Complete reference for all permission policy actions and ARN-style resources in API7 Gateway — organized by namespace (gateway, iam, portal) for building least-privilege policies.
This reference catalogs every action and resource ARN that can appear in an API7 Gateway permission policy. Use it as the authoritative source for the action names and ARN formats the policy engine recognizes when it evaluates a request. This catalog was checked against the control plane's own action list on version 3.10.7 — a new release can add actions before this page is updated to match, so treat a permission check failing against an action that is not listed here as a signal to re-verify with the control plane directly, not as proof the action does not exist.
The control plane does not validate an action name or a resource ARN's namespace against this catalog when you create or update a policy. A misspelled action (gateway:GetGatewayGruop) or a wrong ARN prefix (arn:aws:... instead of arn:api7:...) is accepted with HTTP 200 and stored as written — it simply never matches anything at evaluation time. A policy built from a typo fails silently: it grants or denies nothing, and the symptom is a permission check that behaves as if the policy were absent. Copy action names and ARN formats from this page exactly, and verify a new or edited policy end-to-end with a real request before relying on it.
%s marks where an identifier goes — it is the product's own template notation, and it is what the control plane's API descriptions use. Replace each %s with the corresponding ID, in the order the segments appear.
Wildcards are *, or a regular expression enclosed in angle brackets. The policy engine rewrites every * to <.*> before matching and leaves <...> blocks as you wrote them, so arn:api7:gateway:gatewaygroup/* and arn:api7:gateway:gatewaygroup/<.*> are equivalent. The /* form is listed below for the actions that have no specific target yet, such as creating a gateway group.
That is what the form means in this table. It is not what it matches: a wildcard crosses /, so arn:api7:gateway:gatewaygroup/* written into a policy also matches every consumer, service and secret provider ARN beneath it. See Resources.
Because angle brackets are regex, never write <gateway-group-id> intending a placeholder: it matches that literal text and nothing else. See Permission Policies and Boundaries.
Diagnostic agents are a cluster-level resource, a sibling of gateway groups rather than something scoped to one. Listing spans every agent, so it carries no per-agent target; opening the console is a write action, since it can start a live profiling capture against a running worker.
Custom plugins belong to a gateway group, so a policy can name the gateway groups a subject may upload plugins to. Uploading is one action whether the plugin is new or already there, since the upload replaces whatever the gateway group is running under that name.
Action
Resource
gateway:GetCustomPlugin
arn:api7:gateway:gatewaygroup/%s
gateway:UpdateCustomPlugin
arn:api7:gateway:gatewaygroup/%s
gateway:DeleteCustomPlugin
arn:api7:gateway:gatewaygroup/%s
Available in API7 Enterprise from version 3.10.6. Before that, the custom plugin actions applied to arn:api7:gateway:gatewaysetting/*, and one of them was gateway:CreateCustomPlugin, which no endpoint uses now. Upgrading rewrites those grants onto arn:api7:gateway:gatewaygroup/*, so they keep working on every gateway group. Narrow them to the gateway groups that need them.
Reading a custom plugin also requires a permission now. Before 3.10.6 any signed-in user could read one, so the upgrade adds gateway:GetCustomPlugin to the grants it carries over. A role that never had custom plugin permissions needs it added to see the plugins of a gateway group.
