Nuvelics documentation
Account

Permission matrix

Every permission an organization can grant, the roles that hold it, and the API operations that need it.

A role is a named set of permissions. This page lists every permission an organization can grant, with the name the web app shows for it, and which roles hold it. What each role is for is in Roles and permissions.

Who holds each permission

NamePermissionOwnerAdminMemberViewer
View data sourcesdatasource:readYesYesYesYes
Create data sourcesdatasource:createYesYesYes-
Edit data sourcesdatasource:updateYesYesYes-
Run data sourcesdatasource:runYesYesYes-
Delete data sourcesdatasource:deleteYesYes--
View newsdesksnewsdesk:readYesYesYesYes
Edit newsdesksnewsdesk:writeYesYesYes-
View event clustersevent_cluster:readYesYesYesYes
View pitchespitch:readYesYesYesYes
Edit pitchespitch:writeYesYesYes-
View storiesstory:readYesYesYesYes
Edit storiesstory:writeYesYesYes-
Push stories to NRCSstory:push_nrcsYesYesYes-
Push stories to CMSstory:push_cmsYesYesYes-
Publish stories to social accountsstory:push_socialYesYesYes-
View membersmember:readYesYesYesYes
Invite membersmember:inviteYesYes--
Remove membersmember:removeYesYes--
Change member rolesmember:change-roleYesYes--
Deactivate membersmember:deactivateYes---
Manage API keysapikey:manageYesYes--
View organization settingsorg:readYesYes-Yes
Edit organization settingsorg:updateYes---
Delete organizationorg:deleteYes---
Manage billingbilling:manageYes---
View spendusage-spend:readYesYes--
View editorial activityusage-editorial:readYesYes--
Manage spending capsspend-cap:manageYesYes--
View credentialscredential:readYesYesYesYes
Manage credentialscredential:manageYesYes--
Manage NRCS connectionsnrcs:manageYesYes--
Manage MAM connectionsmam:manageYesYes--
Manage CMS connectionscms:manageYesYes--
Manage social connectionssocial:manageYesYes--
View SOM activitysom:readYesYesYesYes
Manage SOM configurationsom:manageYesYes--
View organization statusorg-status:readYesYesYesYes
View activity logaudit:readYesYes--
Edit editorial guidelineseditorial_guidelines:updateYesYes--
View output templatesoutput_template:readYesYesYesYes
Manage output templatesoutput_template:manageYesYes--
View brand kitsbrand_kit:readYesYesYesYes
Manage brand kitsbrand_kit:manageYesYes--
View story checksstory_check:readYesYesYesYes
Manage story checksstory_check:manageYesYes--
Manage MCP settingsmcp:manageYesYes--
Manage notificationsnotification:manageYesYes--

What each permission opens in the API

Under each permission are the API operations that check it before they run. Operations that need no specific permission, and the few that check their permissions inside the operation (creating or revoking an API key, for example), are not listed.

View data sources

Permission datasource:read.

  • GET /api/tenant/v1/articles
  • GET /api/tenant/v1/articles/{id}
  • GET /api/tenant/v1/datasources
  • GET /api/tenant/v1/datasources/{id}
  • GET /api/tenant/v1/datasources/{id}/runs
  • GET /api/tenant/v1/runs

Create data sources

Permission datasource:create.

  • POST /api/tenant/v1/datasources

Edit data sources

Permission datasource:update.

  • PATCH /api/tenant/v1/datasources/{id}

Run data sources

Permission datasource:run.

  • POST /api/tenant/v1/datasources/{id}/run

Delete data sources

Permission datasource:delete.

  • DELETE /api/tenant/v1/datasources/{id}

View newsdesks

Permission newsdesk:read.

  • GET /api/tenant/v1/newsdesks
  • GET /api/tenant/v1/newsdesks/{id}

Edit newsdesks

Permission newsdesk:write.

  • POST /api/tenant/v1/newsdesks
  • DELETE /api/tenant/v1/newsdesks/{id}
  • PATCH /api/tenant/v1/newsdesks/{id}
  • PUT /api/tenant/v1/newsdesks/{id}/datasources

View event clusters

Permission event_cluster:read.

  • GET /api/tenant/v1/event-clusters
  • GET /api/tenant/v1/event-clusters/{id}
  • GET /api/tenant/v1/event-clusters/{id}/media

View pitches

Permission pitch:read.

  • GET /api/tenant/v1/pitches
  • GET /api/tenant/v1/pitches/{id}
  • GET /api/tenant/v1/pitches/{id}/feed-deliveries
  • GET /api/tenant/v1/pitches/{id}/media

Edit pitches

Permission pitch:write.

  • GET /api/tenant/v1/pitch-requests
  • POST /api/tenant/v1/pitch-requests
  • GET /api/tenant/v1/pitch-requests/{id}
  • POST /api/tenant/v1/pitch-requests/{id}/dismiss
  • POST /api/tenant/v1/pitches/{id}/approve
  • POST /api/tenant/v1/pitches/{id}/dismiss
  • POST /api/tenant/v1/pitches/{id}/reopen
  • POST /api/tenant/v1/pitches/{id}/seeds/{articleId}/media
  • POST /api/tenant/v1/pitches/{id}/submit

View stories

Permission story:read.

  • GET /api/tenant/v1/stories
  • GET /api/tenant/v1/stories/{id}
  • GET /api/tenant/v1/stories/{id}/checks
  • GET /api/tenant/v1/stories/{id}/enrichment
  • GET /api/tenant/v1/stories/{id}/outputs
  • GET /api/tenant/v1/stories/{id}/outputs/{outputId}
  • GET /api/tenant/v1/stories/{id}/outputs/{outputId}/cms-preview
  • GET /api/tenant/v1/stories/{id}/outputs/{outputId}/cms-pushes
  • GET /api/tenant/v1/stories/{id}/outputs/{outputId}/photo-candidates
  • GET /api/tenant/v1/stories/{id}/outputs/{outputId}/renders
  • GET /api/tenant/v1/stories/{id}/outputs/{outputId}/social-publishes
  • GET /api/tenant/v1/stories/{id}/photos

Edit stories

Permission story:write.

  • POST /api/tenant/v1/stories/{id}/dismissals
  • POST /api/tenant/v1/stories/{id}/dismissals/restore
  • POST /api/tenant/v1/stories/{id}/outputs
  • DELETE /api/tenant/v1/stories/{id}/outputs/{outputId}
  • PATCH /api/tenant/v1/stories/{id}/outputs/{outputId}
  • POST /api/tenant/v1/stories/{id}/outputs/{outputId}/claim-check
  • POST /api/tenant/v1/stories/{id}/outputs/{outputId}/claim-findings/{findingKey}/accept
  • POST /api/tenant/v1/stories/{id}/outputs/{outputId}/draft/accept
  • POST /api/tenant/v1/stories/{id}/outputs/{outputId}/draft/discard
  • POST /api/tenant/v1/stories/{id}/outputs/{outputId}/regenerate
  • POST /api/tenant/v1/stories/{id}/outputs/{outputId}/renders
  • POST /api/tenant/v1/stories/{id}/photos
  • DELETE /api/tenant/v1/stories/{id}/photos/{assetId}
  • POST /api/tenant/v1/stories/{id}/photos/caption-suggestion
  • POST /api/tenant/v1/stories/{id}/photos/from-url
  • POST /api/tenant/v1/stories/{id}/reenrich

Push stories to NRCS

Permission story:push_nrcs.

  • GET /api/tenant/v1/nrcs-push-targets
  • POST /api/tenant/v1/stories/{id}/push

Push stories to CMS

Permission story:push_cms.

  • GET /api/tenant/v1/cms-push-targets
  • POST /api/tenant/v1/stories/{id}/outputs/{outputId}/cms-pushes

Publish stories to social accounts

Permission story:push_social.

  • GET /api/tenant/v1/social-publish-targets
  • POST /api/tenant/v1/stories/{id}/outputs/{outputId}/social-publishes/{publishId}/check

View members

Permission member:read.

  • GET /api/tenant/v1/members

Invite members

Permission member:invite.

  • GET /api/tenant/v1/members/invitations
  • POST /api/tenant/v1/members/invitations
  • DELETE /api/tenant/v1/members/invitations/{id}
  • POST /api/tenant/v1/members/invitations/{id}/resend

Remove members

Permission member:remove.

  • DELETE /api/tenant/v1/members/{userId}

Change member roles

Permission member:change-role.

  • PATCH /api/tenant/v1/members/{userId}

Deactivate members

Permission member:deactivate.

  • POST /api/tenant/v1/members/{userId}/deactivate

Manage API keys

Permission apikey:manage.

  • GET /api/tenant/v1/api-keys

Edit organization settings

Permission org:update.

  • GET /api/tenant/v1/oauth-connections
  • DELETE /api/tenant/v1/oauth-connections/{id}
  • PATCH /api/tenant/v1/organizations/current

View spend

Permission usage-spend:read.

  • GET /api/tenant/v1/spend-caps
  • GET /api/tenant/v1/usage-events
  • GET /api/tenant/v1/usage-events/summary

View editorial activity

Permission usage-editorial:read.

  • GET /api/tenant/v1/pitches/summary
  • GET /api/tenant/v1/stories/enrichment-summary

Manage spending caps

Permission spend-cap:manage.

  • PUT /api/tenant/v1/spend-caps
  • POST /api/tenant/v1/spend-caps/resume

View credentials

Permission credential:read.

  • GET /api/tenant/v1/credentials
  • GET /api/tenant/v1/credentials/{id}
  • GET /api/tenant/v1/credentials/{id}/param-options
  • GET /api/tenant/v1/datasources/credential-opt-in-kinds

Manage credentials

Permission credential:manage.

  • POST /api/tenant/v1/credentials
  • DELETE /api/tenant/v1/credentials/{id}
  • PATCH /api/tenant/v1/credentials/{id}

Manage NRCS connections

Permission nrcs:manage.

  • GET /api/tenant/v1/nrcs-configs
  • POST /api/tenant/v1/nrcs-configs
  • DELETE /api/tenant/v1/nrcs-configs/{id}
  • GET /api/tenant/v1/nrcs-configs/{id}
  • PATCH /api/tenant/v1/nrcs-configs/{id}
  • PATCH /api/tenant/v1/nrcs-configs/{id}/skills
  • POST /api/tenant/v1/nrcs-configs/{id}/webhook/disable
  • POST /api/tenant/v1/nrcs-configs/{id}/webhook/enable
  • POST /api/tenant/v1/nrcs-configs/{id}/webhook/regenerate

Manage MAM connections

Permission mam:manage.

  • GET /api/tenant/v1/mam-configs
  • POST /api/tenant/v1/mam-configs
  • DELETE /api/tenant/v1/mam-configs/{id}
  • GET /api/tenant/v1/mam-configs/{id}
  • PATCH /api/tenant/v1/mam-configs/{id}

Manage CMS connections

Permission cms:manage.

  • GET /api/tenant/v1/cms-configs
  • POST /api/tenant/v1/cms-configs
  • DELETE /api/tenant/v1/cms-configs/{id}
  • GET /api/tenant/v1/cms-configs/{id}
  • PATCH /api/tenant/v1/cms-configs/{id}

Manage social connections

Permission social:manage.

  • GET /api/tenant/v1/social-connections
  • GET /api/tenant/v1/social-connections/{id}
  • PATCH /api/tenant/v1/social-connections/{id}
  • POST /api/tenant/v1/social-connections/{id}/reconnect
  • POST /api/tenant/v1/social-connections/authorize

View SOM activity

Permission som:read.

  • GET /api/tenant/v1/som-activity/inbox
  • GET /api/tenant/v1/som-activity/skill-runs
  • GET /api/tenant/v1/som-activity/stories
  • GET /api/tenant/v1/som-activity/stories/{storyId}
  • GET /api/tenant/v1/som-activity/summary
  • GET /api/tenant/v1/som-config/status

Manage SOM configuration

Permission som:manage.

  • DELETE /api/tenant/v1/som-config
  • GET /api/tenant/v1/som-config
  • PUT /api/tenant/v1/som-config

View organization status

Permission org-status:read.

  • GET /api/tenant/v1/org-status

View activity log

Permission audit:read.

  • GET /api/tenant/v1/audit-events
  • GET /api/tenant/v1/audit-events/{id}

Edit editorial guidelines

Permission editorial_guidelines:update.

  • PATCH /api/tenant/v1/organizations/current/editorial-guidelines

View output templates

Permission output_template:read.

  • GET /api/tenant/v1/output-templates
  • GET /api/tenant/v1/output-templates/{id}
  • GET /api/tenant/v1/social-layouts
  • GET /api/tenant/v1/social-layouts/{id}

Manage output templates

Permission output_template:manage.

  • POST /api/tenant/v1/output-templates
  • DELETE /api/tenant/v1/output-templates/{id}
  • PATCH /api/tenant/v1/output-templates/{id}
  • POST /api/tenant/v1/social-layouts
  • DELETE /api/tenant/v1/social-layouts/{id}
  • PATCH /api/tenant/v1/social-layouts/{id}
  • POST /api/tenant/v1/social-layouts/import

View brand kits

Permission brand_kit:read.

  • GET /api/tenant/v1/brand-kits
  • GET /api/tenant/v1/brand-kits/{id}
  • GET /api/tenant/v1/brand-kits/default-faces
  • GET /api/tenant/v1/custom-fonts
  • GET /api/tenant/v1/custom-fonts/{id}

Manage brand kits

Permission brand_kit:manage.

  • POST /api/tenant/v1/brand-kits
  • DELETE /api/tenant/v1/brand-kits/{id}
  • PATCH /api/tenant/v1/brand-kits/{id}
  • GET /api/tenant/v1/brand-kits/font-catalog
  • POST /api/tenant/v1/brand-kits/fonts/google
  • POST /api/tenant/v1/custom-fonts
  • DELETE /api/tenant/v1/custom-fonts/{id}
  • PATCH /api/tenant/v1/custom-fonts/{id}

View story checks

Permission story_check:read.

  • GET /api/tenant/v1/story-checks
  • GET /api/tenant/v1/story-checks/{id}

Manage story checks

Permission story_check:manage.

  • POST /api/tenant/v1/story-checks
  • DELETE /api/tenant/v1/story-checks/{id}
  • PATCH /api/tenant/v1/story-checks/{id}
  • POST /api/tenant/v1/story-checks/draft
  • POST /api/tenant/v1/story-checks/preview

Manage MCP settings

Permission mcp:manage.

  • PATCH /api/tenant/v1/organizations/current/mcp-settings

Manage notifications

Permission notification:manage.

  • GET /api/tenant/v1/notifications
  • POST /api/tenant/v1/notifications/routes
  • DELETE /api/tenant/v1/notifications/routes/{id}
  • PUT /api/tenant/v1/notifications/routes/{id}
  • POST /api/tenant/v1/notifications/test

Report a problem with this page

Roles

The four roles in an organization, what each is for, and who can assign them.

Signing in

How people sign in to Nuvelics on the web, the command line and AI assistants, and what an administrator controls.

On this page

Who holds each permissionWhat each permission opens in the APIView data sourcesCreate data sourcesEdit data sourcesRun data sourcesDelete data sourcesView newsdesksEdit newsdesksView event clustersView pitchesEdit pitchesView storiesEdit storiesPush stories to NRCSPush stories to CMSPublish stories to social accountsView membersInvite membersRemove membersChange member rolesDeactivate membersManage API keysEdit organization settingsView spendView editorial activityManage spending capsView credentialsManage credentialsManage NRCS connectionsManage MAM connectionsManage CMS connectionsManage social connectionsView SOM activityManage SOM configurationView organization statusView activity logEdit editorial guidelinesView output templatesManage output templatesView brand kitsManage brand kitsView story checksManage story checksManage MCP settingsManage notifications