Skip to main content
The resource permission catalog lists every canonical resource path and its supported actions. GitHub apps are workspace-scoped. Every other catalog resource is project-scoped. Portals remain outside the canonical catalog. Read Unkey Resource Names for URN format and pattern rules. Read Resource permissions for permission matching and action rules.

Canonical catalog

Each resource shows its actions in brackets. The next line shows its canonical resource path. Add unkey:v1:{workspace_id}: before the path and #{action} after it to form a permission.
gateway and rbac are path containers. They organize child paths. They are not concrete resources and cannot be permission targets.

Examples

These examples show how concrete IDs and wildcards use the same catalog.

Create a key

Use write with a wildcard key ID because the key does not exist yet.

Promote or roll back a deployment

Promoting or rolling back a deployment changes which deployment serves the environment. Both actions require write on the environment. A deployment permission does not grant either action.

Start or stop a deployment

Deployment write covers creation, updates, starts, and stops.

Read deployment logs

Logs are first-class resources. Deployment read does not grant access to deployment logs. Grant read on the log path.

Read gateway logs

Gateway logs belong to an environment’s gateway.

Verify a key

Key verification uses verify, not read.
Use these pages for URN rules, permission rules, and WorkOS role expansion.