Roles & permission keys

heliana gates every action behind a resource:action permission key. This page lists every key, grouped by feature area (click a group to expand it), and what each built-in role holds. Day to day, use the Roles screen. It doesn’t print these raw strings: it shows the group’s label (“Access lists”) and the action’s label (“Read”, “Manage”) from the same matrix these tables describe.

For the concepts behind the permission model see Permissions model and the Roles & permissions guide.

---

Permission keys

The groups below are in the same order as the rows of the roles matrix, and the group headings are the ones printed on that screen.

Access lists

Key	What it gates
access:read	View the access-list catalog, the entries of a list, and the list’s leaders
access:manage	Create and delete access lists; add and remove entries; appoint and remove list leaders

A list leader reaches their own list — reading its entries, and adding or removing them — without holding either key. Leadership is a link, not a grant; see System roles below. A leader does not choose which Patreon tiers feed their list: that needs integration:manage.

Audit log

Key	What it gates
auditLog:read	Read the audit log. Records that target a server are narrowed by your server access, so two members holding this key can see different rows.

Bans

Key	What it gates
ban:create	Issue a ban against a player
ban:read	View bans on a player profile
ban:update	In the permission set, but no route checks it — bans are created and revoked, not edited.
ban:delete	Revoke (lift) a ban

Ban lists

Key	What it gates
banList:read	View the catalog of ban-source providers
banList:manage	Add or remove a ban exception on a player, and create, view, edit, delete, and sync a ban source, including reading its sync runs

Events

Key	What it gates
event:read	The live feed on the Dashboard, match history and scoreboards, player sessions and playtime

Invitations

Key	What it gates
invitation:create	Send an invitation to join the organization
invitation:cancel	Cancel a pending invitation
invitation:read	List the organization’s pending invitations

Members

Key	What it gates
member:create	In the permission set, but no route checks it — members join through an invitation.
member:read	View the organization’s member list
member:update	Change a member’s role or server access
member:delete	Remove a member from the organization

Notes

Key	What it gates
note:create	Add a note to a player profile
note:read	View notes on a player profile
note:delete	Delete a note

There is no note-edit key: a note can’t be edited — delete it and write a new one.

Organization

Key	What it gates
organization:update	Rename the organization; view its subscription and server limit on the Billing page
organization:delete	Delete the organization, with all its servers, data and history; pay for it (checkout, Paddle portal, number of extra servers) — owner only

Only the Owner holds organization:delete; it cannot be handed to a custom role even if that role’s grant list names it. Deleting an organization is one-way; leaving one needs no permission key. Both are described in Leave or delete.

Integrations

Key	What it gates
integration:manage	Connect, sync and disconnect Patreon and Discord, and choose which Patreon tiers and Discord guild roles feed each access list

Secrets

Key	What it gates
secret:manage	Add, replace and delete organization secrets used by automation fetch; values are never shown after saving

Patrons

Key	What it gates
patron:read	View the Patrons page and a patron’s card: tiers, status, paid-until and history
patron:manage	Exclude a patron from access and lift the exclusion

Players

Key	What it gates
player:read	View player profiles, activity history, and list memberships
player:ip	View a player’s IP addresses, their address-matched alt accounts, and per-session addresses
player:link	Verify or unverify a player’s Heliana account EOS ID in this organization

Roles

Key	What it gates
role:create	Create a custom role
role:read	View custom role definitions
role:update	Edit a custom role’s permissions
role:delete	Delete a custom role

Servers

Key	What it gates
server:create	Add a server to the organization
server:read	View server configuration and connection settings
server:update	Edit a server’s connection and config management, pause and resume collection
server:delete	Retire a server. Labelled Delete in the matrix, but the server row stays — it remains the author of its past observations.

Support

Key	What it gates
support:grant	Grant Heliana support access to the organization for 24 hours. Held by Owners and Admins by default.

Tags

Key	What it gates
tag:read	View the tag catalog and the entries of a tag
tag:assign	Add players to tags and remove them (tag entries)
tag:manage	Create, edit and delete tags in the catalog

Automations

Key	What it gates
automation:create	Create an automation
automation:read	View the organization’s automations
automation:update	Edit an automation, and run any manual automation
automation:delete	Delete an automation

Two keys in the list above are held by roles but checked by no route today: ban:update and member:create. Granting or withholding them has no effect.

---

Running a manual automation

There is no automation:exec:<id> key — a key is resource:action, and a key generated per automation cannot exist in that set.

The Run button on a manual automation opens for either of two independent reasons:

• the member’s role holds automation:update — that opens every manual automation in the organization; or
• the member’s role is linked to that one automation, which opens only the automation named.

The link is what the Automation actions row of the roles matrix sets. On screen it is one checkbox, and that is honest: checking it links the role to that automation. Underneath, a role is saved as two separate fields — its permission keys and its linked automations — because a link is a relationship to one named object, not a permission over the organization.

Owner and Admin hold automation:update, so they run every manual automation without any link. System-role columns are locked, so only a custom role can carry the link.

See Grant per-automation execution rights.

---

System roles

heliana ships two built-in roles: Owner and Admin. They can’t be edited or deleted.

There is no third role for leading an access list. Leadership is a link between one Heliana account and one list, set on that list’s page by someone holding access:manage. A list leader is not a member of the organization and holds no role in it; they read and edit their own list’s entries and nothing beyond it.

Owner

Holds every key in the matrix.

Resource	Grants
Access lists	read, manage
Audit log	read
Bans	create, read, update, delete
Ban lists	read, manage
Events	read
Invitations	create, cancel, read
Members	create, read, update, delete
Notes	create, read, delete
Organization	update, delete
Integrations	manage
Patrons	read, manage
Players	read, IP address, Verify account
Roles	create, read, update, delete
Servers	create, read, update, delete
Support	grant
Tags	read, assign, manage
Automations	create, read, update, delete

Admin

Holds every key Owner holds except organization:delete — deleting the organization is reserved for its Owner, and that is the one place the matrix now tells Owner and Admin apart.

Resource	Grants
Access lists	read, manage
Audit log	read
Bans	create, read, update, delete
Ban lists	read, manage
Events	read
Invitations	create, cancel, read
Members	create, read, update, delete
Notes	create, read, delete
Organization	update
Integrations	manage
Patrons	read, manage
Players	read, IP address, Verify account
Roles	create, read, update, delete
Servers	create, read, update, delete
Support	grant
Tags	read, assign, manage
Automations	create, read, update, delete

Besides organization:delete, the difference is not a key: an organization has exactly one Owner, who can be neither removed nor demoted. The organization’s creator holds Owner from the start; the invite dialog never offers it, but the role selector in the Members table does, and only the Owner can assign it, which transfers ownership and makes the previous Owner an Admin.

---

Custom roles

A custom role holds any subset of the keys above, plus the manual automations it is linked to through the Automation actions rows. The role editor presents the keys as a checkbox matrix, with the automation rows appended as their own group when at least one manual automation exists.

Seeded role Moderator

Every organization is seeded with one custom role named Moderator when it is created — action on players without organization configuration, eleven keys, plus six linked Actions buttons. The organization can rename, edit or delete it like any custom role; it is only ever seeded once, at creation.

Resource	Grants
Bans	create, read, delete
Events	read
Notes	create, read, delete
Players	read
Servers	read
Tags	read, assign

The role holds no automation:* key, so it cannot read the Automations table (which carries webhook addresses). Instead it is linked to six moderation Actions buttons: five player buttons — Ban player, Warn player, Kick player, Remove from squad and Force team change — appear in the Actions menu on a player’s page, and Broadcast appears in the Actions menu of the server panel. The other server-control buttons — Run RCON command, Change map, End match and Force seed bots — are not linked; an Admin can tick them on the Roles screen.

A save that carries anything other than the keys above is refused outright rather than cleaned up: no role holds a key outside the matrix, so it exceeds the set of whoever is saving, and the whole request fails with nothing written. The set shown on the Roles screen is exactly the set the API treats as that role’s access.