Skip to content
Lamba
Sign In

API details

Permissions Catalog

Workspace, Project console, and Project runtime permission guidance for Lamba integrations.

Before you start

This catalog is integration guidance. Backend enforcement is the source of truth for the final permission decision.

Workspace permission groups

GroupExample permissionsSurface
WorkspaceView and manage projectsConsole
AuthenticationManage login methods and hosted brandingConsole
DirectoryView, import, block, or unblock usersConsole
SessionsView or revoke sessionsConsole and runtime admin
AnalyticsView or export analyticsConsole
WebhooksView, manage, and rotate webhook endpointsConsole
AuditView or export audit logsConsole
BillingView or manage billing artifactsConsole
ApplicationsView and manage OAuth/OIDC clientsConsole
SecurityView and manage security postureConsole

Project runtime permissions

Project roles should describe what a Project Member can do inside your product. Keep built-in viewer available so invite, public join, and register flows always have a safe default.

Implementation steps

  1. Decide whether the user is operating the console or the runtime product.
  2. Read the correct authorization surface.
  3. Hide actions that are not allowed.
  4. Still handle 403 from APIs because permissions can change after render.
  5. Audit role and permission changes.

Troubleshooting

When a user reports missing access, capture Workspace ID, Project ID, environment, membership type, current role, requested action, and trace ID. This usually reveals whether the wrong catalog was checked.

  • Roles and Permissions: /docs/concepts/roles-permissions
  • Member Lifecycle: /docs/concepts/member-lifecycle
  • Error Reference: /docs/reference/errors