Permission names

How to read this list

The installer creates 35 core names. Mishka Blog adds 6 when you install it, and Mishka Document adds 6.
admin:dashboard:<area> names open the admin screens. admin:api:<area> names open the same areas over the admin JSON:API. A name counts only on its own surface.
A name ending in * covers every name below it. A name without one covers only itself.
The Permissions screen under Account lists the stored names with these descriptions, sorted by name by default. A name that is already stored keeps its description when the installer runs again.

Core wildcard names

Name	What it opens
`*`	Every permission within the holder's own site. For a master that means every site. It never makes anyone a master.
`admin:*`	Full admin of the dashboard and the API.
`admin:dashboard:*`	Full dashboard admin: every dashboard area, every builder and code.
`admin:api:*`	Full API admin: every admin JSON:API and GraphQL area, and code.
`admin:dashboard:runtime:*`	Every runtime section on the dashboard, their code included, and opening every builder.
`admin:api:runtime:*`	Every runtime section over the admin JSON:API, their code included.

Core dashboard names: runtime

Name	What it opens
`admin:dashboard:runtime:site`	The Sites screen and site data: read, create, edit and archive. A site-wide action still needs a master.
`admin:dashboard:runtime:page`	Writing pages, their drafts and versions, their code included, and opening the page builder.
`admin:dashboard:runtime:layout`	Writing layouts, their drafts and versions, their code included, and opening the layout builder.
`admin:dashboard:runtime:component`	Writing components and their versions, their code included, and opening the component builder.
`admin:dashboard:runtime:error_page`	Writing error pages, their drafts and versions, their code included, and opening the error page builder.
`admin:dashboard:runtime:stylesheet`	Writing stylesheets, their CSS included.
`admin:dashboard:runtime:js_hook`	Writing JS hooks, their content included.
`admin:dashboard:runtime:media`	Writing media, media categories and their versions. Every dashboard admin reads them.
`admin:dashboard:runtime:translation`	Writing translation rows. Every dashboard admin reads them.
`admin:dashboard:runtime:redirect`	Writing the site's redirect rules. Every dashboard admin reads them.
`admin:dashboard:runtime:activity`	The Activity screen, activity entries and the recent-activity widget.

Core dashboard names: accounts, settings and code

Name	What it opens
`admin:dashboard:setting`	Writing site settings that declare no permission of their own, the extension switches and the notification toggles included.
`admin:dashboard:user`	The Users screen: list, read, create, edit and delete the accounts of the holder's own site.
`admin:dashboard:permission`	The Permissions screen: read the permission names, and grant or revoke permissions within what the holder holds.
`admin:dashboard:code`	Writing pages, layouts, components, error pages, stylesheets and JS hooks, their code included, and opening every builder.

Core API names

Name	What it opens
`admin:api:runtime:site`	Site data over the admin JSON:API.
`admin:api:runtime:page`	Writing pages over the admin JSON:API, their code included.
`admin:api:runtime:layout`	Writing layouts over the admin JSON:API, their code included.
`admin:api:runtime:component`	Writing components over the admin JSON:API, their code included.
`admin:api:runtime:error_page`	Writing error pages over the admin JSON:API, their code included.
`admin:api:runtime:stylesheet`	Writing stylesheets over the admin JSON:API, their CSS included.
`admin:api:runtime:js_hook`	Writing JS hooks over the admin JSON:API, their content included.
`admin:api:runtime:media`	Writing media and media categories over the admin JSON:API.
`admin:api:runtime:translation`	Writing translations over the admin JSON:API.
`admin:api:runtime:redirect`	Writing redirect rules over the admin JSON:API.
`admin:api:runtime:activity`	The activity log over the admin JSON:API.
`admin:api:user`	Accounts over the admin JSON:API.
`admin:api:permission`	The permission names and the grants over the admin JSON:API.
`admin:api:code`	Writing pages, layouts, components, error pages, stylesheets and JS hooks over the admin JSON:API, their code included.

Mishka Blog names

The blog creates these when you install it on a site. See Start a blog.

Name	What it opens
`admin:dashboard:blog:*`	The whole blog on the dashboard: posts and comments.
`admin:dashboard:blog:post`	The editorial side of the blog: posts, collections, tags, bloggers, teams and auto posting, with their views, ratings, bookmarks and follows. Holders are told when a post is published.
`admin:dashboard:blog:comment`	Comment moderation: comments and comment votes.
`admin:api:blog:*`	The whole blog over the admin JSON:API.
`admin:api:blog:post`	Posts, collections, tags, bloggers, teams and auto posting over the admin JSON:API.
`admin:api:blog:comment`	Comments over the admin JSON:API.

Mishka Document names

The document extension creates these when you install it on a site.

Name	What it opens
`admin:dashboard:document:*`	The whole document extension on the dashboard.
`admin:dashboard:document:workspace`	Workspaces, their versions and lineage, other users' follows, the Home workspace form and the Workspace Versions screen.
`admin:dashboard:document:section`	Sections, notes, drafts, tags, issues and issue comments, other users' bookmarks, section views, and their screens.
`admin:api:document:*`	The whole document extension over the admin JSON:API.
`admin:api:document:workspace`	Workspace, workspace version and version lineage routes.
`admin:api:document:section`	Section, note, draft, tag, issue and issue comment routes.

Names you add yourself

A master can add any other name on the Permissions screen with + Add Permission. A name is lowercase letters, digits and underscores, joined by colons, up to 200 characters. A * may end it. A page, a post or a collection can be locked with any name, such as members:read.