YouTrack Server
 
2019.2
Get YouTrack Standalone
You are viewing the documentation for an earlier version of YouTrack Server. View this page in the current documentation
  1. Administration
  2. Access Management
  3. Roles
  4. Hub Permissions

Hub Permissions

Last modified: 17 December 2019

A permission is an authorization granted to a user to perform particular operations. Permissions are granted to a user within a role, but not directly.

A role is a set of permissions which defines the level of access for a user to particular functionality and operations.

Permissions that let users perform administrative operations in YouTrack are provided by the Hub service. Permissions for the Hub service are divided in two categories:

  • Global permissions are granted at the global scope and do not depend on a specific project. For example, you cannot grant permission to create user accounts in a single project, you can do it only in the system-wide scope. Global permissions are marked with a global badge in the list of permissions.

  • Per-project permissions allow actions related to a specific project. For example, a role with the Read Project Basic permission grants users and groups access to view project properties and content for a specific project. If these users don't have the Read Project Basic permission for other projects in YouTrack, they don't have access to them.

The permissions that are listed on this page are used by the built-in Hub service to regulate access to administrative actions. For a list of permissions that grant access to work with the entities that are managed in the YouTrack service, see YouTrack Permissions.

Generic Permissions

The following permissions are not related to specific entities in the system. These permissions are available at the global level.

Permission

Description

Low-level Admin Read

Read-only access to low-level administrative settings. Includes permission to view integrations with third-party services and metrics.

Low-level Admin Write

Manage low-level administrative actions. Includes permission to integrate with third-party services and back up the database. Implies Low-level Admin Read.

Group-related Permissions

The following permissions grant access to group-related actions. Groups are used as resources in a project. These permissions are all available at the per-project level.

Permission

Description

Create Group

Create new groups.

Delete Group

Delete groups.

Implies Read Group.

Read Group

View the list of groups and read group properties. When combined with other permissions, the following access rights are granted:

  • With permission to read both parent and child groups, view subgroups.

  • With Read User Basic, view the list of members.

Update Group

Edit group properties. When combined with other permissions, the following access rights are granted:

  • With permission to update both parent and child groups, manage subgroups.

  • With Read User Basic, update group memberships.

Implies Read Group.

Project-related Permissions

The following permissions grant access to project-related actions.

  • The Create Project permission is granted at the global level.

  • All other project-related permissions are granted on a per-project basis.

Permission

Description

Create Project

Create new projects.

Delete Project

Delete projects.

Implies Read Project Full.

Read Project Basic

View basic project properties and content. When combined with other permissions, the following access rights are granted:

  • With Read User Basic, users can view the list of users who are members of the project team.

  • With Read Service, users can view the list of resources for a project. The list of resources in the project is also available to members of groups who are granted access in the settings for the service.

Basic project properties include the name, description, logo, and project owner.

Read Project Full

View all project properties and content. When combined with other permissions, the following access rights are granted:

  • With Read Role, users can view roles that are granted to the project team and the roles that are assigned to other users and groups in the project.

  • With Read Service, users can view the list of resources for a project. The list of resources in the project is also available to members of groups who are granted access in the settings for the service.

Implies Read Project Basic.

Update Project

Edit project properties and content, manage resources.

Implies Read Project Full.

Role-related Permissions

The following permissions grant access to role-related actions. These permissions are all available at the global level.

Permission

Description

Create Role

Create new roles.

Delete Role

Delete roles.

Implies Read Role.

Read Role

View the list of roles and the set of permissions that are assigned to each role. When combined with other permissions, the following access rights are granted:

  • With Read Project Full, users can view roles that are granted to the project team and the roles that are assigned to other users and groups in the project.

  • With Read Service, users can view the set of permissions that are provided by the service. The list of permissions is also available to members of groups who are granted access in the settings for the service.

Update Role

Edit role properties. Modify the set of permissions that are assigned to a role.

Implies Read Role.

Service-related Permissions

The following permissions grant access to service-related actions. These permissions are all available at the global level.

Permission

Description

Create Service

Register new services.

Delete Service

Delete services.

Implies Read Service.

Read Service

View the list of services and read service properties. View service resources, permissions, and default roles.

Update Service

Edit service properties. Create, update, or delete resources, permissions, and default roles.

Implies Read Service.

User-related Permissions

The following permissions grant access to user-related actions. These permissions all available at the global level.

Permission

Description

Create User

Create new user accounts. Invite users to register their own accounts.

Delete User

Delete user accounts.

Implies Read User Full.

Read Self

View all properties, including authorization details for the user who is currently logged in.

Read User Basic

View the list of registered users and read the ID, login, name, and avatar for each user. With Update Group, users can manage group memberships.

Read User Full

View all properties for all registered users, including authorization details.

Implies Read Self and Read User Basic.

Update Self

Edit own profile data.

Implies Read Self.

Update User

Edit user profile data. Ban, merge, and anonymize user accounts.

Implies Update Self and Read User Full.