Permissions

Each API-key permission contains:

Services

Service	Resources
`flow`	Functions and function invocations
`canopy`	Static sites
`clearlake`	Buckets and objects
`waymark`	Custom domains

Action	Allows
`read`	List or retrieve resources, logs, and status
`write`	Create, update, redeploy, request upload URLs, or roll back
`delete`	Delete resources or objects
`invoke`	Send application traffic to a Flow function

Operation	Permission
Create or redeploy a Flow function	`flow:write`
Read, list, inspect, or view Flow logs	`flow:read`
Invoke a Flow function	`flow:invoke`
Delete a Flow function	`flow:delete`
Create or redeploy a Canopy site	`canopy:write`
Read, list, inspect, or view Canopy logs	`canopy:read`
Delete a Canopy site	`canopy:delete`
Create a ClearLake bucket or request an upload URL	`clearlake:write`
Read ClearLake buckets, objects, or download URLs	`clearlake:read`
Delete ClearLake buckets or objects	`clearlake:delete`
Register a Waymark domain	`waymark:write`
Read Waymark domains	`waymark:read`
Delete a Waymark domain	`waymark:delete`

Collection endpoints use * as their permission resource. Named endpoints use the route’s resource identifier. Example:

{
  "service": "clearlake",
  "resource_pattern": "uploads-*",
  "actions": ["read", "write"]
}

Use * for account-wide access to the selected service and actions.