> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudservices.ecowestern.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> Scope API keys to services, resources, and actions

Each API-key permission contains:

* `service`: the ECS service.
* `resource_pattern`: the resource name or pattern.
* `actions`: the operations allowed for that resource.

## Services

| Service     | Resources                          |
| ----------- | ---------------------------------- |
| `flow`      | Functions and function invocations |
| `canopy`    | Static sites                       |
| `clearlake` | Buckets and objects                |
| `waymark`   | Custom domains                     |

## Actions

| Action   | Allows                                                      |
| -------- | ----------------------------------------------------------- |
| `read`   | List or retrieve resources, logs, and status                |
| `write`  | Create, update, redeploy, request upload URLs, or roll back |
| `delete` | Delete resources or objects                                 |
| `invoke` | Send application traffic to a Flow function                 |

## Endpoint mapping

| Operation                                          | Permission         |
| -------------------------------------------------- | ------------------ |
| Create or redeploy a Flow function                 | `flow:write`       |
| Read, list, inspect, or view Flow logs             | `flow:read`        |
| Invoke a Flow function                             | `flow:invoke`      |
| Delete a Flow function                             | `flow:delete`      |
| Create or redeploy a Canopy site                   | `canopy:write`     |
| Read, list, inspect, or view Canopy logs           | `canopy:read`      |
| Delete a Canopy site                               | `canopy:delete`    |
| Create a ClearLake bucket or request an upload URL | `clearlake:write`  |
| Read ClearLake buckets, objects, or download URLs  | `clearlake:read`   |
| Delete ClearLake buckets or objects                | `clearlake:delete` |
| Register a Waymark domain                          | `waymark:write`    |
| Read Waymark domains                               | `waymark:read`     |
| Delete a Waymark domain                            | `waymark:delete`   |

## Resource patterns

Collection endpoints use `*` as their permission resource. Named endpoints use the route's resource identifier.

Example:

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "service": "clearlake",
  "resource_pattern": "uploads-*",
  "actions": ["read", "write"]
}
```

Use `*` for account-wide access to the selected service and actions.