> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-code/rule-extensions/rule-extensions-permissions.md).

# Rule Extensions permissions

Rule Extensions are available to Enterprise customers. Access is granted through a [custom role](https://docs.snyk.io/snyk-platform-administration/user-roles/user-role-management). Rule Extensions are **managed at the Group level** and **tested at the Organization level**, so a role combines Group-level and Organization-level permissions.

Grant only the permissions a role needs. The set differs slightly depending on whether the role is used through the **API** or the **in-product UI**.

## Permissions for API access

A service-account role used with the Rule Extensions REST API needs only the Rule Extensions permissions:

| Permission             | Slug                              | Grants                                                                   |
| ---------------------- | --------------------------------- | ------------------------------------------------------------------------ |
| View Rule Extensions   | `group.rule_extension.read`       | View Rule Extensions in the Group. Required by Create, Edit, and Delete. |
| Create Rule Extensions | `group.rule_extension.create`     | Create Rule Extensions in the Group.                                     |
| Edit Rule Extensions   | `group.rule_extension.edit`       | Update Rule Extensions in the Group.                                     |
| Delete Rule Extensions | `group.rule_extension.delete`     | Permanently delete Rule Extensions from the Group.                       |
| Test Rule Extensions   | `org.rule_extension.project.test` | Run an impact test on a Project in the Organization.                     |

To use the API, create a service account that holds this role and authenticate with its token.

## Permissions for UI access

Reaching the Rule Extensions screens in the Snyk Web UI (**Group settings → Snyk Code**) additionally requires permission to view the Group and its Organizations:

| Permission             | Slug                              | Grants                                               |
| ---------------------- | --------------------------------- | ---------------------------------------------------- |
| View Group             | `group.read`                      | View details of the Group.                           |
| View Group Settings    | `group.settings.read`             | View the Group's settings.                           |
| View Organizations     | `group.org.list`                  | View Organizations in the Group.                     |
| View Rule Extensions   | `group.rule_extension.read`       | View Rule Extensions in the Group.                   |
| Create Rule Extensions | `group.rule_extension.create`     | Create Rule Extensions in the Group.                 |
| Edit Rule Extensions   | `group.rule_extension.edit`       | Update Rule Extensions in the Group.                 |
| Delete Rule Extensions | `group.rule_extension.delete`     | Permanently delete Rule Extensions from the Group.   |
| Test Rule Extensions   | `org.rule_extension.project.test` | Run an impact test on a Project in the Organization. |

## Create the custom role

1. Go to **Group settings → Member Roles → Create new role** and choose the Group role type.
2. Add the Group-level and Organization-level permissions above that the role needs.
3. Assign the role to the member (for UI access) or service account (for API access) that manages Rule Extensions.

{% hint style="info" %}
Customers who managed access during the closed beta must add the updated Rule Extensions permissions to their custom roles — Snyk does not backfill them. Snyk removes the deprecated SAST Rule Extensions permissions from the UI after a 30-day grace period.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-code/rule-extensions/rule-extensions-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.