Complete reference for all permission policy actions and ARN-style resources in API7 Gateway — organized by namespace (gateway, iam, portal) for building least-privilege policies.
This reference catalogs every action and resource ARN that can appear in an API7 Gateway permission policy. Use it as the authoritative source when authoring policies — every action listed here is enforced by the Control Plane, and every resource ARN follows the exact format the policy engine accepts.
Permissions are organized into three namespaces:
| Namespace | Purpose |
|---|
gateway: | Data plane configuration — gateway groups, services, routes, consumers, plugins, certificates, alerts |
iam: | Identity and organization — users, roles, permission policies, license, audit logs, login options, SMTP, contact points |
portal: | Developer Portal — portals, API products, developers, DCR providers, portal tokens |
Wildcards are expressed as * (literal wildcard in the resource path) or <regex> (regular expression enclosed in angle brackets, applied at match time). For example, arn:api7:gateway:gatewaygroup/<.*> matches every gateway group, while arn:api7:gateway:gatewaygroup/* is used in creation statements where there is no specific target yet.
| Action | Resource |
|---|
gateway:GetGatewayGroup | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateGatewayGroup | arn:api7:gateway:gatewaygroup/* |
gateway:UpdateGatewayGroup | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteGatewayGroup | arn:api7:gateway:gatewaygroup/%s |
gateway:GetAdminKey | arn:api7:gateway:gatewaygroup/%s |
| Action | Resource |
|---|
gateway:GetGatewayInstance | arn:api7:gateway:gatewaygroup/%s |
gateway:GetGatewayInstanceCore | arn:api7:gateway:gatewaygroup/* |
gateway:CreateGatewayInstance | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteGatewayInstance | arn:api7:gateway:gatewaygroup/%s |
| Action | Resource |
|---|
gateway:GetConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:CreateConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/* |
gateway:UpdateConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:DeleteConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
| Action | Resource |
|---|
gateway:GetConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:CreateConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:UpdateConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:DeleteConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
| Action | Resource |
|---|
gateway:GetSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
| Action | Resource |
|---|
gateway:GetCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteCertificate | arn:api7:gateway:gatewaygroup/%s |
| Action | Resource |
|---|
gateway:GetCACertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateCACertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateCACertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteCACertificate | arn:api7:gateway:gatewaygroup/%s |
| Action | Resource |
|---|
gateway:GetSNI | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateSNI | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateSNI | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteSNI | arn:api7:gateway:gatewaygroup/%s |
| Action | Resource |
|---|
gateway:GetGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
| Action | Resource |
|---|
gateway:GetPluginMetadata | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdatePluginMetadata | arn:api7:gateway:gatewaygroup/%s |
gateway:DeletePluginMetadata | arn:api7:gateway:gatewaygroup/%s |
| Action | Resource |
|---|
gateway:GetServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
gateway:ConnectServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
gateway:DisconnectServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
| Action | Resource |
|---|
gateway:GetSecretProvider | arn:api7:gateway:gatewaygroup/%s/secret_provider/%s |
gateway:PutSecretProvider | arn:api7:gateway:gatewaygroup/%s/secret_provider/%s |
gateway:DeleteSecretProvider | arn:api7:gateway:gatewaygroup/%s/secret_provider/%s |
For gRPC service definitions used by the grpc-transcode and proto plugins.
| Action | Resource |
|---|
gateway:GetProto | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateProto | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateProto | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteProto | arn:api7:gateway:gatewaygroup/%s |
For online request debugging and trace capture.
| Action | Resource |
|---|
gateway:GetDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:StopDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:ExportDebugSession | arn:api7:gateway:gatewaygroup/%s |
Services are scoped to gateway groups. The same four actions cover a service's routes and stream routes.
| Action | Resource |
|---|
gateway:GetPublishedService | arn:api7:gateway:gatewaygroup/%s/service/%s |
gateway:CreatePublishedService | arn:api7:gateway:gatewaygroup/%s/service/* |
gateway:UpdatePublishedService | arn:api7:gateway:gatewaygroup/%s/service/%s |
gateway:DeletePublishedService | arn:api7:gateway:gatewaygroup/%s/service/%s |
System-wide gateway deployment settings.
| Action | Resource |
|---|
gateway:UpdateDeploymentSetting | arn:api7:gateway:gatewaysetting/* |
Custom plugins belong to a gateway group, so a policy can name the gateway groups a subject may upload plugins to. Uploading is one action whether the plugin is new or already there, since the upload replaces whatever the gateway group is running under that name.
| Action | Resource |
|---|
gateway:GetCustomPlugin | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateCustomPlugin | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteCustomPlugin | arn:api7:gateway:gatewaygroup/%s |
Available in API7 Enterprise from version 3.10.6. Before that, the custom plugin actions applied to arn:api7:gateway:gatewaysetting/*, and one of them was gateway:CreateCustomPlugin, which no endpoint uses now. Upgrading rewrites those grants onto arn:api7:gateway:gatewaygroup/*, so they keep working on every gateway group. Narrow them to the gateway groups that need them.
Reading a custom plugin also requires a permission now. Before 3.10.6 any signed-in user could read one, so the upgrade adds gateway:GetCustomPlugin to the grants it carries over. A role that never had custom plugin permissions needs it added to see the plugins of a gateway group.
| Action | Resource |
|---|
gateway:GetAlertPolicy | arn:api7:gateway:alert/%s |
gateway:CreateAlertPolicy | arn:api7:gateway:alert/* |
gateway:UpdateAlertPolicy | arn:api7:gateway:alert/%s |
gateway:DeleteAlertPolicy | arn:api7:gateway:alert/%s |
Reusable webhook payload templates used by alert contact points.
| Action | Resource |
|---|
gateway:GetWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
gateway:CreateWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
gateway:UpdateWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
gateway:DeleteWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
| Action | Resource |
|---|
iam:GetUser | arn:api7:iam:user/%s |
iam:InviteUser | arn:api7:iam:user/* |
iam:UpdateUser | arn:api7:iam:user/%s |
iam:DeleteUser | arn:api7:iam:user/%s |
iam:UpdateUserRole | arn:api7:iam:user/%s |
iam:ResetPassword | arn:api7:iam:user/%s |
iam:UpdateUserBoundary | arn:api7:iam:user/%s |
| Action | Resource |
|---|
iam:GetRole | arn:api7:iam:role/%s |
iam:CreateRole | arn:api7:iam:role/* |
iam:UpdateRole | arn:api7:iam:role/%s |
iam:DeleteRole | arn:api7:iam:role/%s |
| Action | Resource |
|---|
iam:GetPermissionPolicy | arn:api7:iam:permissionpolicy/%s |
iam:CreatePermissionPolicy | arn:api7:iam:permissionpolicy/* |
iam:UpdatePermissionPolicy | arn:api7:iam:permissionpolicy/%s |
iam:DeletePermissionPolicy | arn:api7:iam:permissionpolicy/%s |
| Action | Resource |
|---|
iam:UpdateLicense | arn:api7:iam:organization/* |
| Action | Resource |
|---|
iam:GetAudit | arn:api7:iam:organization/* |
iam:ExportAudits | arn:api7:iam:organization/* |
Login options configure authentication methods for the Dashboard (OIDC, SAML, LDAP, CAS).
| Action | Resource |
|---|
iam:GetLoginOption | arn:api7:iam:organization/* |
iam:CreateLoginOption | arn:api7:iam:organization/* |
iam:UpdateLoginOption | arn:api7:iam:organization/* |
iam:DeleteLoginOption | arn:api7:iam:organization/* |
| Action | Resource |
|---|
iam:GetSCIMProvisioning | arn:api7:iam:organization/* |
iam:UpdateSCIMProvisioning | arn:api7:iam:organization/* |
Used for outbound email notifications and user invitations.
| Action | Resource |
|---|
iam:GetSMTPServer | arn:api7:iam:organization/* |
iam:UpdateSMTPServer | arn:api7:iam:organization/* |
Contact points are alert notification targets (email, webhook, etc.) referenced by alert policies.
| Action | Resource |
|---|
iam:GetContactPoint | arn:api7:iam:contactpoint/%s |
iam:CreateContactPoint | arn:api7:iam:contactpoint/* |
iam:UpdateContactPoint | arn:api7:iam:contactpoint/%s |
iam:DeleteContactPoint | arn:api7:iam:contactpoint/%s |
| Action | Resource |
|---|
portal:GetPortal | arn:api7:portal:portal/%s |
portal:CreatePortal | arn:api7:portal:portal/* |
portal:UpdatePortal | arn:api7:portal:portal/%s |
portal:DeletePortal | arn:api7:portal:portal/%s |
| Action | Resource |
|---|
portal:GetPortalToken | arn:api7:portal:portal/%s/token/* |
portal:CreatePortalToken | arn:api7:portal:portal/%s/token/* |
portal:UpdatePortalToken | arn:api7:portal:portal/%s/token/* |
portal:DeletePortalToken | arn:api7:portal:portal/%s/token/* |
| Action | Resource |
|---|
portal:GetAPIProduct | arn:api7:portal:portal/%s/apiproduct/%s |
portal:CreateAPIProduct | arn:api7:portal:portal/%s/apiproduct/* |
portal:UpdateAPIProduct | arn:api7:portal:portal/%s/apiproduct/%s |
portal:DeleteAPIProduct | arn:api7:portal:portal/%s/apiproduct/%s |
| Action | Resource |
|---|
portal:GetDeveloper | arn:api7:portal:portal/%s/developer/%s |
portal:InviteDeveloper | arn:api7:portal:portal/%s/developer/* |
portal:DeleteDeveloper | arn:api7:portal:portal/%s/developer/%s |
Dynamic Client Registration providers used by the Developer Portal.
| Action | Resource |
|---|
portal:GetDCRProvider | arn:api7:portal:dcrprovider/* |
portal:CreateDCRProvider | arn:api7:portal:dcrprovider/* |
portal:UpdateDCRProvider | arn:api7:portal:dcrprovider/* |
portal:DeleteDCRProvider | arn:api7:portal:dcrprovider/* |
Configures authentication methods that developers can use to sign in to a Developer Portal.
| Action | Resource |
|---|
portal:GetDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
portal:CreateDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
portal:UpdateDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
portal:DeleteDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
| Action | Resource |
|---|
portal:GetDeveloperSCIMProvisioning | arn:api7:portal:portal/%s/loginsetting/* |
portal:UpdateDeveloperSCIMProvisioning | arn:api7:portal:portal/%s/loginsetting/* |
Controls whether a Developer Portal is publicly accessible without login.
| Action | Resource |
|---|
portal:GetDeveloperPortalPublicAccess | arn:api7:portal:portal/%s/loginsetting/* |
portal:UpdateDeveloperPortalPublicAccess | arn:api7:portal:portal/%s/loginsetting/* |
Approve pending API product subscriptions or new developer sign-ups.
| Action | Resource |
|---|
portal:ApproveAPIProductSubscription | arn:api7:portal:portal/%s/apiproduct/%s |
portal:ApproveDeveloperSignUp | arn:api7:portal:portal/%s/developer/* |