import RecursiveSidebar from "./RecursiveSidebar.astro" import { LanguageSwitcherDropdown } from "~/components/LanguageSwitcherDropdown" @@ -24,6 +28,14 @@ type SectionEntryWithParent = SectionEntry & { parentSection?: string } /** Product sidebars that should not duplicate the shared AI resources footer. */ const SECTIONS_WITHOUT_AI_RESOURCES = new Set([SIDEBAR_SECTIONS.GLOBAL, SIDEBAR_SECTIONS.LEGACY]) +/** Product sidebars that include the shared Chainlink Platform section. */ +const SECTIONS_WITH_CHAINLINK_PLATFORM = new Set([ + SIDEBAR_SECTIONS.CRE, + SIDEBAR_SECTIONS.ACE, + SIDEBAR_SECTIONS.CREC, + SIDEBAR_SECTIONS.DATA_STREAMS, +]) + export type Props = { currentPage: string section?: Sections @@ -74,6 +86,13 @@ function getSidebarSections(section?: Sections): SectionEntryWithParent[] { }) } + if (SECTIONS_WITH_CHAINLINK_PLATFORM.has(parentSection as Sections)) { + sections.push({ + ...withPlatformParentQuery(CHAINLINK_PLATFORM_SECTION, parentSection as Sections), + parentSection: parentSection as Sections, + }) + } + return sections }) } @@ -108,6 +127,9 @@ function getSidebarSections(section?: Sections): SectionEntryWithParent[] { ...productSections, ...(solutionsSection ? [solutionsSection] : []), withParentQuery(AI_AGENT_RESOURCES_SECTION, section), + ...(SECTIONS_WITH_CHAINLINK_PLATFORM.has(section) + ? [withPlatformParentQuery(CHAINLINK_PLATFORM_SECTION, section)] + : []), ] } diff --git a/src/config/sidebar.ts b/src/config/sidebar.ts index 7ffb0d295e6..f7b0fe62722 100644 --- a/src/config/sidebar.ts +++ b/src/config/sidebar.ts @@ -9,6 +9,7 @@ import { isSunsetSidebarSection } from "./sunset.ts" import { CCIP_SIDEBAR_CONTENT } from "./sidebar/ccip-dynamic.ts" import { CCIP_V16_SIDEBAR_CONTENT } from "./sidebar/ccip-v1.ts" import { AI_AGENT_RESOURCES_SECTION } from "./sidebar/ai-agent-resources.ts" +import { CHAINLINK_PLATFORM_SECTION } from "./sidebar/chainlink-platform.ts" import type { ChainType, CcipVersion } from "./types.js" import chainlinkLocalV021Contents from "./sidebar/chainlink-local/api-reference/v0_2_1.json" with { type: "json" } import chainlinkLocalV022Contents from "./sidebar/chainlink-local/api-reference/v0_2_2.json" with { type: "json" } @@ -2862,6 +2863,7 @@ export const SIDEBAR_WITH_SUNSET_PRODUCTS: Partial ({ + ...item, + url: item.url ? addParentParam(item.url, parent) : item.url, + children: item.children ? mapContentsWithParent(item.children, parent) : undefined, + })) +} + +/** Returns the Chainlink Platform section with URLs scoped to a product sidebar via `?parent=`. */ +export function withParentQuery(section: SectionEntry, parent: Sections): SectionEntry { + return { + ...section, + contents: mapContentsWithParent(section.contents, parent), + } +} diff --git a/src/content.config.ts b/src/content.config.ts index e52fc3556ac..4b53b72e1a2 100644 --- a/src/content.config.ts +++ b/src/content.config.ts @@ -199,6 +199,14 @@ const resourcesCollection = defineCollection({ schema: baseFrontmatter, }) +const chainlinkPlatformCollection = defineCollection({ + loader: glob({ + base: "./src/content/chainlink-platform", + pattern: "**/*.md?(x)", + }), + schema: baseFrontmatter, +}) + const vrfCollection = defineCollection({ loader: glob({ base: "./src/content/vrf", @@ -330,6 +338,7 @@ export const collections = { cre: creCollection, crec: crecCollection, resources: resourcesCollection, + "chainlink-platform": chainlinkPlatformCollection, vrf: vrfCollection, "chainlink-local": chainlinkLocalCollection, quickstarts: quickstartsCollection, diff --git a/src/content/chainlink-platform/api-keys.mdx b/src/content/chainlink-platform/api-keys.mdx new file mode 100644 index 00000000000..e4dc57c8734 --- /dev/null +++ b/src/content/chainlink-platform/api-keys.mdx @@ -0,0 +1,22 @@ +--- +section: global +date: Last Modified +title: "API Keys" +metadata: + title: "API Keys" + description: "Learn how to create and manage API keys for the Chainlink Platform." +--- + +import { Aside } from "@components" + + + +## Overview + +TODO: Describe API keys on the Chainlink Platform and what they are used for. + +## Managing API keys + +TODO: Walk through creating, rotating, and revoking API keys. diff --git a/src/content/chainlink-platform/creating-an-account.mdx b/src/content/chainlink-platform/creating-an-account.mdx new file mode 100644 index 00000000000..991f04103ba --- /dev/null +++ b/src/content/chainlink-platform/creating-an-account.mdx @@ -0,0 +1,26 @@ +--- +section: global +date: Last Modified +title: "Creating an Account" +metadata: + title: "Creating an Account" + description: "Learn how to create a Chainlink Platform account to get started with Chainlink services." +--- + +import { Aside } from "@components" + + + +## Overview + +TODO: Describe what a Chainlink Platform account is and why you need one. + +## Prerequisites + +TODO: List what you need before creating an account. + +## Steps + +TODO: Walk through creating an account. diff --git a/src/content/chainlink-platform/inviting-team-members.mdx b/src/content/chainlink-platform/inviting-team-members.mdx new file mode 100644 index 00000000000..de33f2c3b1f --- /dev/null +++ b/src/content/chainlink-platform/inviting-team-members.mdx @@ -0,0 +1,22 @@ +--- +section: global +date: Last Modified +title: "Inviting Team Members" +metadata: + title: "Inviting Team Members" + description: "Learn how to invite teammates to your Chainlink Platform organization and manage their access." +--- + +import { Aside } from "@components" + + + +## Overview + +TODO: Describe team collaboration on the Chainlink Platform. + +## Steps + +TODO: Walk through inviting team members to your organization. diff --git a/src/content/chainlink-platform/rbac.mdx b/src/content/chainlink-platform/rbac.mdx new file mode 100644 index 00000000000..041c1c345b4 --- /dev/null +++ b/src/content/chainlink-platform/rbac.mdx @@ -0,0 +1,22 @@ +--- +section: global +date: Last Modified +title: "RBAC" +metadata: + title: "RBAC" + description: "Learn how role-based access control (RBAC) works on the Chainlink Platform." +--- + +import { Aside } from "@components" + + + +## Overview + +TODO: Describe role-based access control on the Chainlink Platform. + +## Available roles + +TODO: List the available roles and what each role can do. diff --git a/src/pages/chainlink-platform/[...id].astro b/src/pages/chainlink-platform/[...id].astro new file mode 100644 index 00000000000..13d52fc320d --- /dev/null +++ b/src/pages/chainlink-platform/[...id].astro @@ -0,0 +1,29 @@ +--- +import DocsLayout from "~/layouts/DocsLayout.astro" +import { getCollection, render } from "astro:content" + +export async function getStaticPaths() { + const platformEntries = await getCollection("chainlink-platform") + + return platformEntries.map((entry) => { + const routeId = entry.id.replace(/\.(md|mdx)$/, "") + + return { + params: { id: routeId }, + props: { entry }, + } + }) +} + +interface Props { + entry: Awaited>>[number] +} + +const { entry } = Astro.props + +const { Content, headings } = await render(entry) +--- + + + + From 9fdd5e28142ddc70189674aa9ac14ba5fc29e43e Mon Sep 17 00:00:00 2001 From: Robin Roy <66296664+robin-rrt@users.noreply.github.com> Date: Wed, 14 Oct 2026 21:54:50 +0530 Subject: [PATCH 02/15] restructure and redirect --- astro.config.ts | 1 + .../ProductNavigation/Desktop/MegaMenu.tsx | 7 + src/components/Header/getNavigationProps.ts | 13 + src/components/LeftSidebar/LeftSidebar.astro | 35 +- src/config/sidebar.ts | 60 +- src/config/sidebar/ai-agent-resources.ts | 25 +- src/config/sidebar/chainlink-platform.ts | 35 +- src/config/sidebar/parent-query.ts | 29 + src/config/sidebarSections.ts | 1 + src/content/chainlink-platform/api-keys.mdx | 2 +- .../creating-an-account.mdx | 157 +- .../inviting-team-members.mdx | 88 +- src/content/chainlink-platform/overview.mdx | 26 + src/content/chainlink-platform/rbac.mdx | 2 +- .../understanding-organizations.mdx | 19 +- .../cre-templates/ai-audit-firewall.mdx | 4 +- .../automated-liquidation-protection.mdx | 4 +- .../automated-portfolio-rebalancing.mdx | 4 +- .../hello-confidential-workflows.mdx | 2 +- src/content/cre/account/creating-account.mdx | 160 - src/content/cre/account/index.mdx | 51 - .../cre/concepts/confidential-workflows.mdx | 6 +- .../getting-started/before-you-build-go.mdx | 4 +- .../getting-started/before-you-build-ts.mdx | 4 +- .../cre/getting-started/build-with-ai-go.mdx | 2 +- .../cre/getting-started/build-with-ai-ts.mdx | 2 +- .../cli-installation/macos-linux.mdx | 4 +- .../cli-installation/windows.mdx | 4 +- .../part-1-project-setup-go.mdx | 4 +- .../part-1-project-setup-ts.mdx | 4 +- .../cre/{account => guides/cli}/cli-login.mdx | 2 +- .../{account => guides/cli}/managing-auth.mdx | 4 +- .../confidential-workflows-access.mdx | 2 +- .../operations}/deploy-access.mdx | 0 .../deploying-to-onchain-registry-go.mdx | 6 +- .../deploying-to-onchain-registry-ts.mdx | 6 +- .../deploying-to-private-registry-go.mdx | 8 +- .../deploying-to-private-registry-ts.mdx | 8 +- .../guides/operations/deploying-workflows.mdx | 2 +- .../operations/linking-wallet-keys.mdx} | 4 +- .../operations/simulating-workflows.mdx | 2 +- .../operations/using-multisig-wallets.mdx | 2 +- .../using-confidential-workflows/index.mdx | 2 +- .../making-workflow-confidential-go.mdx | 2 +- .../making-workflow-confidential-ts.mdx | 2 +- .../using-solana-client/onchain-write-go.mdx | 2 +- .../using-solana-client/onchain-write-ts.mdx | 2 +- .../http-trigger/testing-in-simulation.mdx | 2 +- src/content/cre/index.mdx | 6 +- src/content/cre/key-terms.mdx | 2 +- src/content/cre/llms-full-go.txt | 2580 ++++++------- src/content/cre/llms-full-ts.txt | 3216 ++++++++--------- src/content/cre/llms.txt | 5 +- src/content/cre/organization/index.mdx | 20 - .../cre/organization/inviting-members.mdx | 91 - src/content/cre/overview.mdx | 4 +- src/content/cre/privacy/index.mdx | 2 +- src/content/cre/reference/cli/account.mdx | 26 +- .../cre/reference/cli/authentication.mdx | 10 +- src/content/cre/reference/cli/execution.mdx | 2 +- .../cre/reference/cli/project-setup-go.mdx | 8 +- .../cre/reference/cli/project-setup-ts.mdx | 4 +- src/content/cre/reference/cli/registry.mdx | 2 +- src/content/cre/reference/cli/secrets.mdx | 3 +- src/content/cre/reference/cli/workflow.mdx | 34 +- .../cre/reference/gelato-migration-go.mdx | 2 +- .../cre/reference/gelato-migration-ts.mdx | 2 +- .../reference/graphql-api/authentication.mdx | 4 +- .../cre/reference/graphql-api/errors.mdx | 4 +- .../cre/reference/graphql-api/index.mdx | 2 +- .../cre/reference/graphql-api/quickstart.mdx | 2 +- .../sdk/confidential-workflows-client-go.mdx | 2 +- .../sdk/confidential-workflows-client-ts.mdx | 2 +- src/content/cre/release-notes.mdx | 2 +- src/content/cre/support-feedback.mdx | 2 +- .../templates/running-demo-workflow-go.mdx | 2 +- .../templates/running-demo-workflow-ts.mdx | 2 +- src/features/redirects/redirects.json | 50 + 78 files changed, 3093 insertions(+), 3817 deletions(-) create mode 100644 src/config/sidebar/parent-query.ts create mode 100644 src/content/chainlink-platform/overview.mdx rename src/content/{cre/organization => chainlink-platform}/understanding-organizations.mdx (82%) delete mode 100644 src/content/cre/account/creating-account.mdx delete mode 100644 src/content/cre/account/index.mdx rename src/content/cre/{account => guides/cli}/cli-login.mdx (97%) rename src/content/cre/{account => guides/cli}/managing-auth.mdx (97%) rename src/content/cre/{account => guides/operations}/confidential-workflows-access.mdx (93%) rename src/content/cre/{account => guides/operations}/deploy-access.mdx (100%) rename src/content/cre/{organization/linking-keys.mdx => guides/operations/linking-wallet-keys.mdx} (99%) delete mode 100644 src/content/cre/organization/index.mdx delete mode 100644 src/content/cre/organization/inviting-members.mdx diff --git a/astro.config.ts b/astro.config.ts index a3a41126569..0b4e7b05cc3 100644 --- a/astro.config.ts +++ b/astro.config.ts @@ -48,6 +48,7 @@ export default defineConfig({ "/ccip/supported-networks": "/ccip/directory/mainnet", "/getting-started": "/getting-started/conceptual-overview", "/resources": "/resources/link-token-contracts", + "/chainlink-platform": "/chainlink-platform/overview", ...ccipRedirects, }, integrations: [ diff --git a/src/components/Header/Nav/ProductNavigation/Desktop/MegaMenu.tsx b/src/components/Header/Nav/ProductNavigation/Desktop/MegaMenu.tsx index bf0782ca383..d41814213db 100644 --- a/src/components/Header/Nav/ProductNavigation/Desktop/MegaMenu.tsx +++ b/src/components/Header/Nav/ProductNavigation/Desktop/MegaMenu.tsx @@ -6,6 +6,7 @@ import dataLinkLogo from "../../../../../assets/product-logos/datalink-logo.svg" import vrfLogo from "../../../../../assets/product-logos/vrf-logo.svg" import dtaLogo from "../../../../../assets/product-logos/dta-logo.svg" import generalGlobeLogo from "../../../../../assets/product-logos/general-globe-logo.svg" +import platformLogo from "../../../../../assets/product-logos/automation-logo.svg" import nodesLogo from "../../../../../assets/product-logos/nodes-logo.svg" import chainlinkLocalLogo from "../../../../../assets/product-logos/chainlink-local-2-logo.svg" import creLogo from "../../../../../assets/product-logos/cre-logo.svg" @@ -156,6 +157,12 @@ export const megaMenuSections = { description: "Foundational Chainlink knowledge", link: "/getting-started/conceptual-overview", }, + { + icon: platformLogo, + title: "Chainlink Platform", + description: "Accounts, organizations, access control, and API keys", + link: "/chainlink-platform", + }, { icon: chainlinkLocalLogo, title: "Chainlink Local", diff --git a/src/components/Header/getNavigationProps.ts b/src/components/Header/getNavigationProps.ts index ea79df8dd0f..42291c84855 100644 --- a/src/components/Header/getNavigationProps.ts +++ b/src/components/Header/getNavigationProps.ts @@ -9,6 +9,7 @@ import dtaLogo from "../../assets/product-logos/dta-logo.svg" import dataLinkLogo from "../../assets/product-logos/datalink-logo.svg" import chainlinkLocal from "../../assets/product-logos/chainlink-local.svg" import generalLogo from "../../assets/product-logos/general-logo.svg" +import platformLogo from "../../assets/product-logos/automation-logo.svg" import nodesLogo from "../../assets/product-logos/node-logo.svg" import quickstartLogo from "../../assets/product-logos/quickstart-logo.svg" import { SIDEBAR as sidebar } from "../../config/sidebar.ts" @@ -169,6 +170,12 @@ const desktopSubProductsNav = [ col: 2, hideFromDropdown: true, }, + { + label: "Platform", + href: "/chainlink-platform", + icon: platformLogo.src, + col: 2, + }, ] const getDocsSections = (pageSdkLangMap: Map) => [ @@ -242,6 +249,12 @@ const getDocsSections = (pageSdkLangMap: Map) => [ icon: generalLogo.src, subProducts: getSubProducts(sidebar.global, new Map(), "global"), }, + { + label: "Platform", + href: "/chainlink-platform", + icon: platformLogo.src, + subProducts: getSubProducts(sidebar.chainlinkPlatform, new Map()), + }, ], }, ] diff --git a/src/components/LeftSidebar/LeftSidebar.astro b/src/components/LeftSidebar/LeftSidebar.astro index 7446dab28e9..f5c6b1d991a 100644 --- a/src/components/LeftSidebar/LeftSidebar.astro +++ b/src/components/LeftSidebar/LeftSidebar.astro @@ -4,10 +4,8 @@ import { SIDEBAR_WITH_SUNSET_PRODUCTS, CCIP_SIDEBARS } from "../../config" import type { SectionEntry, SectionContent } from "../../config" import { SIDEBAR_SECTIONS } from "../../config/sidebarSections.ts" import { AI_AGENT_RESOURCES_SECTION, withParentQuery } from "../../config/sidebar/ai-agent-resources.ts" -import { - CHAINLINK_PLATFORM_SECTION, - withParentQuery as withPlatformParentQuery, -} from "../../config/sidebar/chainlink-platform.ts" +import { CHAINLINK_PLATFORM_SECTION } from "../../config/sidebar/chainlink-platform.ts" +import { withParentQuery as withPlatformParentQuery } from "../../config/sidebar/parent-query.ts" import { getSolutionsSection } from "../../config/sidebar/solutions.ts" import RecursiveSidebar from "./RecursiveSidebar.astro" import { LanguageSwitcherDropdown } from "~/components/LanguageSwitcherDropdown" @@ -36,6 +34,13 @@ const SECTIONS_WITH_CHAINLINK_PLATFORM = new Set([ SIDEBAR_SECTIONS.DATA_STREAMS, ]) +/** + * Sections whose pages render every product sidebar (hidden) and reveal the + * matching one client-side via the `?parent=` query parameter. Their own + * sidebar is shown by default when no `?parent=` is present. + */ +const SHARED_PAGE_SECTIONS = new Set([SIDEBAR_SECTIONS.GLOBAL, SIDEBAR_SECTIONS.CHAINLINK_PLATFORM]) + export type Props = { currentPage: string section?: Sections @@ -63,8 +68,10 @@ function detectCcipVersionFromPage(page: string): CcipVersion { function getSidebarSections(section?: Sections): SectionEntryWithParent[] { if (!section) { return [] - } else if (section === "global") { - // Flatten all sidebar entries into one array (include AI resources per product) + } else if (SHARED_PAGE_SECTIONS.has(section)) { + // Shared-page sections render every product sidebar (hidden) and reveal the + // matching one client-side via `?parent=`. The section's own sidebar is + // shown by default when no `?parent=` is present. return Object.entries(SIDEBAR_WITH_SUNSET_PRODUCTS).flatMap(([parentSection, entries]) => { const sections = entries?.map((entry) => ({ ...entry, parentSection: parentSection as Sections })) ?? [] @@ -180,7 +187,7 @@ function removeSlashes(url: string): string { const sidebarSections = getSidebarSections(section) --- - diff --git a/src/components/DocsNavigation/DocsNavigationMobile/DocsPickerMobile.tsx b/src/components/DocsNavigation/DocsNavigationMobile/DocsPickerMobile.tsx index 855966deb48..eda104c5d15 100644 --- a/src/components/DocsNavigation/DocsNavigationMobile/DocsPickerMobile.tsx +++ b/src/components/DocsNavigation/DocsNavigationMobile/DocsPickerMobile.tsx @@ -9,7 +9,7 @@ import { BottomBar } from "./BottomBar.tsx" import { ProductContent } from "./ProductContent.tsx" import { SubProductContent } from "./SubProductContent.tsx" import styles from "./productNavigation.module.css" -import { getNavigationProps, getSubProducts } from "../../Header/getNavigationProps.ts" +import { getNavigationProps, getSubProducts, getSubProductByParentParam } from "../../Header/getNavigationProps.ts" import defaultLogo from "../../../assets/product-logos/default-logo.svg" import { useStore } from "@nanostores/react" import { selectedCcipVersion } from "~/stores/ccipVersion.js" @@ -24,6 +24,7 @@ declare global { type Props = { path: string + parentSection?: string | null } const Trigger = extendRadixComponent(Dialog.Trigger) @@ -72,7 +73,7 @@ const buildSubProducts = (product: ProductItem | undefined, ccipVersion: CcipVer } } -export function ProductNavigation({ path }: Props) { +export function ProductNavigation({ path, parentSection = null }: Props) { const [open, setOpen] = React.useState(false) // Which product's sub-nav is open. The tree itself is DERIVED from this (+ the CCIP version) in the // `subProducts` memo below, so there is exactly one source of truth and the tree can never diverge @@ -89,9 +90,12 @@ export function ProductNavigation({ path }: Props) { const ccipVersion = useStore(selectedCcipVersion) const subProductTrigger = subProductsNav?.find(({ href }) => isMatchedPath(path, href)) + // A shared page viewed through a product sidebar keeps that product in the trigger. + const parentProduct = getSubProductByParentParam(parentSection) + const activeProduct = parentProduct || subProductTrigger - const label = subProductTrigger?.label || "Resources" - const icon = subProductTrigger?.label ? subProductTrigger.icon : defaultLogo.src + const label = activeProduct?.label || "Resources" + const icon = activeProduct?.label ? activeProduct.icon : defaultLogo.src // Single source of truth for the open product's tree. Rebuilds when the active product OR the CCIP // version changes — so re-entering CCIP always shows the correct, versioned, chain-filterable tree @@ -103,18 +107,22 @@ export function ProductNavigation({ path }: Props) { ) // On page (path) change, select the product whose section owns this URL and show its sub-nav. + // A shared page viewed through a product sidebar (`?parent=`) selects that product instead. // Version is handled by the memo above, so it is intentionally NOT a dependency here. useEffect(() => { - const match = productsNav.categories - .flatMap((category) => category.items) - .find((item) => item.subProducts && isMatchedPath(path, item.href)) + const parentItem = parentProduct ? findProduct(productsNav, parentProduct.href) : undefined + const match = parentItem?.subProducts + ? parentItem + : productsNav.categories + .flatMap((category) => category.items) + .find((item) => item.subProducts && isMatchedPath(path, item.href)) if (match) { setActiveProductHref(match.href) setProductsSlidePosition("submenu") } else { setActiveProductHref(null) } - }, [path, productsNav]) + }, [path, productsNav, parentProduct]) const onProductClick = React.useCallback((product: ProductItem) => { setActiveProductHref(product.href) diff --git a/src/components/DocsNavigation/index.tsx b/src/components/DocsNavigation/index.tsx index 4df1aa039c8..412e23d8b5f 100644 --- a/src/components/DocsNavigation/index.tsx +++ b/src/components/DocsNavigation/index.tsx @@ -1,4 +1,4 @@ -import React from "react" +import React, { useEffect, useState } from "react" import DocsNavigationDesktop from "./DocsNavigationDesktop/DocsNavigationDesktop.tsx" import DocsNavigationMobile from "./DocsNavigationMobile/DocsNavigationMobile.tsx" @@ -11,12 +11,25 @@ function DocsNavigation({ children?: React.ReactNode isCcipDirectory?: boolean }) { + // Shared pages viewed through a product sidebar carry `?parent=
`. The param never reaches + // this island as a prop (static output), so read it on the client. useState + useEffect (rather + // than a render-time read) keeps the first client render identical to the server-rendered HTML. + const [parentSection, setParentSection] = useState(null) + useEffect(() => { + const readParentSection = () => setParentSection(new URLSearchParams(window.location.search).get("parent")) + readParentSection() + document.addEventListener("astro:after-swap", readParentSection) + return () => document.removeEventListener("astro:after-swap", readParentSection) + }, []) + return ( <> - + {children} - {children} + + {children} + ) } diff --git a/src/components/Header/getNavigationProps.ts b/src/components/Header/getNavigationProps.ts index 4f6fa0e8f45..a8127b9b3d0 100644 --- a/src/components/Header/getNavigationProps.ts +++ b/src/components/Header/getNavigationProps.ts @@ -178,6 +178,32 @@ const desktopSubProductsNav = [ }, ] +/* + Shared pages rendered inside a product's sidebar carry `?parent=
` (see + src/config/sidebar/parent-query.ts). The docs picker uses that param to keep showing the product + the reader is browsing instead of the section that owns the shared page. Sections without an entry + here (e.g. automation, chainlinkFunctions) fall back to path-based matching. +*/ +const parentSectionToHref: Partial> = { + ace: "/ace", + cre: "/cre", + crec: "/crec", + dataFeeds: "/data-feeds", + dataStreams: "/data-streams", + dataLink: "/datalink", + ccip: "/ccip", + vrf: "/vrf", + chainlinkLocal: "/chainlink-local", + nodeOperator: "/chainlink-nodes", + "dta-technical-standard": "/dta-technical-standard", + chainlinkPlatform: "/chainlink-platform", +} + +export const getSubProductByParentParam = (parent: string | null | undefined) => { + const href = parent ? parentSectionToHref[parent as Sections] : undefined + return href ? desktopSubProductsNav.find((item) => item.href === href) : undefined +} + const getDocsSections = (pageSdkLangMap: Map) => [ { label: "Documentation", diff --git a/src/config/sidebar/chainlink-platform.ts b/src/config/sidebar/chainlink-platform.ts index c7a60414062..e2a174e0d64 100644 --- a/src/config/sidebar/chainlink-platform.ts +++ b/src/config/sidebar/chainlink-platform.ts @@ -13,13 +13,17 @@ export const CHAINLINK_PLATFORM_CONTENTS: SectionContent[] = [ title: "Creating an Account", url: "chainlink-platform/creating-an-account", }, + { + title: "Understanding Organizations", + url: "chainlink-platform/understanding-organizations", + }, { title: "Inviting Team Members", url: "chainlink-platform/inviting-team-members", }, { - title: "Understanding Organizations", - url: "chainlink-platform/understanding-organizations", + title: "Assigning and Modifying Roles", + url: "chainlink-platform/assigning-and-modifying-roles", }, { title: "RBAC (Role-Based Access Control)", diff --git a/src/content/ace/getting-started/account-setup.mdx b/src/content/ace/getting-started/account-setup.mdx index 87dd271c7ad..182d970c47b 100644 --- a/src/content/ace/getting-started/account-setup.mdx +++ b/src/content/ace/getting-started/account-setup.mdx @@ -58,7 +58,7 @@ Once your account has been provisioned for the ACE service, create an API key. - have both a Chainlink Platform role (**Admin** or **User**) and an ACE role (**Admin** or **Operator**). -See [RBAC](/chainlink-platform/rbac?parent=ace) for how roles work. +For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=ace#ace). To invite team members and assign roles, see [Invite members](/chainlink-platform/invite-members?parent=ace). diff --git a/src/content/ace/llms-full.txt b/src/content/ace/llms-full.txt index e3c2299824d..f79e82488cf 100644 --- a/src/content/ace/llms-full.txt +++ b/src/content/ace/llms-full.txt @@ -1812,7 +1812,7 @@ Once your account has been provisioned for the ACE service, create an API key. > > - have both a Chainlink Platform role (**Admin** or **User**) and an ACE role (**Admin** or **Operator**). > -> See [RBAC](/chainlink-platform/rbac?parent=ace) for how roles work. +> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=ace#ace). To invite team members and assign roles, see [Invite members](/chainlink-platform/invite-members?parent=ace). 1. Log in to the [Chainlink Platform](https://app.chain.link), click on "Org settings" in the top-right corner of the navbar to open your **Organization Settings** page, then open the **API Keys** tab. diff --git a/src/content/chainlink-platform/assigning-and-modifying-roles.mdx b/src/content/chainlink-platform/assigning-and-modifying-roles.mdx new file mode 100644 index 00000000000..db77072ba27 --- /dev/null +++ b/src/content/chainlink-platform/assigning-and-modifying-roles.mdx @@ -0,0 +1,80 @@ +--- +section: chainlinkPlatform +date: Last Modified +title: "Assigning and Modifying Roles" +metadata: + title: "Assigning and Modifying Roles" + description: "Change the roles that organization members hold for each product: open a member's edit form from the Members tab, pick a role for each product, preview the permissions a role grants, and save." + datePublished: "2026-10-20" + lastModified: "2026-10-20" +--- + +import { ClickToZoom } from "@components" + +Each member of your organization has a role for each product, and that role determines what the member can do in the product. This guide covers assigning and changing those roles from the **Members** tab of the **Organization** page. + +For what each role includes, see [RBAC](/chainlink-platform/rbac). To add a new member to your organization, see [Inviting Team Members](/chainlink-platform/inviting-team-members). + +## Prerequisites + +- You must be logged in to app.chain.link. +- You must have a role that can manage member roles: + - The **Owner** and **Platform Admins** can manage member roles for all products. + - **Product Admins** (for example, a CRE Admin) can manage member roles for their product only. +- The member whose roles you want to change must already belong to your organization. If they don't, invite them first: see [Inviting Team Members](/chainlink-platform/inviting-team-members). + +You can only set roles for products that you have access to. + +## Adding or Modifying a member's roles + +1. Sign in to app.chain.link. +1. Click your account icon in the top-right corner, then click **Org settings** to open the **Organization** page. + + + +1. Open the **Members** tab. It lists every member of your organization. + + + +1. Click the member's name to open the **Edit member form**. + +1. On the **Roles** tab, open the dropdown next to a product and select the member's role for that product. The roles available in each dropdown depend on the product: + + + + | Product | Available roles | + | ------------- | ----------------------------------- | + | Platform | Admin, User, Viewer | + | ACE | Admin, Operator, Viewer, No Access | + | CRE | Admin, Developer, Viewer, No Access | + | CRE Connect | Admin, Operator, Viewer, No Access | + | Data Streams | Admin, No Access | + | Agent Gateway | Admin, No Access | + + Set a product to **No Access** to remove the member's access to that product. The **Platform** role is required and has no **No Access** option. + +1. To preview what a role grants before saving, expand the product's accordion. It shows the role's description and the permissions the role includes, grouped by service. Products set to **No Access** show **No role selected**. + + + +1. Click **Save changes**. Click **Cancel** to discard your changes. + +## Related + +- [RBAC](/chainlink-platform/rbac) - See what permissions each role includes for every product. +- [Inviting Team Members](/chainlink-platform/inviting-team-members) - Add new members to your organization. +- [API Keys](/chainlink-platform/api-keys) - Give applications scoped permissions instead of member roles. diff --git a/src/content/chainlink-platform/getting-started.mdx b/src/content/chainlink-platform/getting-started.mdx index 7b1f2838787..dcc38e99475 100644 --- a/src/content/chainlink-platform/getting-started.mdx +++ b/src/content/chainlink-platform/getting-started.mdx @@ -24,4 +24,5 @@ When you create an account, you either start a new organization (becoming the _O Each member of your organization has a role for each product, and API keys carry the permissions you select for them. To learn more, see: - [RBAC](/chainlink-platform/rbac) - Role-based access control and what each role can do +- [Assigning and Modifying Roles](/chainlink-platform/assigning-and-modifying-roles) - Change the roles that organization members hold for each product - [API Keys](/chainlink-platform/api-keys) - Create and manage API keys for programmatic access diff --git a/src/content/chainlink-platform/inviting-team-members.mdx b/src/content/chainlink-platform/inviting-team-members.mdx index 4c463751c55..96f1b77ba18 100644 --- a/src/content/chainlink-platform/inviting-team-members.mdx +++ b/src/content/chainlink-platform/inviting-team-members.mdx @@ -26,7 +26,7 @@ To collaborate with your team on workflows, you can invite members to your organ ## Step 1: Navigate to Organization settings -In the left sidebar, click on **"Organization"**. +In the top navbar, click on your account icon, and then navigate to **"Org settings"**. + ## Step 4: Add team member details @@ -54,11 +58,11 @@ Enter the **email address** of the person you want to invite, and set their **ro ## Step 5: Send invitations -Once you've set all the roles you want to define for the invited member, click the **"Submit"** button in the bottom right corner. +Once you've set all the roles you want to define for the invited member, click the **"Send invite"** button in the bottom right corner. @@ -82,4 +86,5 @@ After you send invitations: - [Understanding Organizations](/chainlink-platform/understanding-organizations) - Learn about organization roles and permissions - [RBAC](/chainlink-platform/rbac) - Learn about member roles and what each role can do +- [Assigning and Modifying Roles](/chainlink-platform/assigning-and-modifying-roles) - Change a member's roles after they join - [Linking Wallet Keys](/cre/guides/operations/linking-wallet-keys) - Help new members connect their wallets diff --git a/src/content/chainlink-platform/rbac.mdx b/src/content/chainlink-platform/rbac.mdx index b32fb955bb8..c2999a450b6 100644 --- a/src/content/chainlink-platform/rbac.mdx +++ b/src/content/chainlink-platform/rbac.mdx @@ -222,17 +222,11 @@ Members with the appropriate permissions can assign and change roles for other m - **Product Admins** (for example, CRE Admins) can manage member roles for their product. - The **Owner** can manage member roles for all products. -To assign or change a member's roles: - -1. Sign in to app.chain.link. -1. Click on your account's icon in the top-right corner, then click on _Org settings_ in the dropdown to open the **Organization** page. -1. Click to open the **Members** tab, if not already on it. -1. Click the member's name in the members table to open the **Edit member form**. -1. On the **Roles** tab, select a role for each product. Every product lists a role selector, including **No Access**. The Platform role is required. -1. Click **Save changes**. +To assign or change a member's roles, see [Assigning and Modifying Roles](/chainlink-platform/assigning-and-modifying-roles). ## What's next? +- [Assigning and Modifying Roles](/chainlink-platform/assigning-and-modifying-roles) - Change the roles that organization members hold for each product. - [API Keys](/chainlink-platform/api-keys) - Create API keys with scoped permissions for each product. - [Inviting Team Members](/chainlink-platform/inviting-team-members) - Add members to your organization. - [Understanding Organizations](/chainlink-platform/understanding-organizations) - Learn how organizations work on the Chainlink Platform. diff --git a/src/content/chainlink-platform/understanding-organizations.mdx b/src/content/chainlink-platform/understanding-organizations.mdx index 2bb0859d0c6..8c99f1d958a 100644 --- a/src/content/chainlink-platform/understanding-organizations.mdx +++ b/src/content/chainlink-platform/understanding-organizations.mdx @@ -17,8 +17,7 @@ An organization serves as a container for: - **Multiple team members** with roles assigned per product - **Linked wallet addresses** from all team members -- **Deployed workflows** visible to all organization members -- **Shared monitoring** of workflow executions and activity +- **Product resources** such as CRE workflows, ACE policies, and CRE Connect channels, visible to members according to their roles - **API keys** for programmatic access to products Organizations enable teams to collaborate on workflows while maintaining individual control over their own wallet addresses and secrets. @@ -42,19 +41,21 @@ Members are users invited to join the organization. Each member: - Has a role for each product, such as CRE, ACE, or CRE Connect - Can link their own wallet addresses to the organization - Can deploy and manage their own workflows, depending on their roles -- Views all organization workflows in the shared dashboard +- Views product resources, such as CRE workflows, when their role for that product includes view access ### Shared visibility -All organization members can: +Organization resources are shared across the whole organization, but each member sees only what their roles permit: -1. **View linked wallet keys** - Use `cre account list-key` to see all addresses linked to the organization by any member -1. **Monitor all workflows** - Access app.chain.link/cre/workflows to view: - - All deployed workflows across the organization +1. **Linked wallet addresses** - Members whose role includes `platform:owner_address:read`, which every Platform role (Admin, User, Viewer) includes, can see all addresses linked to the organization by any member. The `cre account list-key` CLI command lists the same addresses. +1. **CRE workflows** - Members with any CRE role (Admin, Developer, Viewer) can view all CRE workflows in the organization at app.chain.link/cre/workflows, including: - Recent execution history - Workflow status (Active, Paused, Pending) - - Execution success/failure metrics + - Execution success and failure metrics - Activity graphs and trends +1. **Other products** - ACE, CRE Connect, Data Streams, and Agent Gateway resources follow the same model: a member with a role for the product can view its resources, and a member without a role for a product cannot access it. + +See [RBAC](/chainlink-platform/rbac) for the permissions each role includes. ## Organization roles diff --git a/src/content/cre/getting-started/part-1-project-setup-ts.mdx b/src/content/cre/getting-started/part-1-project-setup-ts.mdx index eb66dfa6b7e..21905cd5349 100644 --- a/src/content/cre/getting-started/part-1-project-setup-ts.mdx +++ b/src/content/cre/getting-started/part-1-project-setup-ts.mdx @@ -32,7 +32,8 @@ In this first part, you'll go from an empty directory to a fully initialized CRE Before you begin, ensure you have the following: - **CRE CLI**: See the [Installation Guide](/cre/getting-started/cli-installation/macos-linux) for details. -- **CRE account & authentication**: You must have a CRE account and be logged in with the CLI. See [Create your account](/chainlink-platform/creating-an-account) and [Log in with the CLI](/cre/guides/cli/cli-login) for instructions. +- **Create your Chainlink Platform account**: You must create a Chainlink Platform account. See [Create your account](/chainlink-platform/creating-an-account) for instructions. +- **Login with CLI**: Authenticate yourself with the CLI using `cre login`. See [Logging in with the CLI](/cre/guides/cli/cli-login) for instructions. - **Bun**: You must have Bun version 1.2.21 or higher installed. Check your version with . See [Install Bun](https://bun.com) for instructions. - **Funded Sepolia Account**: An account with Sepolia ETH to pay for transaction gas fees. Required for [Part 4: Writing Onchain](/cre/getting-started/part-4-writing-onchain), and for any deployment that uses `deployment-registry: "onchain:ethereum-mainnet"`. Not required to simulate workflows or deploy to the `private` registry. Go to faucets.chain.link to get some Sepolia ETH. diff --git a/src/content/cre/llms-full-go.txt b/src/content/cre/llms-full-go.txt index eed504f327d..b1ad71f282f 100644 --- a/src/content/cre/llms-full-go.txt +++ b/src/content/cre/llms-full-go.txt @@ -8807,13 +8807,23 @@ For CI/CD pipelines, automated scripts, or any environment where a browser is no ### Creating an API key -You must be the organization Owner, or have both a Chainlink Platform role (**Admin** or **User**) and the CRE **Admin** role, to create an API key with these permissions. See [RBAC](/chainlink-platform/rbac?parent=cre) for how roles work. +> **NOTE: To create an API key for CRE** +> +> - You must be the organization **Owner** +> +> **OR** +> +> - have both a Chainlink Platform role (**Admin** or **User**) and the CRE **Admin** role. +> +> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=cre#cre). To invite team members and assign roles, see [Invite members](/chainlink-platform/invite-members?parent=cre). -1. Sign in to the [Chainlink Platform](https://app.chain.link), click your account's icon in the top-right corner of the navbar and click **Org settings** to open its **Organization** page, then open the **API Keys** tab. +1. [Create an account](/chainlink-platform/creating-an-account?parent=cre) or sign in to [app.chain.link](https://app.chain.link). -2. Click **Create API Key** and enter a name for the key. +2. Click on your account's icon in the top-right corner of the navbar and go to **Org settings** to open the **Organization** page, then navigate to the **API Keys** tab. + +3. Click **Create API Key** and enter a name for the key. -3. In the **API Scope** section, expand the **CRE** accordion and grant the key the permissions that the CLI uses. +4. In the **API Scope** section, expand the **CRE** accordion and grant the key the permissions that the CLI uses. | Permission | Permission ID | | --------------------------------------- | ------------------------------------------ | @@ -8826,9 +8836,9 @@ You must be the organization Owner, or have both a Chainlink Platform role (**Ad | Link Workflow Owner Addresses | `platform:owner_address:linking:write/cre` | | Read Organization information | `platform:organization:read` | - See [API Keys](/chainlink-platform/api-keys?parent=cre) for the full list of permissions available for CRE. + See [API Keys](/chainlink-platform/api-keys?parent=cre#cre) for the full list of permissions available for CRE. -4. Click **Create API Key**, then copy the key and click **Done**. The API key is displayed only once. +5. Click **Create API Key**, then copy the key and click **Done**. The API key is displayed only once. > **CAUTION: Keep your API key secure** > diff --git a/src/content/cre/llms-full-ts.txt b/src/content/cre/llms-full-ts.txt index 0bda4ee16b1..d7ce3392a5b 100644 --- a/src/content/cre/llms-full-ts.txt +++ b/src/content/cre/llms-full-ts.txt @@ -8623,13 +8623,23 @@ For CI/CD pipelines, automated scripts, or any environment where a browser is no ### Creating an API key -You must be the organization Owner, or have both a Chainlink Platform role (**Admin** or **User**) and the CRE **Admin** role, to create an API key with these permissions. See [RBAC](/chainlink-platform/rbac?parent=cre) for how roles work. +> **NOTE: To create an API key for CRE** +> +> - You must be the organization **Owner** +> +> **OR** +> +> - have both a Chainlink Platform role (**Admin** or **User**) and the CRE **Admin** role. +> +> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=cre#cre). To invite team members and assign roles, see [Invite members](/chainlink-platform/invite-members?parent=cre). -1. Sign in to the [Chainlink Platform](https://app.chain.link), click your account's icon in the top-right corner of the navbar and click **Org settings** to open its **Organization** page, then open the **API Keys** tab. +1. [Create an account](/chainlink-platform/creating-an-account?parent=cre) or sign in to [app.chain.link](https://app.chain.link). -2. Click **Create API Key** and enter a name for the key. +2. Click on your account's icon in the top-right corner of the navbar and go to **Org settings** to open the **Organization** page, then navigate to the **API Keys** tab. + +3. Click **Create API Key** and enter a name for the key. -3. In the **API Scope** section, expand the **CRE** accordion and grant the key the permissions that the CLI uses. +4. In the **API Scope** section, expand the **CRE** accordion and grant the key the permissions that the CLI uses. | Permission | Permission ID | | --------------------------------------- | ------------------------------------------ | @@ -8642,9 +8652,9 @@ You must be the organization Owner, or have both a Chainlink Platform role (**Ad | Link Workflow Owner Addresses | `platform:owner_address:linking:write/cre` | | Read Organization information | `platform:organization:read` | - See [API Keys](/chainlink-platform/api-keys?parent=cre) for the full list of permissions available for CRE. + See [API Keys](/chainlink-platform/api-keys?parent=cre#cre) for the full list of permissions available for CRE. -4. Click **Create API Key**, then copy the key and click **Done**. The API key is displayed only once. +5. Click **Create API Key**, then copy the key and click **Done**. The API key is displayed only once. > **CAUTION: Keep your API key secure** > @@ -13985,7 +13995,8 @@ In this first part, you'll go from an empty directory to a fully initialized CRE Before you begin, ensure you have the following: - **CRE CLI**: See the [Installation Guide](/cre/getting-started/cli-installation/macos-linux) for details. -- **CRE account & authentication**: You must have a CRE account and be logged in with the CLI. See [Create your account](/chainlink-platform/creating-an-account) and [Log in with the CLI](/cre/guides/cli/cli-login) for instructions. +- **Create your Chainlink Platform account**: You must create a Chainlink Platform account. See [Create your account](/chainlink-platform/creating-an-account) for instructions. +- **Login with CLI**: Authenticate yourself with the CLI using `cre login`. See [Logging in with the CLI](/cre/guides/cli/cli-login) for instructions. - **Bun**: You must have [Bun](https://bun.com/docs) version 1.2.21 or higher installed. Check your version with bun --version. See [Install Bun](https://bun.com) for instructions. - **Funded Sepolia Account**: An account with Sepolia ETH to pay for transaction gas fees. Required for [Part 4: Writing Onchain](/cre/getting-started/part-4-writing-onchain), and for any deployment that uses `deployment-registry: "onchain:ethereum-mainnet"`. Not required to simulate workflows or deploy to the `private` registry. Go to [faucets.chain.link](https://faucets.chain.link) to get some Sepolia ETH. diff --git a/src/content/cre/reference/cli/authentication.mdx b/src/content/cre/reference/cli/authentication.mdx index 50d46511cf8..5320bfdec64 100644 --- a/src/content/cre/reference/cli/authentication.mdx +++ b/src/content/cre/reference/cli/authentication.mdx @@ -75,9 +75,19 @@ For CI/CD pipelines, automated scripts, or any environment where a browser is no ### Creating an API key -You must be the organization Owner, or have both a Chainlink Platform role (**Admin** or **User**) and the CRE **Admin** role, to create an API key with these permissions. See [RBAC](/chainlink-platform/rbac?parent=cre) for how roles work. + + +1. [Create an account](/chainlink-platform/creating-an-account?parent=cre) or sign in to app.chain.link. +1. Click on your account's icon in the top-right corner of the navbar and go to **Org settings** to open the **Organization** page, then navigate to the **API Keys** tab. 1. Click **Create API Key** and enter a name for the key. 1. In the **API Scope** section, expand the **CRE** accordion and grant the key the permissions that the CLI uses. @@ -92,7 +102,7 @@ You must be the organization Owner, or have both a Chainlink Platform role (**Ad | Link Workflow Owner Addresses | `platform:owner_address:linking:write/cre` | | Read Organization information | `platform:organization:read` | - See [API Keys](/chainlink-platform/api-keys?parent=cre) for the full list of permissions available for CRE. + See [API Keys](/chainlink-platform/api-keys?parent=cre#cre) for the full list of permissions available for CRE. 1. Click **Create API Key**, then copy the key and click **Done**. The API key is displayed only once. diff --git a/src/content/crec/getting-started/prerequisites.mdx b/src/content/crec/getting-started/prerequisites.mdx index 25fae7bcc6b..91c5d3c97dd 100644 --- a/src/content/crec/getting-started/prerequisites.mdx +++ b/src/content/crec/getting-started/prerequisites.mdx @@ -53,7 +53,7 @@ Once your account has been provisioned, create an API key. - Have **both** a Chainlink Platform role (**Admin** or **User**) and a CRE Connect role (**Admin** or **Operator**). -See [RBAC](/chainlink-platform/rbac?parent=crec) for how roles work. +For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=crec#cre-connect). To invite team members and assign roles, see [Invite members](/chainlink-platform/invite-members?parent=crec). @@ -66,11 +66,14 @@ See [RBAC](/chainlink-platform/rbac?parent=crec) for how roles work. | Read available blockchain networks | `crec:network:read` | | Read channels | `crec:channel:read` | | Create or update channels | `crec:channel:write` | + | Archive channels | `crec:channel:archive:write` | | Read watchers | `crec:watcher:read` | | Create or update watchers | `crec:watcher:write` | + | Archive watchers | `crec:watcher:archive:write` | | Read events, run history, and search events | `crec:event:read` | | Read wallets | `crec:wallet:read` | | Create or update wallets | `crec:wallet:write` | + | Archive wallets | `crec:wallet:archive:write` | | Read operations and search by initiator, signer, or canceller | `crec:operation:read` | | Create operations (draft or pre-signed) | `crec:operation:write` | | Sign (finalize) or cancel operations | `crec:operation:signature:write` | diff --git a/src/content/crec/llms-full.txt b/src/content/crec/llms-full.txt index 4883cd848db..8fc3a7ef416 100644 --- a/src/content/crec/llms-full.txt +++ b/src/content/crec/llms-full.txt @@ -450,7 +450,7 @@ Once your account has been provisioned, create an API key. > > - Have **both** a Chainlink Platform role (**Admin** or **User**) and a CRE Connect role (**Admin** or **Operator**). > -> See [RBAC](/chainlink-platform/rbac?parent=crec) for how roles work. +> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=crec#cre-connect). To invite team members and assign roles, see [Invite members](/chainlink-platform/invite-members?parent=crec). 1. Log in to the [Chainlink Platform](https://app.chain.link), click on "Org settings" in the top-right corner of the navbar to open your **Organization Settings** page, then open the **API Keys** tab. @@ -463,11 +463,14 @@ Once your account has been provisioned, create an API key. | Read available blockchain networks | `crec:network:read` | | Read channels | `crec:channel:read` | | Create or update channels | `crec:channel:write` | + | Archive channels | `crec:channel:archive:write` | | Read watchers | `crec:watcher:read` | | Create or update watchers | `crec:watcher:write` | + | Archive watchers | `crec:watcher:archive:write` | | Read events, run history, and search events | `crec:event:read` | | Read wallets | `crec:wallet:read` | | Create or update wallets | `crec:wallet:write` | + | Archive wallets | `crec:wallet:archive:write` | | Read operations and search by initiator, signer, or canceller | `crec:operation:read` | | Create operations (draft or pre-signed) | `crec:operation:write` | | Sign (finalize) or cancel operations | `crec:operation:signature:write` | From e382a888e7e0dd7e379fb5dbd7b112d08aeb7aae Mon Sep 17 00:00:00 2001 From: Robin Roy <66296664+robin-rrt@users.noreply.github.com> Date: Wed, 21 Oct 2026 21:57:47 +0530 Subject: [PATCH 11/15] add permission names --- .../ace/getting-started/account-setup.mdx | 39 ++- src/content/ace/llms-full.txt | 39 ++- src/content/chainlink-platform/api-keys.mdx | 216 ++++++++-------- .../assigning-and-modifying-roles.mdx | 4 +- src/content/chainlink-platform/rbac.mdx | 244 +++++++++--------- .../understanding-organizations.mdx | 2 +- src/content/cre/guides/cli/cli-login.mdx | 2 +- src/content/cre/llms-full-go.txt | 28 +- src/content/cre/llms-full-ts.txt | 28 +- .../cre/reference/cli/authentication.mdx | 31 +-- .../reference/graphql-api/authentication.mdx | 2 +- .../crec/getting-started/prerequisites.mdx | 43 ++- src/content/crec/llms-full.txt | 35 ++- 13 files changed, 339 insertions(+), 374 deletions(-) diff --git a/src/content/ace/getting-started/account-setup.mdx b/src/content/ace/getting-started/account-setup.mdx index 182d970c47b..1534a193645 100644 --- a/src/content/ace/getting-started/account-setup.mdx +++ b/src/content/ace/getting-started/account-setup.mdx @@ -54,11 +54,11 @@ Once your account has been provisioned for the ACE service, create an API key. @@ -66,25 +66,20 @@ For information about role-based access, see [RBAC](/chainlink-platform/rbac?par 1. Click **Create API Key** and enter a name for the key. 1. In the **API Scope** section, expand the **ACE** accordion and grant the key the permissions that this Getting Started guide uses. - | Permission | Permission ID | - | ------------------------------------------------------------------------- | ---------------------------------------- | - | Create wallets | `ace:core:wallet:write` | - | Read policy engines | `ace:policy_manager:policy_engine:read` | - | Create and update policy engines | `ace:policy_manager:policy_engine:write` | - | Read targets and their protections | `ace:policy_manager:target:read` | - | Create and update targets and their protections | `ace:policy_manager:target:write` | - | Read policies and data validator instances | `ace:policy_manager:policy:read` | - | Create and update policies and data validator instances | `ace:policy_manager:policy:write` | - | Read identity and credential registries and credential types | `ace:identity_manager:registry:read` | - | Create and update identity and credential registries and credential types | `ace:identity_manager:registry:write` | - | Read identities and credentials | `ace:identity_manager:identity:read` | - | Create and update identities and assign credentials | `ace:identity_manager:identity:write` | - | Read the reporting service's policy view | `ace:reporting:policy:read` | - | Read the reporting service's identity view | `ace:reporting:identity:read` | - | Read the reporting service's target view | `ace:reporting:target:read` | - | Read the reporting service's transaction view | `ace:reporting:transaction:read` | - | Read the reporting service's permit view | `ace:reporting:permit:read` | - | Read the reporting service's registry usage view | `ace:reporting:registry:read` | + | Permission | Setting | Permission IDs | + | ---------------------------- | ------- | --------------------------------------------------------------------------------- | + | Core wallet | All | `ace:core:wallet:read`, `ace:core:wallet:write` | + | Policy manager policy engine | All | `ace:policy_manager:policy_engine:read`, `ace:policy_manager:policy_engine:write` | + | Policy manager target | All | `ace:policy_manager:target:read`, `ace:policy_manager:target:write` | + | Policy manager policy | All | `ace:policy_manager:policy:read`, `ace:policy_manager:policy:write` | + | Identity manager registry | All | `ace:identity_manager:registry:read`, `ace:identity_manager:registry:write` | + | Identity manager identity | All | `ace:identity_manager:identity:read`, `ace:identity_manager:identity:write` | + | Reporting policy | Read | `ace:reporting:policy:read` | + | Reporting identity | Read | `ace:reporting:identity:read` | + | Reporting target | Read | `ace:reporting:target:read` | + | Reporting transaction | Read | `ace:reporting:transaction:read` | + | Reporting permit | Read | `ace:reporting:permit:read` | + | Reporting registry | Read | `ace:reporting:registry:read` | See [API Keys](/chainlink-platform/api-keys?parent=ace#ace) for the full list of permissions available for ACE. diff --git a/src/content/ace/llms-full.txt b/src/content/ace/llms-full.txt index f79e82488cf..6b03155f306 100644 --- a/src/content/ace/llms-full.txt +++ b/src/content/ace/llms-full.txt @@ -1808,11 +1808,11 @@ Once your account has been provisioned for the ACE service, create an API key. > > - You must be the organization **Owner** > -> **OR** +> **OR** > -> - have both a Chainlink Platform role (**Admin** or **User**) and an ACE role (**Admin** or **Operator**). +> - Have the ACE **Admin** or **Operator** role. > -> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=ace#ace). To invite team members and assign roles, see [Invite members](/chainlink-platform/invite-members?parent=ace). +> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=ace#ace). To invite team members and assign roles, see [Invite members](/chainlink-platform/inviting-team-members?parent=ace). 1. Log in to the [Chainlink Platform](https://app.chain.link), click on "Org settings" in the top-right corner of the navbar to open your **Organization Settings** page, then open the **API Keys** tab. @@ -1820,25 +1820,20 @@ Once your account has been provisioned for the ACE service, create an API key. 3. In the **API Scope** section, expand the **ACE** accordion and grant the key the permissions that this Getting Started guide uses. - | Permission | Permission ID | - | ------------------------------------------------------------------------- | ---------------------------------------- | - | Create wallets | `ace:core:wallet:write` | - | Read policy engines | `ace:policy_manager:policy_engine:read` | - | Create and update policy engines | `ace:policy_manager:policy_engine:write` | - | Read targets and their protections | `ace:policy_manager:target:read` | - | Create and update targets and their protections | `ace:policy_manager:target:write` | - | Read policies and data validator instances | `ace:policy_manager:policy:read` | - | Create and update policies and data validator instances | `ace:policy_manager:policy:write` | - | Read identity and credential registries and credential types | `ace:identity_manager:registry:read` | - | Create and update identity and credential registries and credential types | `ace:identity_manager:registry:write` | - | Read identities and credentials | `ace:identity_manager:identity:read` | - | Create and update identities and assign credentials | `ace:identity_manager:identity:write` | - | Read the reporting service's policy view | `ace:reporting:policy:read` | - | Read the reporting service's identity view | `ace:reporting:identity:read` | - | Read the reporting service's target view | `ace:reporting:target:read` | - | Read the reporting service's transaction view | `ace:reporting:transaction:read` | - | Read the reporting service's permit view | `ace:reporting:permit:read` | - | Read the reporting service's registry usage view | `ace:reporting:registry:read` | + | Permission | Setting | Permission IDs | + | ---------------------------- | ------- | --------------------------------------------------------------------------------- | + | Core wallet | All | `ace:core:wallet:read`, `ace:core:wallet:write` | + | Policy manager policy engine | All | `ace:policy_manager:policy_engine:read`, `ace:policy_manager:policy_engine:write` | + | Policy manager target | All | `ace:policy_manager:target:read`, `ace:policy_manager:target:write` | + | Policy manager policy | All | `ace:policy_manager:policy:read`, `ace:policy_manager:policy:write` | + | Identity manager registry | All | `ace:identity_manager:registry:read`, `ace:identity_manager:registry:write` | + | Identity manager identity | All | `ace:identity_manager:identity:read`, `ace:identity_manager:identity:write` | + | Reporting policy | Read | `ace:reporting:policy:read` | + | Reporting identity | Read | `ace:reporting:identity:read` | + | Reporting target | Read | `ace:reporting:target:read` | + | Reporting transaction | Read | `ace:reporting:transaction:read` | + | Reporting permit | Read | `ace:reporting:permit:read` | + | Reporting registry | Read | `ace:reporting:registry:read` | See [API Keys](/chainlink-platform/api-keys?parent=ace#ace) for the full list of permissions available for ACE. diff --git a/src/content/chainlink-platform/api-keys.mdx b/src/content/chainlink-platform/api-keys.mdx index 5ec0b3b51b1..d9fe601f41f 100644 --- a/src/content/chainlink-platform/api-keys.mdx +++ b/src/content/chainlink-platform/api-keys.mdx @@ -25,165 +25,163 @@ To create and manage API keys, you need a role that includes API key permissions ## Available permissions -The following tables list the permissions you can assign to an API key for each product. A check mark indicates that the permission is included in that product role. The Owner role includes every permission for every product. +The following tables list the permissions you can assign to an API key for each product. Each row matches a permission group in the **API Scope** section of the creation form: the **Setting** column is what to select for that group, and the **Permission IDs** column lists the permission IDs that the setting grants. A check mark indicates that the role includes the permissions the setting grants. The Owner role includes every permission for every product. ### Chainlink Platform -| Permission | Admin | User | Viewer | -| ------------------------------------------- | ----- | ---- | ------ | -| Read Organization information | ✓ | ✓ | ✓ | -| View Organization Addresses in Address Book | ✓ | ✓ | ✓ | +| Permission | Setting | Permission IDs | Admin | User | +| ------------- | ------- | ----------------------------- | ----- | ---- | +| Organization | Read | `platform:organization:read` | ✓ | ✓ | +| Owner address | Read | `platform:owner_address:read` | ✓ | ✓ | ### CRE -| Permission | Admin | Developer | Viewer | -| --------------------------------------- | ----- | --------- | ------ | -| View CRE workflows | ✓ | ✓ | ✓ | -| Download CRE workflow artifacts | ✓ | ✓ | ✓ | -| Deploy CRE workflow artifacts | ✓ | ✓ | | -| Manage CRE workflows (Private Registry) | ✓ | ✓ | | -| Link / unlink Workflow Owner Addresses | ✓ | | | +| Permission | Setting | Permission IDs | Admin | Developer | Viewer | +| --------------------- | ------- | ----------------------------------------------------------- | ----- | --------- | ------ | +| Workflow | Read | `cre:workflow:read` | ✓ | ✓ | ✓ | +| Workflow | All | `cre:workflow:read`, `cre:workflow:write/private_registry` | ✓ | ✓ | | +| Workflow artifact | Read | `cre:workflow:artifact:read` | ✓ | ✓ | ✓ | +| Workflow artifact | All | `cre:workflow:artifact:read`, `cre:workflow:artifact:write` | ✓ | ✓ | | +| Owner address linking | All | `platform:owner_address:linking:write/cre` | ✓ | | | ### ACE #### Administration -| Permission | Admin | Operator | Viewer | -| ---------------- | ----- | -------- | ------ | -| Full ACE access | ✓ | | | -| Manage ACE Roles | ✓ | | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| ----------- | ------- | -------------------------------- | ----- | -------- | ------ | +| Member role | All | `platform:member_role:write/ace` | ✓ | | | #### Policy Manager -| Permission | Admin | Operator | Viewer | -| -------------------------------------------------------------------------------------- | ----- | -------- | ------ | -| Read policy engines | ✓ | ✓ | ✓ | -| Create and update policy engine | ✓ | ✓ | | -| Archive policy engine (affects everything deployed under it) | ✓ | | | -| Read policies and data validator instances | ✓ | ✓ | ✓ | -| Create and update policy and data validator instances | ✓ | ✓ | | -| Archive policy and data validator instances | ✓ | ✓ | | -| Read targets and their protections | ✓ | ✓ | ✓ | -| Create and update target and its protections | ✓ | ✓ | | -| Archive target and its protections | ✓ | ✓ | | -| Read a target's cross-org evaluation access grants | ✓ | | | -| Grant and revoke cross-org evaluation access to a target | ✓ | | | -| Read extractors and policy types | ✓ | ✓ | ✓ | -| Create and update extractor or policy type (updates affect every instance built on it) | ✓ | ✓ | | -| Archive extractor or policy type (affects every instance built on it) | ✓ | | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| --------------------------------------------------------------------------- | ------- | ----------------------------------------------------------------------------------- | ----- | -------- | ------ | +| Policy manager policy engine | Read | `ace:policy_manager:policy_engine:read` | ✓ | ✓ | ✓ | +| Policy manager policy engine | All | `ace:policy_manager:policy_engine:read`, `ace:policy_manager:policy_engine:write` | ✓ | ✓ | | +| Policy manager policy engine archive (affects everything deployed under it) | All | `ace:policy_manager:policy_engine:archive:write` | ✓ | | | +| Policy manager policy | Read | `ace:policy_manager:policy:read` | ✓ | ✓ | ✓ | +| Policy manager policy | All | `ace:policy_manager:policy:read`, `ace:policy_manager:policy:write` | ✓ | ✓ | | +| Policy manager policy archive | All | `ace:policy_manager:policy:archive:write` | ✓ | ✓ | | +| Policy manager target | Read | `ace:policy_manager:target:read` | ✓ | ✓ | ✓ | +| Policy manager target | All | `ace:policy_manager:target:read`, `ace:policy_manager:target:write` | ✓ | ✓ | | +| Policy manager target archive | All | `ace:policy_manager:target:archive:write` | ✓ | ✓ | | +| Policy manager target access | Read | `ace:policy_manager:target_access:read` | ✓ | | | +| Policy manager target access | All | `ace:policy_manager:target_access:read`, `ace:policy_manager:target_access:write` | ✓ | | | +| Policy manager implementation | Read | `ace:policy_manager:implementation:read` | ✓ | ✓ | ✓ | +| Policy manager implementation | All | `ace:policy_manager:implementation:read`, `ace:policy_manager:implementation:write` | ✓ | ✓ | | +| Policy manager implementation archive (affects every instance built on it) | All | `ace:policy_manager:implementation:archive:write` | ✓ | | | #### Identity Manager -| Permission | Admin | Operator | Viewer | -| ------------------------------------------------------------------------------ | ----- | -------- | ------ | -| Read identity/credential registries and credential types | ✓ | ✓ | ✓ | -| Create and update identity or credential registry, and credential types | ✓ | ✓ | | -| Archive identity or credential registry (affects everything deployed under it) | ✓ | | | -| Read a registry's cross-org access grants | ✓ | | | -| Grant and revoke cross-org read access to a registry | ✓ | | | -| Read identities and credentials | ✓ | ✓ | ✓ | -| Create and update identity, and assign credentials | ✓ | ✓ | | -| Archive identity and credentials | ✓ | ✓ | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| ------------------------------------------------------------------------ | ------- | ----------------------------------------------------------------------------------------- | ----- | -------- | ------ | +| Identity manager registry | Read | `ace:identity_manager:registry:read` | ✓ | ✓ | ✓ | +| Identity manager registry | All | `ace:identity_manager:registry:read`, `ace:identity_manager:registry:write` | ✓ | ✓ | | +| Identity manager registry archive (affects everything deployed under it) | All | `ace:identity_manager:registry:archive:write` | ✓ | | | +| Identity manager registry access | Read | `ace:identity_manager:registry_access:read` | ✓ | | | +| Identity manager registry access | All | `ace:identity_manager:registry_access:read`, `ace:identity_manager:registry_access:write` | ✓ | | | +| Identity manager identity | Read | `ace:identity_manager:identity:read` | ✓ | ✓ | ✓ | +| Identity manager identity | All | `ace:identity_manager:identity:read`, `ace:identity_manager:identity:write` | ✓ | ✓ | | +| Identity manager identity archive | All | `ace:identity_manager:identity:archive:write` | ✓ | ✓ | | #### Reporting -| Permission | Admin | Operator | Viewer | -| ------------------------------------------------ | ----- | -------- | ------ | -| Read the reporting service's policy view | ✓ | ✓ | ✓ | -| Read the reporting service's identity view | ✓ | ✓ | ✓ | -| Read the reporting service's target view | ✓ | ✓ | ✓ | -| Read the reporting service's transaction view | ✓ | ✓ | ✓ | -| Read the reporting service's permit view | ✓ | ✓ | ✓ | -| Read the reporting service's registry usage view | ✓ | ✓ | ✓ | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| --------------------- | ------- | -------------------------------- | ----- | -------- | ------ | +| Reporting policy | Read | `ace:reporting:policy:read` | ✓ | ✓ | ✓ | +| Reporting identity | Read | `ace:reporting:identity:read` | ✓ | ✓ | ✓ | +| Reporting target | Read | `ace:reporting:target:read` | ✓ | ✓ | ✓ | +| Reporting transaction | Read | `ace:reporting:transaction:read` | ✓ | ✓ | ✓ | +| Reporting permit | Read | `ace:reporting:permit:read` | ✓ | ✓ | ✓ | +| Reporting registry | Read | `ace:reporting:registry:read` | ✓ | ✓ | ✓ | #### Evaluation -| Permission | Admin | Operator | Viewer | -| ------------------------ | ----- | -------- | ------ | -| Read evaluation permits | ✓ | ✓ | ✓ | -| Create evaluation permit | ✓ | ✓ | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| ----------------- | ------- | ----------------------------------------------------------- | ----- | -------- | ------ | +| Evaluation permit | Read | `ace:evaluation:permit:read` | ✓ | ✓ | ✓ | +| Evaluation permit | All | `ace:evaluation:permit:read`, `ace:evaluation:permit:write` | ✓ | ✓ | | #### Core -| Permission | Admin | Operator | Viewer | -| ------------------------- | ----- | -------- | ------ | -| Read organization details | ✓ | ✓ | ✓ | -| Read supported networks | ✓ | ✓ | ✓ | -| Read wallets | ✓ | ✓ | ✓ | -| Create wallet | ✓ | | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| --------------- | ------- | ----------------------------------------------- | ----- | -------- | ------ | +| Core org config | Read | `ace:core:org_config:read` | ✓ | ✓ | ✓ | +| Core network | Read | `ace:core:network:read` | ✓ | ✓ | ✓ | +| Core wallet | Read | `ace:core:wallet:read` | ✓ | ✓ | ✓ | +| Core wallet | All | `ace:core:wallet:read`, `ace:core:wallet:write` | ✓ | | | #### Active Monitoring -| Permission | Admin | Operator | Viewer | -| -------------------------------------------------- | ----- | -------- | ------ | -| Read action variables | ✓ | ✓ | ✓ | -| Read contract groups | ✓ | ✓ | ✓ | -| Create contract groups | ✓ | ✓ | | -| Read rule groups | ✓ | ✓ | ✓ | -| Create and update rule groups | ✓ | ✓ | | -| Read monitored addresses | ✓ | ✓ | ✓ | -| Add addresses to the screening watch list | ✓ | ✓ | | -| Read the screening interval | ✓ | ✓ | ✓ | -| Set, remove, start and stop the screening interval | ✓ | ✓ | | -| Read decision logs | ✓ | ✓ | ✓ | -| Dismiss and enforce decision logs | ✓ | ✓ | | -| Read screening-provider API key metadata | ✓ | ✓ | ✓ | -| Set and remove screening-provider API keys | ✓ | | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| ------------------------------------ | ------- | ------------------------------------------------------------------------------------------------- | ----- | -------- | ------ | +| Active monitoring action variable | Read | `ace:active_monitoring:action_variable:read` | ✓ | ✓ | ✓ | +| Active monitoring contract group | Read | `ace:active_monitoring:contract_group:read` | ✓ | ✓ | ✓ | +| Active monitoring contract group | All | `ace:active_monitoring:contract_group:read`, `ace:active_monitoring:contract_group:write` | ✓ | ✓ | | +| Active monitoring rule group | Read | `ace:active_monitoring:rule_group:read` | ✓ | ✓ | ✓ | +| Active monitoring rule group | All | `ace:active_monitoring:rule_group:read`, `ace:active_monitoring:rule_group:write` | ✓ | ✓ | | +| Active monitoring monitored address | Read | `ace:active_monitoring:monitored_address:read` | ✓ | ✓ | ✓ | +| Active monitoring monitored address | All | `ace:active_monitoring:monitored_address:read`, `ace:active_monitoring:monitored_address:write` | ✓ | ✓ | | +| Active monitoring screening interval | Read | `ace:active_monitoring:screening_interval:read` | ✓ | ✓ | ✓ | +| Active monitoring screening interval | All | `ace:active_monitoring:screening_interval:read`, `ace:active_monitoring:screening_interval:write` | ✓ | ✓ | | +| Active monitoring decision log | Read | `ace:active_monitoring:decision_log:read` | ✓ | ✓ | ✓ | +| Active monitoring decision log | All | `ace:active_monitoring:decision_log:read`, `ace:active_monitoring:decision_log:write` | ✓ | ✓ | | +| Active monitoring provider api key | Read | `ace:active_monitoring:provider_api_key:read` | ✓ | ✓ | ✓ | +| Active monitoring provider api key | All | `ace:active_monitoring:provider_api_key:read`, `ace:active_monitoring:provider_api_key:write` | ✓ | | | ### CRE Connect #### Core -| Permission | Admin | Operator | Viewer | -| ---------------------------------- | ----- | -------- | ------ | -| Read available blockchain networks | ✓ | ✓ | ✓ | -| Read wallets | ✓ | ✓ | ✓ | -| Create or update wallet | ✓ | ✓ | | -| Archive wallet | ✓ | | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| -------------- | ------- | --------------------------------------- | ----- | -------- | ------ | +| Network | Read | `crec:network:read` | ✓ | ✓ | ✓ | +| Wallet | Read | `crec:wallet:read` | ✓ | ✓ | ✓ | +| Wallet | All | `crec:wallet:read`, `crec:wallet:write` | ✓ | ✓ | | +| Wallet archive | All | `crec:wallet:archive:write` | ✓ | | | #### Operations -| Permission | Admin | Operator | Viewer | -| -------------------------------------------------------- | ----- | -------- | ------ | -| Read operations and search by initiator/signer/canceller | ✓ | ✓ | ✓ | -| Create operation (draft or pre-signed) | ✓ | ✓ | | -| Sign (finalize) or cancel operation | ✓ | ✓ | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| ------------------- | ------- | --------------------------------------------- | ----- | -------- | ------ | +| Operation | Read | `crec:operation:read` | ✓ | ✓ | ✓ | +| Operation | All | `crec:operation:read`, `crec:operation:write` | ✓ | ✓ | | +| Operation signature | All | `crec:operation:signature:write` | ✓ | ✓ | | #### Channels -| Permission | Admin | Operator | Viewer | -| ------------------------ | ----- | -------- | ------ | -| Read channels | ✓ | ✓ | ✓ | -| Create or update channel | ✓ | ✓ | | -| Archive channel | ✓ | | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| --------------- | ------- | ----------------------------------------- | ----- | -------- | ------ | +| Channel | Read | `crec:channel:read` | ✓ | ✓ | ✓ | +| Channel | All | `crec:channel:read`, `crec:channel:write` | ✓ | ✓ | | +| Channel archive | All | `crec:channel:archive:write` | ✓ | | | #### Watchers -| Permission | Admin | Operator | Viewer | -| ------------------------ | ----- | -------- | ------ | -| Read watchers | ✓ | ✓ | ✓ | -| Create or update watcher | ✓ | ✓ | | -| Archive watcher | ✓ | | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| --------------- | ------- | ----------------------------------------- | ----- | -------- | ------ | +| Watcher | Read | `crec:watcher:read` | ✓ | ✓ | ✓ | +| Watcher | All | `crec:watcher:read`, `crec:watcher:write` | ✓ | ✓ | | +| Watcher archive | All | `crec:watcher:archive:write` | ✓ | | | #### Queries -| Permission | Admin | Operator | Viewer | -| ------------ | ----- | -------- | ------ | -| Read queries | ✓ | ✓ | ✓ | -| Create query | ✓ | ✓ | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| ---------- | ------- | ------------------------------------- | ----- | -------- | ------ | +| Query | Read | `crec:query:read` | ✓ | ✓ | ✓ | +| Query | All | `crec:query:read`, `crec:query:write` | ✓ | ✓ | | #### Events -| Permission | Admin | Operator | Viewer | -| ------------------------------------------- | ----- | -------- | ------ | -| Read events, run history, and search events | ✓ | ✓ | ✓ | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| ---------- | ------- | ----------------- | ----- | -------- | ------ | +| Event | Read | `crec:event:read` | ✓ | ✓ | ✓ | #### Administration -| Permission | Admin | Operator | Viewer | -| ------------------------ | ----- | -------- | ------ | -| Manage CRE Connect Roles | ✓ | | | -| Full CRE Connect access | ✓ | | | +| Permission | Setting | Permission IDs | Admin | Operator | Viewer | +| ----------- | ------- | --------------------------------- | ----- | -------- | ------ | +| Member role | All | `platform:member_role:write/crec` | ✓ | | | ### Data Streams and Agent Gateway @@ -191,7 +189,7 @@ API keys cannot be scoped to Data Streams or Agent Gateway. Data Streams uses it {/* prettier-ignore */} ## Creating an API key @@ -204,7 +202,7 @@ To create an API key: 1. Enter a name for the key. 1. In the **API Scope** section, select the permissions for the key: - Each product (Platform, ACE, CRE, and CRE Connect) has its own accordion. Expand the products the key needs access to. - - Each product has a preset: **None**, **Read**, **All**, or **Custom**. **Read** grants the product's read permissions, **All** grants every permission available for that product, and **Custom** is applied automatically when you change any individual permission. + - Each product has a preset: **None**, **Read**, **All**, or **Custom**. **Read** grants the product's read permissions, **All** grants every permission available for that product, and **Custom** is applied automatically when you change any individual permission. The Chainlink Platform accordion offers only **None**, **Read**, and **Custom**. - To grant individual permissions instead of a preset, set each permission group to **None**, **Read**, or **All**. Some groups offer only a subset of these options. 1. Click **Create API Key**, then copy the key and click **Done**. diff --git a/src/content/chainlink-platform/assigning-and-modifying-roles.mdx b/src/content/chainlink-platform/assigning-and-modifying-roles.mdx index db77072ba27..a740285f811 100644 --- a/src/content/chainlink-platform/assigning-and-modifying-roles.mdx +++ b/src/content/chainlink-platform/assigning-and-modifying-roles.mdx @@ -55,7 +55,7 @@ You can only set roles for products that you have access to. | Product | Available roles | | ------------- | ----------------------------------- | - | Platform | Admin, User, Viewer | + | Platform | Admin, User | | ACE | Admin, Operator, Viewer, No Access | | CRE | Admin, Developer, Viewer, No Access | | CRE Connect | Admin, Operator, Viewer, No Access | @@ -71,7 +71,7 @@ You can only set roles for products that you have access to. alt="Expanded role permissions accordion showing the role description and permissions grouped by service" /> -1. Click **Save changes**. Click **Cancel** to discard your changes. +1. Click **Save changes** to save your changes. ## Related diff --git a/src/content/chainlink-platform/rbac.mdx b/src/content/chainlink-platform/rbac.mdx index c2999a450b6..8829d9275fe 100644 --- a/src/content/chainlink-platform/rbac.mdx +++ b/src/content/chainlink-platform/rbac.mdx @@ -39,27 +39,27 @@ Each product defines its own set of roles. The following tables list every permi Chainlink Platform roles control access to organization-level features such as members, API keys, addresses, billing, and limits. -| Permission | Permission ID | Admin | User | Viewer | -| ---------------------------------------------------- | ---------------------------------------- | ----- | ---- | ------ | -| Read Organization information | `platform:organization:read` | ✓ | ✓ | ✓ | -| Write Organization information | `platform:organization:write` | ✓ | | | -| View all Billing data | `platform:billing:read/*` | ✓ | ✓ | ✓ | -| Adjust all Billing plans | `platform:billing:write/*` | ✓ | | | -| View Payments activity | `platform:payments:read` | ✓ | ✓ | | -| Initiate payments | `platform:payments:write` | ✓ | | | -| View Organization Members | `platform:member:read` | ✓ | ✓ | ✓ | -| Invite Organization Members | `platform:member_invite:write` | ✓ | | | -| Remove Organization Members | `platform:member:write` | ✓ | | | -| Manage Member Roles for all Products | `platform:member_role:write/*` | ✓ | | | -| View Organization Addresses in Address Book | `platform:owner_address:read` | ✓ | ✓ | ✓ | -| Write Organization Addresses to Address Book | `platform:owner_address:write` | ✓ | | | -| View all API Keys | `platform:api_key:read` | ✓ | ✓ | | -| Create & Edit API Keys | `platform:api_key:write` | ✓ | ✓ | | -| Read Platform limits | `platform:limits:read/platform` | ✓ | ✓ | ✓ | -| Manage Platform limits | `platform:limits:write/platform` | ✓ | | | -| Link / Unlink Organization Addresses to all products | `platform:owner_address:linking:write/*` | | | | -| Read all limits | `platform:limits:read/*` | | | | -| Manage all limits | `platform:limits:write/*` | | | | +| Permission | Permission ID | Admin | User | +| ---------------------------------------------------- | ---------------------------------------- | ----- | ---- | +| Organization (Read) | `platform:organization:read` | ✓ | ✓ | +| Organization (Write) | `platform:organization:write` | ✓ | | +| View all Billing data | `platform:billing:read/*` | ✓ | ✓ | +| Adjust all Billing plans | `platform:billing:write/*` | ✓ | | +| View Payments activity | `platform:payments:read` | ✓ | ✓ | +| Initiate payments | `platform:payments:write` | ✓ | | +| View Organization Members | `platform:member:read` | ✓ | ✓ | +| Invite Organization Members | `platform:member_invite:write` | ✓ | | +| Remove Organization Members | `platform:member:write` | ✓ | | +| Manage Member Roles for all Products | `platform:member_role:write/*` | ✓ | | +| Owner address (Read) | `platform:owner_address:read` | ✓ | ✓ | +| Owner address (Write) | `platform:owner_address:write` | ✓ | | +| View all API Keys | `platform:api_key:read` | ✓ | ✓ | +| Create & Edit API Keys | `platform:api_key:write` | ✓ | ✓ | +| Read Platform limits | `platform:limits:read/platform` | ✓ | ✓ | +| Manage Platform limits | `platform:limits:write/platform` | ✓ | | +| Link / Unlink Organization Addresses to all products | `platform:owner_address:linking:write/*` | | | +| Read all limits | `platform:limits:read/*` | | | +| Manage all limits | `platform:limits:write/*` | | | The last three permissions in the table are cross-product permissions that no Platform role includes. Product roles grant their product-scoped versions instead: for example, the CRE Admin role includes `platform:owner_address:linking:write/cre` and `platform:limits:write/cre`. @@ -67,19 +67,19 @@ The last three permissions in the table are cross-product permissions that no Pl CRE roles control access to workflows, secrets, limits, and workflow owner addresses. CRE roles can only be assigned to organizations with full access status. -| Permission | Permission ID | Admin | Developer | Viewer | -| --------------------------------------- | ------------------------------------------ | ----- | --------- | ------ | -| Full CRE access | `cre:*` | ✓ | | | -| View CRE Workflows | `cre:workflow:read` | ✓ | ✓ | ✓ | -| Download CRE Workflow Artifacts | `cre:workflow:artifact:read` | ✓ | ✓ | ✓ | -| Deploy CRE Workflow Artifacts | `cre:workflow:artifact:write` | ✓ | ✓ | | -| Manage CRE Workflows (Private Registry) | `cre:workflow:write/private_registry` | ✓ | ✓ | | -| List CRE Secrets | `cre:secret:read` | ✓ | ✓ | ✓ | -| Manage CRE Secrets | `cre:secret:write` | ✓ | ✓ | | -| Manage CRE Roles | `platform:member_role:write/cre` | ✓ | | | -| Link / unlink Workflow Owner Addresses | `platform:owner_address:linking:write/cre` | ✓ | | | -| Read CRE limits | `platform:limits:read/cre` | ✓ | ✓ | ✓ | -| Manage CRE limits | `platform:limits:write/cre` | ✓ | | | +| Permission | Permission ID | Admin | Developer | Viewer | +| ---------------------------------- | ------------------------------------------ | ----- | --------- | ------ | +| Full CRE access | `cre:*` | ✓ | | | +| Workflow (Read) | `cre:workflow:read` | ✓ | ✓ | ✓ | +| Workflow artifact (Read) | `cre:workflow:artifact:read` | ✓ | ✓ | ✓ | +| Workflow artifact (Write) | `cre:workflow:artifact:write` | ✓ | ✓ | | +| Workflow (Write, Private Registry) | `cre:workflow:write/private_registry` | ✓ | ✓ | | +| List CRE Secrets | `cre:secret:read` | ✓ | ✓ | ✓ | +| Manage CRE Secrets | `cre:secret:write` | ✓ | ✓ | | +| Member role (Write) | `platform:member_role:write/cre` | ✓ | | | +| Owner address linking (Write) | `platform:owner_address:linking:write/cre` | ✓ | | | +| Read CRE limits | `platform:limits:read/cre` | ✓ | ✓ | ✓ | +| Manage CRE limits | `platform:limits:write/cre` | ✓ | | | ### ACE @@ -87,107 +87,107 @@ ACE roles control access to policy engines, policies, targets, identities, evalu **Policy manager** -| Permission | Permission ID | Admin | Operator | Viewer | -| -------------------------------------------------------- | ------------------------------------------------- | ----- | -------- | ------ | -| Read policy engines | `ace:policy_manager:policy_engine:read` | ✓ | ✓ | ✓ | -| Create and update policy engines | `ace:policy_manager:policy_engine:write` | ✓ | ✓ | | -| Archive policy engines | `ace:policy_manager:policy_engine:archive:write` | ✓ | | | -| Read policies and data validator instances | `ace:policy_manager:policy:read` | ✓ | ✓ | ✓ | -| Create and update policies and data validator instances | `ace:policy_manager:policy:write` | ✓ | ✓ | | -| Archive policies and data validator instances | `ace:policy_manager:policy:archive:write` | ✓ | | | -| Read targets and their protections | `ace:policy_manager:target:read` | ✓ | ✓ | ✓ | -| Create and update targets and their protections | `ace:policy_manager:target:write` | ✓ | ✓ | | -| Archive targets and their protections | `ace:policy_manager:target:archive:write` | ✓ | | | -| Read a target's cross-org evaluation access grants | `ace:policy_manager:target_access:read` | ✓ | | | -| Grant and revoke cross-org evaluation access to a target | `ace:policy_manager:target_access:write` | ✓ | | | -| Read extractors and policy types | `ace:policy_manager:implementation:read` | ✓ | ✓ | ✓ | -| Create and update extractors and policy types | `ace:policy_manager:implementation:write` | ✓ | ✓ | | -| Archive extractors and policy types | `ace:policy_manager:implementation:archive:write` | ✓ | | | +| Permission | Permission ID | Admin | Operator | Viewer | +| --------------------------------------------- | ------------------------------------------------- | ----- | -------- | ------ | +| Policy manager policy engine (Read) | `ace:policy_manager:policy_engine:read` | ✓ | ✓ | ✓ | +| Policy manager policy engine (Write) | `ace:policy_manager:policy_engine:write` | ✓ | ✓ | | +| Policy manager policy engine archive (Write) | `ace:policy_manager:policy_engine:archive:write` | ✓ | | | +| Policy manager policy (Read) | `ace:policy_manager:policy:read` | ✓ | ✓ | ✓ | +| Policy manager policy (Write) | `ace:policy_manager:policy:write` | ✓ | ✓ | | +| Policy manager policy archive (Write) | `ace:policy_manager:policy:archive:write` | ✓ | ✓ | | +| Policy manager target (Read) | `ace:policy_manager:target:read` | ✓ | ✓ | ✓ | +| Policy manager target (Write) | `ace:policy_manager:target:write` | ✓ | ✓ | | +| Policy manager target archive (Write) | `ace:policy_manager:target:archive:write` | ✓ | ✓ | | +| Policy manager target access (Read) | `ace:policy_manager:target_access:read` | ✓ | | | +| Policy manager target access (Write) | `ace:policy_manager:target_access:write` | ✓ | | | +| Policy manager implementation (Read) | `ace:policy_manager:implementation:read` | ✓ | ✓ | ✓ | +| Policy manager implementation (Write) | `ace:policy_manager:implementation:write` | ✓ | ✓ | | +| Policy manager implementation archive (Write) | `ace:policy_manager:implementation:archive:write` | ✓ | | | **Identity manager** -| Permission | Permission ID | Admin | Operator | Viewer | -| ------------------------------------------------------------------------- | --------------------------------------------- | ----- | -------- | ------ | -| Read identity and credential registries and credential types | `ace:identity_manager:registry:read` | ✓ | ✓ | ✓ | -| Create and update identity and credential registries and credential types | `ace:identity_manager:registry:write` | ✓ | ✓ | | -| Archive identity and credential registries | `ace:identity_manager:registry:archive:write` | ✓ | | | -| Read a registry's cross-org access grants | `ace:identity_manager:registry_access:read` | ✓ | | | -| Grant and revoke cross-org read access to a registry | `ace:identity_manager:registry_access:write` | ✓ | | | -| Read identities and credentials | `ace:identity_manager:identity:read` | ✓ | ✓ | ✓ | -| Create and update identities and assign credentials | `ace:identity_manager:identity:write` | ✓ | ✓ | | -| Archive identities and credentials | `ace:identity_manager:identity:archive:write` | ✓ | | | +| Permission | Permission ID | Admin | Operator | Viewer | +| ----------------------------------------- | --------------------------------------------- | ----- | -------- | ------ | +| Identity manager registry (Read) | `ace:identity_manager:registry:read` | ✓ | ✓ | ✓ | +| Identity manager registry (Write) | `ace:identity_manager:registry:write` | ✓ | ✓ | | +| Identity manager registry archive (Write) | `ace:identity_manager:registry:archive:write` | ✓ | | | +| Identity manager registry access (Read) | `ace:identity_manager:registry_access:read` | ✓ | | | +| Identity manager registry access (Write) | `ace:identity_manager:registry_access:write` | ✓ | | | +| Identity manager identity (Read) | `ace:identity_manager:identity:read` | ✓ | ✓ | ✓ | +| Identity manager identity (Write) | `ace:identity_manager:identity:write` | ✓ | ✓ | | +| Identity manager identity archive (Write) | `ace:identity_manager:identity:archive:write` | ✓ | ✓ | | **Reporting and evaluation** -| Permission | Permission ID | Admin | Operator | Viewer | -| ------------------------------------------------ | -------------------------------- | ----- | -------- | ------ | -| Read the reporting service's policy view | `ace:reporting:policy:read` | ✓ | ✓ | ✓ | -| Read the reporting service's identity view | `ace:reporting:identity:read` | ✓ | ✓ | ✓ | -| Read the reporting service's target view | `ace:reporting:target:read` | ✓ | ✓ | ✓ | -| Read the reporting service's transaction view | `ace:reporting:transaction:read` | ✓ | ✓ | ✓ | -| Read the reporting service's permit view | `ace:reporting:permit:read` | ✓ | ✓ | ✓ | -| Read the reporting service's registry usage view | `ace:reporting:registry:read` | ✓ | ✓ | ✓ | -| Read evaluation permits | `ace:evaluation:permit:read` | ✓ | ✓ | ✓ | -| Create evaluation permits | `ace:evaluation:permit:write` | ✓ | ✓ | | +| Permission | Permission ID | Admin | Operator | Viewer | +| ---------------------------- | -------------------------------- | ----- | -------- | ------ | +| Reporting policy (Read) | `ace:reporting:policy:read` | ✓ | ✓ | ✓ | +| Reporting identity (Read) | `ace:reporting:identity:read` | ✓ | ✓ | ✓ | +| Reporting target (Read) | `ace:reporting:target:read` | ✓ | ✓ | ✓ | +| Reporting transaction (Read) | `ace:reporting:transaction:read` | ✓ | ✓ | ✓ | +| Reporting permit (Read) | `ace:reporting:permit:read` | ✓ | ✓ | ✓ | +| Reporting registry (Read) | `ace:reporting:registry:read` | ✓ | ✓ | ✓ | +| Evaluation permit (Read) | `ace:evaluation:permit:read` | ✓ | ✓ | ✓ | +| Evaluation permit (Write) | `ace:evaluation:permit:write` | ✓ | ✓ | | **Core** -| Permission | Permission ID | Admin | Operator | Viewer | -| ------------------------- | -------------------------- | ----- | -------- | ------ | -| Read organization details | `ace:core:org_config:read` | ✓ | ✓ | ✓ | -| Read supported networks | `ace:core:network:read` | ✓ | ✓ | ✓ | -| Read wallets | `ace:core:wallet:read` | ✓ | ✓ | ✓ | -| Create wallets | `ace:core:wallet:write` | ✓ | | | +| Permission | Permission ID | Admin | Operator | Viewer | +| ---------------------- | -------------------------- | ----- | -------- | ------ | +| Core org config (Read) | `ace:core:org_config:read` | ✓ | ✓ | ✓ | +| Core network (Read) | `ace:core:network:read` | ✓ | ✓ | ✓ | +| Core wallet (Read) | `ace:core:wallet:read` | ✓ | ✓ | ✓ | +| Core wallet (Write) | `ace:core:wallet:write` | ✓ | | | **Active monitoring** -| Permission | Permission ID | Admin | Operator | Viewer | -| --------------------------------------------------- | ------------------------------------------------ | ----- | -------- | ------ | -| Read action variables | `ace:active_monitoring:action_variable:read` | ✓ | ✓ | ✓ | -| Read contract groups | `ace:active_monitoring:contract_group:read` | ✓ | ✓ | ✓ | -| Create contract groups | `ace:active_monitoring:contract_group:write` | ✓ | ✓ | | -| Read rule groups | `ace:active_monitoring:rule_group:read` | ✓ | ✓ | ✓ | -| Create and update rule groups | `ace:active_monitoring:rule_group:write` | ✓ | ✓ | | -| Read monitored addresses | `ace:active_monitoring:monitored_address:read` | ✓ | ✓ | ✓ | -| Add addresses to the screening watch list | `ace:active_monitoring:monitored_address:write` | ✓ | ✓ | | -| Read the screening interval | `ace:active_monitoring:screening_interval:read` | ✓ | ✓ | ✓ | -| Set, remove, start, and stop the screening interval | `ace:active_monitoring:screening_interval:write` | ✓ | ✓ | | -| Read decision logs | `ace:active_monitoring:decision_log:read` | ✓ | ✓ | ✓ | -| Dismiss and enforce decision logs | `ace:active_monitoring:decision_log:write` | ✓ | ✓ | | -| Read screening-provider API key metadata | `ace:active_monitoring:provider_api_key:read` | ✓ | ✓ | ✓ | -| Set and remove screening-provider API keys | `ace:active_monitoring:provider_api_key:write` | ✓ | | | +| Permission | Permission ID | Admin | Operator | Viewer | +| -------------------------------------------- | ------------------------------------------------ | ----- | -------- | ------ | +| Active monitoring action variable (Read) | `ace:active_monitoring:action_variable:read` | ✓ | ✓ | ✓ | +| Active monitoring contract group (Read) | `ace:active_monitoring:contract_group:read` | ✓ | ✓ | ✓ | +| Active monitoring contract group (Write) | `ace:active_monitoring:contract_group:write` | ✓ | ✓ | | +| Active monitoring rule group (Read) | `ace:active_monitoring:rule_group:read` | ✓ | ✓ | ✓ | +| Active monitoring rule group (Write) | `ace:active_monitoring:rule_group:write` | ✓ | ✓ | | +| Active monitoring monitored address (Read) | `ace:active_monitoring:monitored_address:read` | ✓ | ✓ | ✓ | +| Active monitoring monitored address (Write) | `ace:active_monitoring:monitored_address:write` | ✓ | ✓ | | +| Active monitoring screening interval (Read) | `ace:active_monitoring:screening_interval:read` | ✓ | ✓ | ✓ | +| Active monitoring screening interval (Write) | `ace:active_monitoring:screening_interval:write` | ✓ | ✓ | | +| Active monitoring decision log (Read) | `ace:active_monitoring:decision_log:read` | ✓ | ✓ | ✓ | +| Active monitoring decision log (Write) | `ace:active_monitoring:decision_log:write` | ✓ | ✓ | | +| Active monitoring provider api key (Read) | `ace:active_monitoring:provider_api_key:read` | ✓ | ✓ | ✓ | +| Active monitoring provider api key (Write) | `ace:active_monitoring:provider_api_key:write` | ✓ | | | **Administration** -| Permission | Permission ID | Admin | Operator | Viewer | -| ---------------- | -------------------------------- | ----- | -------- | ------ | -| Full ACE access | `ace:*` | ✓ | | | -| Manage ACE Roles | `platform:member_role:write/ace` | ✓ | | | +| Permission | Permission ID | Admin | Operator | Viewer | +| ------------------- | -------------------------------- | ----- | -------- | ------ | +| Full ACE access | `ace:*` | ✓ | | | +| Member role (Write) | `platform:member_role:write/ace` | ✓ | | | ### CRE Connect CRE Connect roles control access to operations, wallets, channels, watchers, queries, and events. -| Permission | Permission ID | Admin | Operator | Viewer | -| ------------------------------------------------------------- | --------------------------------- | ----- | -------- | ------ | -| Read available blockchain networks | `crec:network:read` | ✓ | ✓ | ✓ | -| Read operations and search by initiator, signer, or canceller | `crec:operation:read` | ✓ | ✓ | ✓ | -| Create operations (draft or pre-signed) | `crec:operation:write` | ✓ | ✓ | | -| Sign (finalize) or cancel operations | `crec:operation:signature:write` | ✓ | ✓ | | -| Read wallets | `crec:wallet:read` | ✓ | ✓ | ✓ | -| Create or update wallets | `crec:wallet:write` | ✓ | ✓ | | -| Archive wallets | `crec:wallet:archive:write` | ✓ | | | -| Read channels | `crec:channel:read` | ✓ | ✓ | ✓ | -| Create or update channels | `crec:channel:write` | ✓ | ✓ | | -| Archive channels | `crec:channel:archive:write` | ✓ | | | -| Read watchers | `crec:watcher:read` | ✓ | ✓ | ✓ | -| Create or update watchers | `crec:watcher:write` | ✓ | ✓ | | -| Archive watchers | `crec:watcher:archive:write` | ✓ | | | -| Read queries | `crec:query:read` | ✓ | ✓ | ✓ | -| Create queries | `crec:query:write` | ✓ | ✓ | | -| Read events, run history, and search events | `crec:event:read` | ✓ | ✓ | ✓ | -| Full CRE Connect access | `crec:*` | ✓ | | | -| Manage CRE Connect Roles | `platform:member_role:write/crec` | ✓ | | | +| Permission | Permission ID | Admin | Operator | Viewer | +| --------------------------- | --------------------------------- | ----- | -------- | ------ | +| Network (Read) | `crec:network:read` | ✓ | ✓ | ✓ | +| Operation (Read) | `crec:operation:read` | ✓ | ✓ | ✓ | +| Operation (Write) | `crec:operation:write` | ✓ | ✓ | | +| Operation signature (Write) | `crec:operation:signature:write` | ✓ | ✓ | | +| Wallet (Read) | `crec:wallet:read` | ✓ | ✓ | ✓ | +| Wallet (Write) | `crec:wallet:write` | ✓ | ✓ | | +| Wallet archive (Write) | `crec:wallet:archive:write` | ✓ | | | +| Channel (Read) | `crec:channel:read` | ✓ | ✓ | ✓ | +| Channel (Write) | `crec:channel:write` | ✓ | ✓ | | +| Channel archive (Write) | `crec:channel:archive:write` | ✓ | | | +| Watcher (Read) | `crec:watcher:read` | ✓ | ✓ | ✓ | +| Watcher (Write) | `crec:watcher:write` | ✓ | ✓ | | +| Watcher archive (Write) | `crec:watcher:archive:write` | ✓ | | | +| Query (Read) | `crec:query:read` | ✓ | ✓ | ✓ | +| Query (Write) | `crec:query:write` | ✓ | ✓ | | +| Event (Read) | `crec:event:read` | ✓ | ✓ | ✓ | +| Full CRE Connect access | `crec:*` | ✓ | | | +| Member role (Write) | `platform:member_role:write/crec` | ✓ | | | ### Data Streams @@ -196,18 +196,18 @@ Data Streams has a single role. | Permission | Permission ID | Admin | | ----------------------------------- | ---------------------------------------- | ----- | | Full Data Streams self-serve access | `datastreams:*` | ✓ | -| Manage Data Streams Roles | `platform:member_role:write/datastreams` | ✓ | +| Member role (Write) | `platform:member_role:write/datastreams` | ✓ | ### Agent Gateway Agent Gateway has a single role. -| Permission | Permission ID | Admin | -| --------------------------- | ----------------------------------------- | ----- | -| Full Agent Gateway access | `agentgateway:*` | ✓ | -| Read Agent Gateway limits | `platform:limits:read/agentgateway` | ✓ | -| Manage Agent Gateway limits | `platform:limits:write/agentgateway` | ✓ | -| Manage Agent Gateway Roles | `platform:member_role:write/agentgateway` | ✓ | +| Permission | Permission ID | Admin | +| ---------------------------- | ----------------------------------------- | ----- | +| Full Agent Gateway access | `agentgateway:*` | ✓ | +| Agent Gateway limits (Read) | `platform:limits:read/agentgateway` | ✓ | +| Agent Gateway limits (Write) | `platform:limits:write/agentgateway` | ✓ | +| Member role (Write) | `platform:member_role:write/agentgateway` | ✓ | {/* prettier-ignore */}