Understanding permissions

How permissions work in Snyk API and Web

Learn what actions each permission grants to better configure your custom roles.

This article provides a detailed breakdown of the high-level permissions in Snyk API & Web, explaining what actions each permission grants. Snyk groups permissions into roles, either built-in or custom. The role, along with a scope, dictates the actions a user can perform.

Role and scope structure

Roles can be applied at three levels, dictating the scope of the actions a user can perform:

• Account: actions apply across the entire account.

• Team: actions apply only to the selected team.

• Target: actions apply only to the selected target.

To learn more about roles, visit Roles and permissions.

Detailed permission breakdown

The following table lists the Name, ID, and a detailed description of the actions allowed for each high-level permission:

Permission	Allowed Actions
Name: Account Settings ID: account_settings	Manage Integrations: * Create, view, change, and delete third-party account integrations (for example, Akamai, Azure DevOps, Jira Cloud, and so on). Manage Labels: * Create, view, change, delete, and list Finding Labels, Target Labels, and User Labels. Manage Automation: * Create, view, change, delete, and list Webhooks.
Name: Audit Log ID: audit_log	Review History: * Obtain the Audit Log entries.
Name: Billing ID: billing	Manage and View Billing: * Manage billing and payment information. * List and download invoices.
Name: Change Finding ID: change_finding	Modify Findings: * List and view findings. * Perform bulk operations on findings. * List and assign users to a finding. * Add notes to findings. * Manually synchronize findings with integrations already configured (for example, Azure DevOps, Jira Cloud, Shortcut). * View Target Labels.
Name: Change Finding State ID: change_finding_state	Modify Findings State: * Change finding state (Accept risk, Mark as invalid, Reset). * Change finding review status (Approved, Rejected).
Name: Change risk ID: change_risk	Modify Risk Level: * Change the risk rating associated with a finding.
Name: Change Target Settings ID: change_target_settings	Manage Target Configuration: * Manage (add, change, delete, and view) Login or Logout configuration, Navigation Sequences, Partial Scans, Scanning Agents, Extra hosts, Seeds or Reject Lists, Custom Headers or Cookies, Blackout Period, Report types, Coverage details, and Technologies. * Manage (add, change, delete, view) Scan Profiles, and assign them to the target. * Configure API Schema files. * Manage target-specific integrations (Azure DevOps, DefectDojo, Jira Cloud or Server, Shortcut, Slack). Manage Domains: * Manage (add, change, list, view, and verify) Domains. Manage Labels: * Create, change, delete, and list Finding Labels and Target Labels. Manage Webhooks: * Configure Scope Webhooks.
Name: Correlation Admin ID: correlation_admin	Manage SAST and DAST Integration: * View and manage Snyk Code integration. * View and assign or remove Snyk Code projects to or from targets. * View correlation data in the finding details. * Provide correlation feedback. * Register correlation matches (thumbs up or thumbs down).
Name: Correlation Viewer ID: correlation_viewer	View SAST and DAST Integration: * View Snyk Code projects assigned to targets. * View correlation data in the finding details. * Provide correlation feedback. * Register correlation matches (thumbs up or thumbs down). * Disable and delete Snyk Code integration.
Name: Create Target ID: create_target	Add Targets: * Add, change, list, view, and verify Domains. * Add Targets (including uploading and downloading target files). * View and list available Scanning Agents.
Name: Delete Target ID: delete_target	Remove Targets: * Delete Targets. * Delete Domains. * Delete Webhooks.
Name: Discovery ID: discovery	Manage Discovery: * List, and view Discovery Assets. * View Discovery Scans. * View Discovery Asset Logs. * Change Discovery Assets (Mark as new or not new, Hide or Show, Rename, Manage Target Labels, Add Notes).
Name: Discovery Read-Only ID: discovery_read_only	View Discovery Data: * List and view Discovery Assets. * View Discovery Asset Logs. * View Discovery Scans.
Name: Manage Credentials ID: manage_credentials	This permission allows you to create, view, update, and delete credentials created by other users, depending on your assigned scope: * Team Scope: You can only manage credentials within the specific teams where you have been granted "Manage Credentials" permissions. * Account Scope: Additionally, you can assign a credential to any team within the entire account.
Name: Password Login Override ID: password_login_override	Authentication: * Override SSO configuration (that is, log in with username and password when SSO is configured).
Name: Role Assignment ID: role_assignment	Manage User Roles: * List high-level permissions. * List built-in roles. * Add, change, delete, list, and view custom-roles. * View User details. * Add, change, delete, list and view User Labels.
Name: Scanning Agent Management ID: scanning_agent_management	Manage Scanning Agents: * Add, change, delete, list, and view.
Name: Start re-test ID: start_retest	Trigger Re-tests: * Initiate a re-test for a finding.
Name: Start Scan ID: start_scan	Manage Scans: * Initiate a manual Scan on a Target. * Cancel, pause, and resume ongoing Scans. * Add, change, delete, list, and view Scheduled Scans.
Name: Team Management ID: team_management	Manage Teams: * Add, change, delete, and view teams. * Move targets between teams.
Name: User Management ID: user_management	Manage Users and Roles (Account Level): * View User Roles, High-Level Permissions, and available Roles. * Add, change, list, enable or disable Users and API Keys. * Manage Users and API Keys' roles (list, view, assign, and remove role from User or API Key). * Manage User Labels.
Name: View Target ID: view_target	View Target Data and Reports: * List and view Target, Target Settings (including integration-specific settings), Scans, Scheduled Scans, and Findings. * View integration-specific links. * View Target Labels. * View User details. Manage Reports: * Download Scan Reports. * Add, change, delete, list, and view Stored or Managed Reports.