Server Permissions

List of Permissions

Ownership of an entry is determined solely based on UUID, ignoring the username.

Note xxx/self/yyy permissions are automatically given when a user has an equivalent xxx/anyone/yyy permission. Explicitly denying the xxx/self/yyy version does not change that.

/entry/author and /entry/verified are not included under /entry/(self|anyone)/edit to prevent accidentally granting these more powerful permissions when granting the whole group (/entry/(self|anyone)).

Permission	Allows the user to ...
/connect
/connect	connect to the server
/config
/config/lock	lock the config
/config/edit	edit the config
/config/list	view the config
/entry
/entry/lock	lock all entries
/entry/self/add	add entries with themself listed as author If the username is incorrect, this must be combined with /entry/author/incorrect_username If the entry is verified, this must be combined with /entry/verified/self/add/verify If the entry is unverified, this must be combined with /entry/verified/self/add/unverify
/entry/self/edit/name	edit the name of their own* entries
/entry/self/edit/nbt	edit the NBT of their own* entries
/entry/self/edit/type	edit the type of their own* entries
/entry/self/edit/data_version	edit the data version of their own* entries
/entry/self/remove	remove their own* entries
/entry/self/get	read their own entries by ID (not including the NBT)
/entry/self/export	export their own entries (read the NBT)
/entry/self/list	list their own entries If the filter doesn't specify an author UUID, it is automatically filled with the user's UUID If the filter does specify an author UUID, and it doesn't match the user's UUID, the request fails
/entry/anyone/add	add entries with anyone listed as author If the username is incorrect, this must be combined with /entry/author/incorrect_username If the entry is verified, this must be combined with /entry/verified/anyone/add/verify If the entry is unverified, this must be combined with /entry/verified/anyone/add/unverify
/entry/anyone/edit/name	edit the name of all* entries
/entry/anyone/edit/nbt	edit the NBT of all* entries
/entry/anyone/edit/type	edit the type of all* entries
/entry/anyone/edit/data_version	edit the data version of all* entries
/entry/anyone/remove	remove all* entries
/entry/anyone/get	read all entries by ID (not including the NBT)
/entry/anyone/export	export all entries (read the NBT)
/entry/anyone/list	list all entries
/entry/author/self/uuid	edit the author UUID on their own entries If the entry is not unverified or being set to unverified in the same request (using /entry/verified/self/edit/unverify), then this must be combined with /entry/verified/anyone/edit/verify
/entry/author/self/username	edit the username on their own* entries If the username is incorrect, this must be combined with /entry/author/incorrect_username
/entry/author/anyone/uuid	edit the author UUID on all* entries If the original entry is verified, and the user doesn't have /entry/verified/anyone/edit/verify, the final entry can still be verified if the UUID is being set to the user's UUID and the user has both /entry/verified/anyone/edit/unverify and /entry/verified/self/edit/verify If the original entry is verified, and the user doesn't have /entry/verified/anyone/edit/unverify, the final entry can still be unverified if the UUID is being set to the user's UUID and the user has both /entry/verified/anyone/edit/verify and /entry/verified/self/edit/unverify
/entry/author/anyone/username	edit the username on all* entries If the username is incorrect, this must be combined with /entry/author/incorrect_username
/entry/author/incorrect_username	introduce incorrect usernames when adding and editing entries when combined with /entry/(self|anyone)/add and /entry/author/(self|anyone)/username respectively
/entry/verified/self/add/verify	add verified entries with themself listed as author when combined with /entry/self/add
/entry/verified/self/add/unverify	add unverified entries with themself listed as author when combined with /entry/self/add
/entry/verified/self/edit/verify	edit their own unverified entries to become verified and edit their own verified entries
/entry/verified/self/edit/unverify	edit their own verified entries to become unverified Unlike /entry/verified/self/edit/verify, this is not required for editing their own unverified entries
/entry/verified/anyone/add/verify	add verified entries with anyone listed as author when combined with /entry/anyone/add
/entry/verified/anyone/add/unverify	add unverified entries with anyone listed as author when combined with /entry/anyone/add
/entry/verified/anyone/edit/verify	edit all unverified entries to become verified and edit all verified entries
/entry/verified/anyone/edit/unverify	edit all verified entries to become unverified Unlike /entry/verified/anyone/edit/verify, this is not required for editing all unverified entries
/tag
/tag/lock	lock all tags
/tag/add	add tags
/tag/edit/name	edit the name of tags
/tag/edit/color	edit the color of tags
/tag/remove	remove tags
/tag/get	read tags by name
/tag/list	list tags If filtering for an entry owned by the user, this must be combined with /tag/self/filter If filtering for an entry owned by anyone, this must be combined with /tag/anyone/filter
/tag/self/attach	attach tags to their own* entries
/tag/self/detach	detach tags from their own* entries
/tag/self/filter	list tags attached to their own entries when combined with /tag/list
/tag/anyone/attach	attach tags to all* entries
/tag/anyone/detach	detach tags from all* entries
/tag/anyone/filter	list tags attached to all entries when combined with /tag/list

*The entry must be unverified unless the user has /entry/verified/(self|anyone)/edit/verify. To satisfy this requirement, the edit request could include setting verified to false if it is not already (requires /entry/verified/(self|anyone)/edit/unverify). If the request is not an edit request (for example, attaching a tag), unverifying and the operation in question cannot be combined into one request, so an edit request must be sent first.

Permissions for Editing Author UUID and Verified

Here are tables summarizing the different permissions required for different operations. Note that it is not possible to edit the author UUID without considering verification status.

Editing Verified Only

	Verify	Unverify
Owned by user	/entry/verified/self/edit/verify	/entry/verified/self/edit/unverify
Owned by anyone	/entry/verified/anyone/edit/verify	/entry/verified/anyone/edit/unverify

The following table assumes useless edits (eg. explicitly unverifying an unverified entry) are stripped from the request before being sent.

Editing Author UUID and Verified

			To
			Owned by user		Owned by anyone
			Verified	Unverified	Verified	Unverified
From	Owned by user	Verified		/entry/verified/self/edit/unverify	/entry/author/self/uuid /entry/verified/anyone/edit/verify	/entry/author/self/uuid /entry/verified/self/edit/unverify
		Unverified	/entry/verified/self/edit/verify		/entry/author/self/uuid /entry/verified/anyone/edit/verify	/entry/author/self/uuid
	Owned by anyone	Verified	/entry/author/anyone/uuid (/entry/verified/anyone/edit/verify OR /entry/verified/anyone/edit/unverify /entry/verified/self/edit/verify)	/entry/author/anyone/uuid (/entry/verified/anyone/edit/unverify OR /entry/verified/anyone/edit/verify /entry/verified/self/edit/unverify)	/entry/author/anyone/uuid /entry/verified/anyone/edit/verify	/entry/author/anyone/uuid /entry/verified/anyone/edit/unverify
		Unverified	/entry/author/anyone/uuid /entry/verified/self/edit/verify	/entry/author/anyone/uuid	/entry/author/anyone/uuid /entry/verified/anyone/edit/verify	/entry/author/anyone/uuid

Default Roles

Note that roles do not start with a slash, while permissions do.

Role	Permissions
admin	/
contributor_anyone	/connect /config/list /entry/anyone /entry/author/anyone /entry/verified/self/add/verify /entry/verified/self/edit/verify /entry/verified/anyone/add/unverify /entry/verified/anyone/edit/unverify /tag/get /tag/list /tag/anyone
contributor_self	/connect /config/list /entry/self /entry/author/self/username /entry/verified/self/add/verify /entry/verified/self/edit/verify /tag/get /tag/list /tag/self
viewer_anyone	/connect /config/list /entry/anyone/get /entry/anyone/export /entry/anyone/list /tag/get /tag/list /tag/anyone/filter
viewer_self	/connect /config/list /config/self/get /config/self/export /config/self/list /tag/get /tag/list /tag/self/filter

Permission Matchers

There are several different ways to refer to permission(s):

• /tag/remove (permission): Selects only the permission /tag/remove
• /config or /config/ (permission group): Selects all permissions starting with /config/
• viewer_self (role): Selects all permissions assigned to the role viewer_self (see above)

Recommended Role Configurations

Server Purpose	Granted Roles
Personal (not accessible from the internet)	Anyone: admin
Public Sharing	Anyone: viewer_anyone, contributor_self Maintainers: contributor_anyone Owner: admin
Public Curated Collection	Anyone: viewer_anyone Maintainers: contributor_anyone Owner: admin
Private Collections	Anyone: contributor_self Owner: admin
Archive	Anyone: viewer_anyone