v1.9.0: Per-endpoint permission documentation
Every operation in the API reference states which roles may call it, derived at generation time from the permission maps the server enforces at runtime.
Full notes: 1.9.0 on GitHub.
Where to see it
- docs.snapcd.io/api-reference — each operation carries a "Required permissions" block listing the roles that may call it. Static, and readable without an account.
/ApiReferencein your own dashboard — the same reference, interactive: try-it runs against your organization./RoleCapabilitiesin the dashboard — the same catalogue browsed the other way round: pick a role, see everything it can do.- The OpenAPI document — an
x-snapcd-permissionsextension (verb,anyOf,reverseInheritedAnyOf,notes) for tooling that needs it machine-readable.
Coverage is enforced rather than aspirational: an operation that is neither documented nor explicitly skipped fails the generator, so an endpoint cannot ship without a permissions answer. The handful of skips are endpoints whose authorization is not role-map-shaped — the Terraform state backend authenticating over HTTP Basic, session helpers, per-user rows — and each states what governs it instead.
How it is derived
PermissionDocExtractor resolves each controller action to the secured repository that enforces it and the verb-specific map to read — convention-first, with [PermissionSource] as an explicit override. It runs as pure reflection off uninitialised instances, with no DI and no database, so the live server and the headless generator emit identically.
Enforcement fixes surfaced by the unification
- Corrected parenthesisation in the run-job role check
- Added missing authorization on MissionRun cancel and rerun
- Aligned StackContributor and StackReader across the stack subtree
- Unified role-assignment repositories on
{Owner, IdentityAccessManager}for all verbs - Granted Agent, Runner and Integration scoped roles on the resource itself
- Removed dead scoped role values
Breaking change
Contributor no longer grants the ability to manage role assignments.
Intelligent GitOps for Infrastructure as Code. Automate, orchestrate, and scale your infrastructure deployments with confidence.
© 2026 Snap CD. All rights reserved.