# Permissions reference

> Every Falak permission name with what it grants and which roles hold it — the same names used as API token abilities.

Source: https://falak.sh/docs/reference/permissions/

Permission names double as API token abilities. The **owner** holds every permission. The role matrix is on [Teams, roles and permissions](/docs/guides/teams-and-roles/#permissions).

| Permission | Grants | Roles (besides owner) |
|---|---|---|
| `alerting.view` | View alert rules, channels, history; receive in-app notifications | admin, developer, viewer |
| `alerting.manage` | Manage alert channels and rules | admin |
| `audit.view` | View the audit log | admin |
| `builds.view` | View builds, build logs and builders | admin, developer, viewer |
| `builds.manage` | Cancel builds and manage builders | admin, developer |
| `databases.view` | View database servers, databases, users and backups | admin, developer, viewer |
| `databases.manage` | Create and drop databases and users, manage backup schedules, run backups | admin, developer |
| `databases.credentials.reveal` | Reveal database user passwords | admin, developer |
| `databases.restore` | Restore backups (overwrites data) | admin |
| `databases.storage.manage` | Manage backup storage providers and credentials | admin |
| `deployments.view` | View deployments, their output and releases | admin, developer, viewer |
| `deployments.create` | Deploy sites; cancel queued, waiting or building deployments | admin, developer |
| `deployments.rollback` | Roll sites back to an earlier release | admin, developer |
| `deployments.manage` | Strategy, health checks, retention, push-to-deploy, deploy hooks | admin, developer |
| `edge.view` | View domains, certificates and routing rules; domain options and DNS checks | admin, developer, viewer |
| `edge.manage` | Manage domains, certificates, redirects, security rules and load balancers | admin, developer |
| `edge.dns.manage` | DNS provider credentials (DNS-01) and generated-domain settings | admin |
| `fleet.agents.manage` | Issue install commands, revoke and upgrade agents | admin |
| `fleet.commands.view` | View agent command output | admin, developer, viewer |
| `insights.view` | View insights, issues and scheduled task health | admin, developer, viewer |
| `insights.manage` | Resolve, assign and comment on issues; configure thresholds and heartbeats | admin, developer |
| `members.view` | View members and teams | admin, developer, viewer |
| `members.manage` | Invite, remove and change roles of members | admin |
| `teams.manage` | Create teams and manage their members | admin |
| `network.view` | View firewalls, private networks and load balancers | admin, developer, viewer |
| `network.manage` | Manage firewall rules and private networks | admin, developer |
| `organization.update` | Rename the organization | admin |
| `organization.delete` | Delete the organization | (owner only) |
| `processes.view` | View workers, daemons, scheduled jobs and status | admin, developer, viewer |
| `processes.manage` | Manage workers, daemons and scheduled jobs; restart processes | admin, developer |
| `projects.view` | View projects, environments and canvases | admin, developer, viewer |
| `projects.manage` | Create, rename, delete projects and environments; arrange and create services on the canvas | admin, developer |
| `providers.view` | View cloud provider credentials and catalogs | admin, developer, viewer |
| `providers.manage` | Add, rotate and remove cloud provider credentials | admin |
| `recipes.view` | View recipes and run history | admin, developer, viewer |
| `recipes.manage` | Create, edit and delete recipes | admin, developer |
| `recipes.run` | Run recipes (arbitrary scripts, possibly as root) | admin |
| `servers.view` | View servers, metrics and provisioning logs | admin, developer, viewer |
| `servers.create` | Create servers | admin, developer |
| `servers.manage` | Manage PHP, settings, SSH keys and re-provision servers | admin, developer |
| `servers.delete` | Delete servers | admin |
| `ssh_keys.manage` | Add and remove organization SSH keys | admin, developer |
| `sites.view` | View sites, settings and command history | admin, developer, viewer |
| `sites.create` | Create sites | admin, developer |
| `sites.manage` | Change site settings, servers, deploy scripts, Laravel toggles | admin, developer |
| `sites.delete` | Delete sites | admin |
| `sites.env.view` | Reveal site environment variables | admin, developer |
| `sites.env.manage` | Edit site environment variables | admin, developer |
| `sites.commands.run` | Run commands in a site on its servers | admin, developer |
| `sites.compose.policy` | Allow privileged Docker Compose files | admin |
| `source_control.view` | View git connections, repositories and pushes | admin, developer, viewer |
| `source_control.manage` | Connect and disconnect git providers | admin |
| `telemetry.view` | View server metrics, logs and traces | admin, developer, viewer |
| `telemetry.manage` | Configure telemetry endpoints and provision Grafana | admin |
| `templates.view` | Browse the catalog and the organization's templates | admin, developer, viewer |
| `templates.manage` | Import, edit and delete the organization's templates | admin, developer |
| `terminal.open` | Open web terminal sessions | admin |
| `terminal.attach` | Watch other members' shared sessions | admin |
| `terminal.control` | Type into and close sessions opened by others | admin |
| `terminal.recordings.view` | Replay other members' recordings | admin |