Where do I see which permission an endpoint requires?

On the endpoint's page in the Applivery API reference, under Required Permission. The same permission appears in the tables on this page.

Which role can call every endpoint?

Only the Owner. It has every action, including billing and ownership actions that no other role includes.

Can a Device Management role use App Distribution endpoints?

Only in one case: the Device Management Viewer includes mad.application.management.actions. Otherwise, Device Management roles cover Device Management and some Workspace actions, and App Distribution has its own roles.

What's the difference between App Distribution Admin and App Admin?

App Distribution Admin applies to the whole Workspace, while App Admin applies to a single App. An App Owner gets the same actions as an App Admin.

What happens if a Collaborator has several roles?

The actions add up. For example, a Workspace role and an App role give the Collaborator the actions of both.

Do custom roles appear on this page?

No. A custom role includes the actions you select, so check the role in Settings → Directory → Roles. This page covers the built-in roles.

Why do some permissions have no endpoint?

Some actions aren't used by any public API endpoint. They still count in the Actions column of the role.

Permissions by Role in Applivery

Q: What does a permission name mean?

It has four parts, area.context.resource.operation. For example, mdm.apple.depDevice.get lets you get an Apple Business device in Device Management.

Every endpoint of the Applivery API that depends on a role requires one permission, which you'll find as Required Permission on its reference page. Each built-in role includes a fixed set of these permissions, so the role a Collaborator or Service Account has decides which endpoints it can call and which actions it can take in the Dashboard.

Use the summary to compare what each role covers, and the tables by area to check a specific permission or endpoint.

How roles and permissions work

A permission, also called an action, has four parts: area.context.resource.operation. For example, mdm.apple.depDevice.get lets you get an Apple Business device in Device Management. It's the same name you'll see as Required Permission in the API reference.

These are the built-in roles:

Role	Where it applies
Owner	The Workspace owner. Has every action, including billing and ownership. There's only one Owner per Workspace.
Device Management Admin, Editor, and Viewer	The built-in Device Management Collaborator roles, assigned on Segment permissions. Check Custom Collaborator Roles.
App Distribution Admin, Editor, and Viewer	The Workspace-level App Distribution Collaborator roles. Check Roles and Permissions in App Distribution.
App Admin, App Editor, and App Viewer	Roles on a single App in App Distribution. An App Owner gets the same actions as an App Admin.
Unassigned	No access at Workspace level. The Collaborator can still get a role on a specific App.
No Role	The actions applied when the user has no role in the Workspace or the App.

Keep in mind that:

Actions add up. A Collaborator with a Workspace role and an App role gets the actions from both, and permissions add up down the Segment tree in Device Management.
Custom roles include the actions you select, so they don't appear on this page. Owner actions (owner.*) and App Distribution people actions (people.mad.*) can't be part of a custom role.

Endpoints by role

Endpoints counts the API operations a role can call. Actions counts every permission the role includes, including actions that no public endpoint uses. One action can cover several endpoints. The last three columns split the endpoints by area.

Role	Endpoints	Actions	Device Management	App Distribution	Workspace
Owner	584	552	386	108	90
Device Management Admin	472	424	386	0	86
Device Management Editor	297	245	257	0	40
Device Management Viewer	192	142	164	1	27
App Distribution Admin	172	164	0	108	64
App Distribution Editor	101	85	0	65	36
App Distribution Viewer	74	57	0	51	23
App Admin	117	108	0	94	23
App Editor	79	66	0	60	19
App Viewer	62	48	0	43	19
Unassigned	8	5	0	0	8
No Role	9	8	0	1	8

Note

The API has 663 endpoints, and 584 of them require a permission. The rest, such as authentication, don't depend on a Collaborator role.

Permissions by area

Each table lists the permissions of one area, the endpoints that require them, and the roles that include them: ✓ means the role includes the permission and – means it doesn't. An endpoint path is relative to /organizations/:organizationId, and — in Endpoints means no public API endpoint uses that permission.

The role columns use these abbreviations:

Abbreviation	Role
O	Owner
A, E, V	Admin, Editor, and Viewer of Device Management or App Distribution, depending on the tab or table
App A, App E, App V	App Admin, App Editor, and App Viewer

In the Workspace tab, each area has two tables: one for the Device Management roles and one for the App Distribution roles.

A ¹ marks a permission that other roles also include, such as Unassigned or No Role; you'll find them under the table.

Permission	Endpoints	O	A	E	V
`mdm.global.agentLog.get`	`GET /mdm/agent-logs/:mdmAgentLogsId`	✓	✓	✓	✓
`mdm.global.agentLog.list`	`GET /mdm/agent-logs`	✓	✓	✓	✓
`mdm.global.agentLog.remove`	`DELETE /mdm/agent-logs/:mdmAgentLogsId`	✓	✓	✓	✓
`mdm.global.agentLog.view`	—	✓	✓	✓	✓
`mdm.global.asset.create`	`POST /mdm/assets` `POST /mdm/assets/edge/asset` `GET /mdm/assets/edge/prepare`	✓	✓	✓	–
`mdm.global.asset.download`	`GET /mdm/assets/:mdmAssetId/download`	✓	✓	✓	–
`mdm.global.asset.get`	`GET /mdm/assets/:mdmAssetId` `GET /mdm/assets/:mdmAssetId/assignations`	✓	✓	✓	✓
`mdm.global.asset.list`	`GET /mdm/assets`	✓	✓	✓	✓
`mdm.global.asset.remove`	`DELETE /mdm/assets/:mdmAssetId`	✓	✓	✓	–
`mdm.global.asset.update`	`PUT /mdm/assets/:mdmAssetId`	✓	✓	✓	–
`mdm.global.asset.view`	`GET /mdm/assets/:mdmAssetId/view`	✓	✓	✓	✓
`mdm.global.automationRule.create`	`POST /mdm/automation-rules`	✓	✓	✓	–
`mdm.global.automationRule.get`	`GET /mdm/automation-rules/:mdmAutomationRuleId`	✓	✓	✓	✓
`mdm.global.automationRule.list`	`GET /mdm/automation-rules`	✓	✓	✓	✓
`mdm.global.automationRule.remove`	`DELETE /mdm/automation-rules/:mdmAutomationRuleId`	✓	✓	✓	–
`mdm.global.automationRule.update`	`PUT /mdm/automation-rules/:mdmAutomationRuleId`	✓	✓	✓	–
`mdm.global.automationRuleLog.list`	`GET /mdm/automation-rules-logs`	✓	✓	✓	✓
`mdm.global.configurations.get`	`GET /mdm/configurations`	✓	✓	–	–
`mdm.global.configurations.update`	`PUT /mdm/configurations`	✓	✓	–	–
`mdm.global.device.list`	`GET /mdm/devices` `GET /mdm/devices/available-updates` `GET /mdm/devices/csv` `GET /mdm/devices/os-versions` `GET /mdm/devices/sync-errors` `GET /mdm/devices/tags`	✓	✓	✓	✓
`mdm.global.deviceAudience.create`	`POST /mdm/device-audiences`	✓	✓	✓	–
`mdm.global.deviceAudience.download`	—	✓	✓	✓	–
`mdm.global.deviceAudience.get`	`GET /mdm/device-audiences/:deviceAudienceId`	✓	✓	✓	✓
`mdm.global.deviceAudience.list`	`GET /mdm/device-audiences`	✓	✓	✓	✓
`mdm.global.deviceAudience.preview`	`POST /mdm/device-audiences/preview` `POST /mdm/device-audiences/preview-multiple`	✓	✓	✓	✓
`mdm.global.deviceAudience.remove`	`DELETE /mdm/device-audiences/:deviceAudienceId`	✓	✓	✓	–
`mdm.global.deviceAudience.update`	`PUT /mdm/device-audiences/:deviceAudienceId`	✓	✓	✓	–
`mdm.global.deviceAudience.view`	`GET /mdm/device-audiences/:deviceAudienceId/preview`	✓	✓	✓	✓
`mdm.global.deviceMessage.get`	`GET /mdm/device-messages/:deviceMessageId`	✓	✓	✓	✓
`mdm.global.deviceMessage.list`	`GET /mdm/device-messages`	✓	✓	✓	✓
`mdm.global.deviceMessage.upsert`	—	✓	✓	✓	–
`mdm.global.deviceTmv.requestControl`	`POST /mdm/tmv/request-control`	✓	✓	–	–
`mdm.global.location.get`	`GET /mdm/locations/:type/:identifier/:mdmLocationId`	✓	✓	✓	✓
`mdm.global.location.list`	`GET /mdm/locations/:type/:identifier`	✓	✓	✓	✓
`mdm.global.location.remove`	`DELETE /mdm/locations/:type/:identifier/:mdmLocationId`	✓	✓	–	–
`mdm.global.mdmSmartAttribute.update`	—	✓	✓	✓	–
`mdm.global.mdmUser.create`	`POST /mdm/users`	✓	✓	✓	–
`mdm.global.mdmUser.get`	`GET /mdm/users/:mdmUserId`	✓	✓	✓	✓
`mdm.global.mdmUser.list`	`GET /mdm/users` `GET /mdm/users/csv/sample` `GET /mdm/users/tags`	✓	✓	✓	✓
`mdm.global.mdmUser.remove`	`DELETE /mdm/users/:mdmUserId`	✓	✓	–	–
`mdm.global.mdmUser.update`	`PUT /mdm/users/:mdmUserId`	✓	✓	✓	–
`mdm.global.networkStatus.get`	`GET /mdm/network-status/:type/:identifier/:mdmNetworkStatusId`	✓	✓	✓	✓
`mdm.global.networkStatus.list`	`GET /mdm/network-status/:type/:identifier`	✓	✓	✓	✓
`mdm.global.networkStatus.remove`	`DELETE /mdm/network-status/:type/:identifier/:mdmNetworkStatusId`	✓	✓	–	–
`mdm.global.packageTime.get`	`GET /mdm/package-times/:type/:identifier/:mdmPackageTimeId`	✓	✓	✓	✓
`mdm.global.packageTime.list`	`GET /mdm/package-times/:type/:identifier`	✓	✓	✓	✓
`mdm.global.packageTime.remove`	`DELETE /mdm/package-times/:type/:identifier/:mdmPackageTimeId`	✓	✓	–	–
`mdm.global.packageTransfer.get`	`GET /mdm/package-transfers/:type/:identifier/:mdmPackageTransferId`	✓	✓	✓	✓
`mdm.global.packageTransfer.list`	`GET /mdm/package-transfers/:type/:identifier`	✓	✓	✓	✓
`mdm.global.packageTransfer.remove`	`DELETE /mdm/package-transfers/:type/:identifier/:mdmPackageTransferId`	✓	✓	–	–
`mdm.global.policy.list`	`GET /mdm/policies`	✓	✓	✓	✓
`mdm.global.policySync.list`	`GET /mdm/policy-sync`	✓	✓	✓	✓
`mdm.global.policySync.remove`	—	✓	✓	✓	✓
`mdm.global.policyTemplate.create`	—	✓	✓	✓	–
`mdm.global.policyTemplate.get`	—	✓	✓	✓	✓
`mdm.global.policyTemplate.list`	—	✓	✓	✓	✓
`mdm.global.policyTemplate.remove`	—	✓	✓	✓	–
`mdm.global.policyTemplate.update`	—	✓	✓	✓	–
`mdm.global.pushNotification.send`	`POST /mdm/push-notifications/send`	✓	✓	–	–
`mdm.global.smartAttribute.create`	`POST /smart-attributes`	✓	✓	✓	–
`mdm.global.smartAttribute.get`	`GET /smart-attributes/:smartAttributeId` `GET /smart-attributes/:smartAttributeId/assignments`	✓	✓	✓	✓
`mdm.global.smartAttribute.list`	`GET /smart-attributes`	✓	✓	✓	✓
`mdm.global.smartAttribute.remove`	`DELETE /smart-attributes/:smartAttributeId`	✓	✓	✓	–
`mdm.global.smartAttribute.update`	`PUT /smart-attributes/:smartAttributeId`	✓	✓	✓	–
`mdm.global.status.get`	`GET /mdm`	✓	✓	✓	✓
`mdm.global.tenantTmv.read`	—	✓	✓	–	–
`mdm.global.tenantTmv.update`	—	✓	✓	–	–

Permission	Endpoints	O	A	E	V
`mdm.apple.application.create`	`POST /mdm/apple/enterprise/applications`	✓	✓	✓	–
`mdm.apple.application.get`	`GET /mdm/apple/enterprise/applications/:admApplicationId`	✓	✓	✓	✓
`mdm.apple.application.list`	`GET /mdm/apple/enterprise/applications`	✓	✓	✓	✓
`mdm.apple.application.remove`	`DELETE /mdm/apple/enterprise/applications/:admApplicationId`	✓	✓	–	–
`mdm.apple.application.search`	`GET /mdm/apple/enterprise/applications/search`	✓	✓	✓	✓
`mdm.apple.application.update`	`PUT /mdm/apple/enterprise/applications/:admApplicationId`	✓	✓	✓	–
`mdm.apple.command.cancel`	`POST /mdm/apple/enterprise/commands/:targetType/:targetId/:admCommandId/cancel`	✓	✓	–	–
`mdm.apple.command.create`	`POST /mdm/apple/enterprise/commands/:targetType` `POST /mdm/apple/enterprise/commands/:targetType/:targetId`	✓	✓	–	–
`mdm.apple.command.get`	`GET /mdm/apple/enterprise/commands/:targetType/:targetId/:admCommandId`	✓	✓	✓	–
`mdm.apple.command.list`	`GET /mdm/apple/enterprise/commands/:targetType/:targetId` `GET /mdm/apple/enterprise/commands/:targetType/:targetId/grouped`	✓	✓	✓	–
`mdm.apple.defaultDeviceConfig.create`	`POST /mdm/apple/enterprise/default-config`	✓	✓	–	–
`mdm.apple.defaultDeviceConfig.get`	`GET /mdm/apple/enterprise/default-config/:admDefaultDeviceConfigId`	✓	✓	–	–
`mdm.apple.defaultDeviceConfig.list`	`GET /mdm/apple/enterprise/default-config`	✓	✓	–	–
`mdm.apple.defaultDeviceConfig.remove`	`DELETE /mdm/apple/enterprise/default-config/:admDefaultDeviceConfigId`	✓	✓	–	–
`mdm.apple.defaultDeviceConfig.update`	`PUT /mdm/apple/enterprise/default-config/:admDefaultDeviceConfigId`	✓	✓	–	–
`mdm.apple.depDevice.assignProfile`	`POST /mdm/apple/enterprise/dep/devices/:admDepDeviceId/assign-profile`	✓	✓	–	–
`mdm.apple.depDevice.disown`	`POST /mdm/apple/enterprise/dep/devices/:admDepDeviceId/disown`	✓	✓	–	–
`mdm.apple.depDevice.get`	`GET /mdm/apple/enterprise/dep/devices/:admDepDeviceId`	✓	✓	–	–
`mdm.apple.depDevice.list`	`GET /mdm/apple/enterprise/dep/devices`	✓	✓	–	–
`mdm.apple.depDevice.lock`	`POST /mdm/apple/enterprise/dep/devices/:admDepDeviceId/lock`	✓	✓	–	–
`mdm.apple.depDevice.removeProfile`	`DELETE /mdm/apple/enterprise/dep/devices/:admDepDeviceId/remove-profile`	✓	✓	–	–
`mdm.apple.depDevice.sync`	`GET /mdm/apple/enterprise/dep/devices/sync` `GET /mdm/apple/enterprise/dep/devices/sync-all` `GET /mdm/apple/enterprise/dep/devices/sync-transaction` `GET /mdm/apple/enterprise/dep/devices/sync-transaction/:admDepSyncTransactionId`	✓	✓	–	–
`mdm.apple.depDevice.update`	`PUT /mdm/apple/enterprise/dep/devices/:admDepDeviceId`	✓	✓	–	–
`mdm.apple.depProfile.create`	`POST /mdm/apple/enterprise/dep/profiles`	✓	✓	–	–
`mdm.apple.depProfile.get`	`GET /mdm/apple/enterprise/dep/profiles/:admDepProfileId`	✓	✓	–	–
`mdm.apple.depProfile.list`	`GET /mdm/apple/enterprise/dep/profiles`	✓	✓	–	–
`mdm.apple.depProfile.remove`	`DELETE /mdm/apple/enterprise/dep/profiles/:admDepProfileId`	✓	✓	–	–
`mdm.apple.device.action`	`POST /mdm/apple/enterprise/devices/:admDeviceId/action` `GET /mdm/apple/enterprise/devices/:admDeviceId/agent-cleanup` `GET /mdm/apple/enterprise/devices/:admDeviceId/agent-recovery` `GET /mdm/apple/enterprise/devices/:admDeviceId/agent-recovery-managed-configuration` `GET /mdm/apple/enterprise/devices/:admDeviceId/setup-assistant-recovery-managed-configuration`	✓	✓	–	–
`mdm.apple.device.create`	—	✓	✓	–	–
`mdm.apple.device.get`	`GET /mdm/apple/enterprise/devices/:admDeviceId` `GET /mdm/apple/enterprise/devices/:admDeviceId/agent-config` `GET /mdm/apple/enterprise/devices/:admDeviceId/agent-config-assets` `GET /mdm/apple/enterprise/devices/:admDeviceId/agent-config-assets-setup` `GET /mdm/apple/enterprise/devices/:admDeviceId/agent-tokens` `GET /mdm/apple/enterprise/devices/:admDeviceId/applications` `GET /mdm/apple/enterprise/devices/:admDeviceId/scheduler-scripts`	✓	✓	✓	✓
`mdm.apple.device.getActivationLockBypassCode`	`GET /mdm/apple/enterprise/devices/:admDeviceId/activation-lock-bypass-code`	✓	✓	–	–
`mdm.apple.device.getFileVaultRecoveryKey`	`GET /mdm/apple/enterprise/devices/:admDeviceId/file-vault-recovery-key`	✓	✓	–	–
`mdm.apple.device.list`	`GET /mdm/apple/enterprise/devices`	✓	✓	✓	✓
`mdm.apple.device.move`	`PUT /mdm/apple/enterprise/devices/:admDeviceId/move`	✓	✓	–	–
`mdm.apple.device.notify`	`GET /mdm/apple/enterprise/devices/:admDeviceId/check-notify` `GET /mdm/apple/enterprise/devices/:admDeviceId/notify`	✓	✓	✓	–
`mdm.apple.device.refresh`	`GET /mdm/apple/enterprise/devices/:admDeviceId/refresh`	✓	✓	✓	–
`mdm.apple.device.reinstall`	`GET /mdm/apple/enterprise/devices/:admDeviceId/reinstall`	✓	✓	–	–
`mdm.apple.device.remove`	`DELETE /mdm/apple/enterprise/devices/:admDeviceId`	✓	✓	–	–
`mdm.apple.device.sync`	`GET /mdm/apple/enterprise/devices/:admDeviceId/sync`	✓	✓	✓	–
`mdm.apple.device.unlock`	`GET /mdm/apple/enterprise/devices/:admDeviceId/unlock`	✓	✓	–	–
`mdm.apple.device.update`	`PUT /mdm/apple/enterprise/devices/:admDeviceId`	✓	✓	✓	–
`mdm.apple.deviceNotification.action`	`POST /mdm/apple/enterprise/devices/:admDeviceId/notifications`	✓	✓	–	–
`mdm.apple.deviceScriptLog.get`	`GET /mdm/apple/enterprise/devices/:admDeviceId/script-logs/:admDeviceScriptLogId`	✓	✓	✓	✓
`mdm.apple.deviceScriptLog.invalidate`	`POST /mdm/apple/enterprise/devices/:admDeviceId/script-logs/:admDeviceScriptLogId/invalidate` `POST /mdm/apple/enterprise/devices/:admDeviceId/script-logs/invalidate-once`	✓	✓	✓	✓
`mdm.apple.deviceScriptLog.list`	`GET /mdm/apple/enterprise/devices/:admDeviceId/script-logs` `GET /mdm/apple/enterprise/devices/:admDeviceId/script-logs/summary`	✓	✓	✓	✓
`mdm.apple.deviceUser.get`	`GET /mdm/apple/enterprise/devices/:admDeviceId/users/:admDeviceUserId` `GET /mdm/apple/enterprise/devices/:admDeviceId/users/:admDeviceUserId/applications`	✓	✓	✓	✓
`mdm.apple.deviceUser.list`	`GET /mdm/apple/enterprise/devices/:admDeviceId/users`	✓	✓	✓	✓
`mdm.apple.deviceUser.notify`	`GET /mdm/apple/enterprise/devices/:admDeviceId/users/:admDeviceUserId/notify`	✓	✓	✓	–
`mdm.apple.deviceUser.refresh`	`GET /mdm/apple/enterprise/devices/:admDeviceId/users/:admDeviceUserId/refresh`	✓	✓	✓	–
`mdm.apple.deviceUser.remove`	—	✓	✓	–	–
`mdm.apple.deviceUser.sync`	`GET /mdm/apple/enterprise/devices/:admDeviceId/users/:admDeviceUserId/sync`	✓	✓	✓	–
`mdm.apple.deviceUser.update`	`PUT /mdm/apple/enterprise/devices/:admDeviceId/users/:admDeviceUserId`	✓	✓	–	–
`mdm.apple.enrollmentTemplate.create`	`POST /mdm/apple/enterprise/enrollment-templates`	✓	✓	✓	–
`mdm.apple.enrollmentTemplate.get`	`GET /mdm/apple/enterprise/enrollment-templates/:admEnrollmentTemplateId` `GET /mdm/apple/enterprise/enrollment-templates/:admEnrollmentTemplateId/assignations`	✓	✓	✓	✓
`mdm.apple.enrollmentTemplate.list`	`GET /mdm/apple/enterprise/enrollment-templates`	✓	✓	✓	✓
`mdm.apple.enrollmentTemplate.remove`	`DELETE /mdm/apple/enterprise/enrollment-templates/:admEnrollmentTemplateId`	✓	✓	–	–
`mdm.apple.enrollmentTemplate.templates`	—	✓	✓	–	–
`mdm.apple.enrollmentTemplate.update`	`PUT /mdm/apple/enterprise/enrollment-templates/:admEnrollmentTemplateId`	✓	✓	✓	–
`mdm.apple.enrollmentToken.create`	`POST /mdm/apple/enterprise/enrollment-tokens` `POST /mdm/apple/enterprise/enrollment-tokens/bulk`	✓	✓	–	–
`mdm.apple.enrollmentToken.get`	`GET /mdm/apple/enterprise/enrollment-tokens/:admEnrollmentTokenId`	✓	✓	✓	✓
`mdm.apple.enrollmentToken.list`	`GET /mdm/apple/enterprise/enrollment-tokens`	✓	✓	✓	✓
`mdm.apple.enrollmentToken.remove`	`DELETE /mdm/apple/enterprise/enrollment-tokens/:admEnrollmentTokenId`	✓	✓	–	–
`mdm.apple.enrollmentToken.update`	`PUT /mdm/apple/enterprise/enrollment-tokens/:admEnrollmentTokenId`	✓	✓	✓	–
`mdm.apple.enterprise.applepush`	—	✓	✓	–	–
`mdm.apple.enterprise.create`	`POST /mdm/apple/enterprise`	✓	✓	–	–
`mdm.apple.enterprise.get`	`GET /mdm/apple/enterprise`	✓	✓	✓	✓
`mdm.apple.enterprise.reinstallDevices`	`GET /mdm/apple/enterprise/reinstall-devices`	✓	✓	–	–
`mdm.apple.enterprise.search`	`GET /mdm/apple/enterprise/search` `POST /mdm/apple/enterprise/search-bundle-ids`	✓	✓	✓	✓
`mdm.apple.enterprise.update`	`PUT /mdm/apple/enterprise` `PUT /mdm/apple/enterprise/dep`	✓	✓	–	–
`mdm.apple.enterprise.uploadIdentity`	—	✓	✓	–	–
`mdm.apple.policy.composition`	`POST /mdm/apple/enterprise/policies/composition`	✓	✓	✓	✓
`mdm.apple.policy.create`	`POST /mdm/apple/enterprise/policies`	✓	✓	✓	–
`mdm.apple.policy.get`	`GET /mdm/apple/enterprise/policies/:admPolicyId` `GET /mdm/apple/enterprise/policies/:admPolicyId/agent-config` `GET /mdm/apple/enterprise/policies/:admPolicyId/assignations` `GET /mdm/apple/enterprise/policies/:admPolicyId/provisioning-profiles/:UUID`	✓	✓	✓	✓
`mdm.apple.policy.list`	`GET /mdm/apple/enterprise/policies`	✓	✓	✓	✓
`mdm.apple.policy.remove`	`DELETE /mdm/apple/enterprise/policies/:admPolicyId`	✓	✓	–	–
`mdm.apple.policy.templates`	`GET /mdm/apple/enterprise/policies/templates` `GET /mdm/apple/enterprise/policies/templates/:templateId`	✓	✓	–	–
`mdm.apple.policy.update`	`PUT /mdm/apple/enterprise/policies/:admPolicyId`	✓	✓	✓	–
`mdm.apple.profile.create`	`POST /mdm/apple/enterprise/profiles`	✓	✓	–	–
`mdm.apple.profile.get`	`GET /mdm/apple/enterprise/profiles/:admProfileId`	✓	✓	✓	✓
`mdm.apple.profile.list`	`GET /mdm/apple/enterprise/profiles`	✓	✓	✓	✓
`mdm.apple.profile.remove`	`DELETE /mdm/apple/enterprise/profiles/:admProfileId`	✓	✓	–	–
`mdm.apple.profile.update`	`PUT /mdm/apple/enterprise/profiles/:admProfileId`	✓	✓	–	–
`mdm.apple.router.get`	`GET /mdm/apple/enterprise/router/:admRouterId`	✓	✓	✓	✓
`mdm.apple.router.list`	`GET /mdm/apple/enterprise/router`	✓	✓	✓	✓
`mdm.apple.syncHistory.list`	`GET /mdm/apple/enterprise/sync-history/:targetType/:targetId`	✓	✓	✓	✓
`mdm.apple.vppAsset.assignments`	`GET /mdm/apple/enterprise/vpp/locations/:admVppLocationId/assets/assignments`	✓	✓	✓	–
`mdm.apple.vppAsset.associate`	`POST /mdm/apple/enterprise/vpp/locations/:admVppLocationId/assets/associate`	✓	✓	✓	–
`mdm.apple.vppAsset.disassociate`	`POST /mdm/apple/enterprise/vpp/locations/:admVppLocationId/assets/disassociate`	✓	✓	✓	–
`mdm.apple.vppAsset.list`	`GET /mdm/apple/enterprise/vpp/locations/:admVppLocationId/assets`	✓	✓	✓	–
`mdm.apple.vppAsset.revoke`	`POST /mdm/apple/enterprise/vpp/locations/:admVppLocationId/assets/revoke`	✓	✓	✓	–
`mdm.apple.vppEvent.check`	`GET /mdm/apple/enterprise/vpp/locations/:admVppLocationId/events/check/:eventId`	✓	✓	✓	–
`mdm.apple.vppLocation.create`	`POST /mdm/apple/enterprise/vpp/locations`	✓	✓	–	–
`mdm.apple.vppLocation.get`	`GET /mdm/apple/enterprise/vpp/locations/:admVppLocationId`	✓	✓	✓	–
`mdm.apple.vppLocation.list`	`GET /mdm/apple/enterprise/vpp/locations`	✓	✓	✓	–
`mdm.apple.vppLocation.remove`	`DELETE /mdm/apple/enterprise/vpp/locations/:admVppLocationId`	✓	✓	–	–
`mdm.apple.vppLocation.update`	—	✓	✓	–	–
`mdm.apple.vppUser.create`	`POST /mdm/apple/enterprise/vpp/locations/:admVppLocationId/users`	✓	✓	✓	–
`mdm.apple.vppUser.get`	—	✓	✓	✓	–
`mdm.apple.vppUser.list`	`GET /mdm/apple/enterprise/vpp/locations/:admVppLocationId/users` `GET /mdm/apple/enterprise/vpp/locations/:admVppLocationId/users/all`	✓	✓	✓	–
`mdm.apple.vppUser.retire`	`DELETE /mdm/apple/enterprise/vpp/locations/:admVppLocationId/users/:mdmUserId`	✓	✓	✓	–
`mdm.apple.vppUser.update`	—	✓	✓	✓	–

Permission	Endpoints	O	A	E	V
`mdm.android.application.create`	`POST /mdm/android/enterprise/applications/emm-application`	✓	✓	✓	–
`mdm.android.application.get`	`GET /mdm/android/enterprise/applications/emm-application/:emmApplicationId`	✓	✓	✓	✓
`mdm.android.application.getApplication`	`GET /mdm/android/enterprise/applications/:applicationName`	✓	✓	✓	✓
`mdm.android.application.list`	`GET /mdm/android/enterprise/applications/emm-application`	✓	✓	✓	✓
`mdm.android.application.remove`	`DELETE /mdm/android/enterprise/applications/emm-application/:emmApplicationId`	✓	✓	–	–
`mdm.android.application.update`	`PUT /mdm/android/enterprise/applications/emm-application/:emmApplicationId`	✓	✓	✓	–
`mdm.android.certificateReport.get`	`GET /mdm/android/enterprise/devices/:emmDeviceId/certificate-reports/history/:historyId`	✓	✓	✓	✓
`mdm.android.certificateReport.list`	`GET /mdm/android/enterprise/devices/:emmDeviceId/certificate-reports/history`	✓	✓	✓	✓
`mdm.android.certificateReport.reset`	`POST /mdm/android/enterprise/devices/:emmDeviceId/certificate-reports/reset`	✓	✓	–	–
`mdm.android.command.cancel`	`POST /mdm/android/enterprise/devices/:emmDeviceId/commands/:emmCommandId/cancel`	✓	✓	–	–
`mdm.android.command.create`	`POST /mdm/android/enterprise/devices/:emmDeviceId/commands`	✓	✓	–	–
`mdm.android.command.get`	`GET /mdm/android/enterprise/devices/:emmDeviceId/commands/:emmCommandId`	✓	✓	✓	–
`mdm.android.command.list`	`GET /mdm/android/enterprise/devices/:emmDeviceId/commands`	✓	✓	✓	–
`mdm.android.device.action`	`POST /mdm/android/enterprise/devices/:emmDeviceId/action`	✓	✓	–	–
`mdm.android.device.create`	—	✓	✓	–	–
`mdm.android.device.emmCommandBulk`	`POST /mdm/android/enterprise/devices/commands`	✓	✓	–	–
`mdm.android.device.get`	`GET /mdm/android/enterprise/devices/:emmDeviceId` `GET /mdm/android/enterprise/devices/:emmDeviceId/agent-config` `GET /mdm/android/enterprise/devices/:emmDeviceId/agent-config-assets` `GET /mdm/android/enterprise/devices/:emmDeviceId/agent-tokens` `GET /mdm/android/enterprise/devices/:emmDeviceId/applications` `GET /mdm/android/enterprise/devices/:emmDeviceId/events` `GET /mdm/android/enterprise/devices/:emmDeviceId/launcher-config`	✓	✓	✓	✓
`mdm.android.device.list`	`GET /mdm/android/enterprise/devices`	✓	✓	✓	✓
`mdm.android.device.move`	`PUT /mdm/android/enterprise/devices/:emmDeviceId/move`	✓	✓	–	–
`mdm.android.device.remove`	`DELETE /mdm/android/enterprise/devices/:emmDeviceId`	✓	✓	–	–
`mdm.android.device.sync`	`GET /mdm/android/enterprise/devices/:emmDeviceId/sync`	✓	✓	✓	–
`mdm.android.device.update`	`PUT /mdm/android/enterprise/devices/:emmDeviceId`	✓	✓	✓	–
`mdm.android.deviceNotification.action`	`POST /mdm/android/enterprise/devices/:emmDeviceId/notifications`	✓	✓	–	–
`mdm.android.directProvisioning.create`	`POST /mdm/android/enterprise/enrollment-templates/:emmEnrollmentTemplateId/direct-provisioning`	✓	✓	✓	–
`mdm.android.directProvisioning.get`	`GET /mdm/android/enterprise/enrollment-templates/:emmEnrollmentTemplateId/direct-provisioning/:emmDirectProvisioningId`	✓	✓	✓	✓
`mdm.android.directProvisioning.list`	`GET /mdm/android/enterprise/enrollment-templates/:emmEnrollmentTemplateId/direct-provisioning`	✓	✓	✓	✓
`mdm.android.directProvisioning.remove`	`DELETE /mdm/android/enterprise/enrollment-templates/:emmEnrollmentTemplateId/direct-provisioning/:emmDirectProvisioningId`	✓	✓	–	–
`mdm.android.directProvisioning.update`	`PUT /mdm/android/enterprise/enrollment-templates/:emmEnrollmentTemplateId/direct-provisioning/:emmDirectProvisioningId`	✓	✓	✓	–
`mdm.android.enrollmentTemplate.create`	`POST /mdm/android/enterprise/enrollment-templates` `POST /mdm/android/enterprise/enrollment-templates/:emmEnrollmentTemplateId/notify`	✓	✓	✓	–
`mdm.android.enrollmentTemplate.get`	`GET /mdm/android/enterprise/enrollment-templates/:emmEnrollmentTemplateId`	✓	✓	✓	✓
`mdm.android.enrollmentTemplate.list`	`GET /mdm/android/enterprise/enrollment-templates`	✓	✓	✓	✓
`mdm.android.enrollmentTemplate.remove`	`DELETE /mdm/android/enterprise/enrollment-templates/:emmEnrollmentTemplateId`	✓	✓	–	–
`mdm.android.enrollmentTemplate.templates`	—	✓	✓	–	–
`mdm.android.enrollmentTemplate.update`	`PUT /mdm/android/enterprise/enrollment-templates/:emmEnrollmentTemplateId` `POST /mdm/android/enterprise/enrollment-templates/:emmEnrollmentTemplateId/default-managed-domain`	✓	✓	✓	–
`mdm.android.enrollmentToken.create`	`POST /mdm/android/enterprise/enrollment-tokens` `POST /mdm/android/enterprise/enrollment-tokens/bulk`	✓	✓	–	–
`mdm.android.enrollmentToken.get`	`GET /mdm/android/enterprise/enrollment-tokens/:emmEnrollmentTokenId`	✓	✓	✓	✓
`mdm.android.enrollmentToken.list`	`GET /mdm/android/enterprise/enrollment-tokens`	✓	✓	✓	✓
`mdm.android.enrollmentToken.remove`	`DELETE /mdm/android/enterprise/enrollment-tokens/:emmEnrollmentTokenId`	✓	✓	–	–
`mdm.android.enrollmentToken.update`	`PUT /mdm/android/enterprise/enrollment-tokens/:emmEnrollmentTokenId`	✓	✓	✓	–
`mdm.android.enterprise.create`	`POST /mdm/android/enterprise`	✓	✓	–	–
`mdm.android.enterprise.generateEnterpriseUpgradeUrl`	`POST /mdm/android/enterprise/upgrade-url`	✓	✓	–	–
`mdm.android.enterprise.generateWebToken`	`POST /mdm/android/enterprise/web-token`	✓	✓	–	–
`mdm.android.enterprise.getByOrganization`	`GET /mdm/android/enterprise`	✓	✓	–	–
`mdm.android.enterprise.remove`	`DELETE /mdm/android/enterprise`	✓	✓	–	–
`mdm.android.enterprise.signupUrlsCreate`	`POST /mdm/android/enterprise/signup-url`	✓	✓	–	–
`mdm.android.enterprise.sync`	`GET /mdm/android/enterprise/sync`	✓	✓	–	–
`mdm.android.enterprise.update`	`PUT /mdm/android/enterprise`	✓	✓	–	–
`mdm.android.package.get`	`GET /mdm/android/enterprise/packages/:packageName`	✓	✓	✓	✓
`mdm.android.policy.composition`	`POST /mdm/android/enterprise/policies/composition`	✓	✓	✓	✓
`mdm.android.policy.create`	`POST /mdm/android/enterprise/policies`	✓	✓	✓	–
`mdm.android.policy.get`	`GET /mdm/android/enterprise/policies/:emmPolicyId` `GET /mdm/android/enterprise/policies/:emmPolicyId/agent-config` `GET /mdm/android/enterprise/policies/:emmPolicyId/assignations`	✓	✓	✓	✓
`mdm.android.policy.list`	`GET /mdm/android/enterprise/policies`	✓	✓	✓	✓
`mdm.android.policy.remove`	`DELETE /mdm/android/enterprise/policies/:emmPolicyId`	✓	✓	–	–
`mdm.android.policy.templates`	`GET /mdm/android/enterprise/policies/templates` `GET /mdm/android/enterprise/policies/templates/:templateId`	✓	✓	–	–
`mdm.android.policy.update`	`PUT /mdm/android/enterprise/policies/:emmPolicyId`	✓	✓	✓	–
`mdm.android.webApp.create`	`POST /mdm/android/enterprise/web-apps`	✓	✓	✓	–
`mdm.android.webApp.get`	`GET /mdm/android/enterprise/web-apps/:emmWebAppId`	✓	✓	✓	✓
`mdm.android.webApp.list`	`GET /mdm/android/enterprise/web-apps`	✓	✓	✓	✓
`mdm.android.webApp.remove`	`DELETE /mdm/android/enterprise/web-apps/:emmWebAppId`	✓	✓	–	–
`mdm.android.webApp.update`	`PUT /mdm/android/enterprise/web-apps/:emmWebAppId`	✓	✓	✓	–

Permission	Endpoints	O	A	E	V
`mdm.aosp.application.create`	`POST /mdm/aosp/enterprise/applications`	✓	✓	✓	–
`mdm.aosp.application.get`	`GET /mdm/aosp/enterprise/applications/:aosApplicationId`	✓	✓	✓	✓
`mdm.aosp.application.list`	`GET /mdm/aosp/enterprise/applications`	✓	✓	✓	✓
`mdm.aosp.application.remove`	`DELETE /mdm/aosp/enterprise/applications/:aosApplicationId`	✓	✓	–	–
`mdm.aosp.application.update`	`PUT /mdm/aosp/enterprise/applications/:aosApplicationId`	✓	✓	✓	–
`mdm.aosp.command.cancel`	`POST /mdm/aosp/enterprise/devices/:aosDeviceId/commands/:aosCommandId/cancel`	✓	✓	–	–
`mdm.aosp.command.create`	`POST /mdm/aosp/enterprise/devices/:aosDeviceId/commands`	✓	✓	–	–
`mdm.aosp.command.get`	`GET /mdm/aosp/enterprise/devices/:aosDeviceId/commands/:aosCommandId` `GET /mdm/aosp/enterprise/devices/:aosDeviceId/commands/:aosCommandId/push-status`	✓	✓	✓	–
`mdm.aosp.command.list`	`GET /mdm/aosp/enterprise/devices/:aosDeviceId/commands`	✓	✓	✓	–
`mdm.aosp.device.get`	`GET /mdm/aosp/enterprise/devices/:aosDeviceId` `GET /mdm/aosp/enterprise/devices/:aosDeviceId/agent-config` `GET /mdm/aosp/enterprise/devices/:aosDeviceId/agent-config-assets` `GET /mdm/aosp/enterprise/devices/:aosDeviceId/applications`	✓	✓	✓	✓
`mdm.aosp.device.list`	`GET /mdm/aosp/enterprise/devices`	✓	✓	✓	✓
`mdm.aosp.device.move`	`PUT /mdm/aosp/enterprise/devices/:aosDeviceId/move`	✓	✓	–	–
`mdm.aosp.device.remove`	`DELETE /mdm/aosp/enterprise/devices/:aosDeviceId`	✓	✓	–	–
`mdm.aosp.device.update`	`PUT /mdm/aosp/enterprise/devices/:aosDeviceId` `POST /mdm/aosp/enterprise/devices/:aosDeviceId/check-update` `POST /mdm/aosp/enterprise/devices/:aosDeviceId/report-status` `POST /mdm/aosp/enterprise/devices/:aosDeviceId/send-logs`	✓	✓	✓	–
`mdm.aosp.enrollmentTemplate.create`	`POST /mdm/aosp/enterprise/enrollment-templates`	✓	✓	✓	–
`mdm.aosp.enrollmentTemplate.get`	`GET /mdm/aosp/enterprise/enrollment-templates/:aosEnrollmentTemplateId`	✓	✓	✓	✓
`mdm.aosp.enrollmentTemplate.list`	`GET /mdm/aosp/enterprise/enrollment-templates`	✓	✓	✓	✓
`mdm.aosp.enrollmentTemplate.remove`	`DELETE /mdm/aosp/enterprise/enrollment-templates/:aosEnrollmentTemplateId`	✓	✓	–	–
`mdm.aosp.enrollmentTemplate.update`	`PUT /mdm/aosp/enterprise/enrollment-templates/:aosEnrollmentTemplateId`	✓	✓	✓	–
`mdm.aosp.enrollmentToken.create`	`POST /mdm/aosp/enterprise/enrollment-tokens` `POST /mdm/aosp/enterprise/enrollment-tokens/bulk`	✓	✓	–	–
`mdm.aosp.enrollmentToken.get`	`GET /mdm/aosp/enterprise/enrollment-tokens/:aosEnrollmentTokenId`	✓	✓	✓	✓
`mdm.aosp.enrollmentToken.list`	`GET /mdm/aosp/enterprise/enrollment-tokens` `GET /mdm/aosp/enterprise/enrollment-tokens/dpc-build-tags`	✓	✓	✓	✓
`mdm.aosp.enrollmentToken.remove`	`DELETE /mdm/aosp/enterprise/enrollment-tokens/:aosEnrollmentTokenId`	✓	✓	–	–
`mdm.aosp.enrollmentToken.update`	`PUT /mdm/aosp/enterprise/enrollment-tokens/:aosEnrollmentTokenId`	✓	✓	✓	–
`mdm.aosp.enterprise.create`	`POST /mdm/aosp/enterprise`	✓	✓	–	–
`mdm.aosp.enterprise.get`	`GET /mdm/aosp/enterprise`	✓	✓	–	–
`mdm.aosp.enterprise.remove`	`DELETE /mdm/aosp/enterprise`	✓	✓	–	–
`mdm.aosp.enterprise.update`	`PUT /mdm/aosp/enterprise`	✓	✓	–	–
`mdm.aosp.policy.composition`	`POST /mdm/aosp/enterprise/policies/composition`	✓	✓	✓	✓
`mdm.aosp.policy.create`	`POST /mdm/aosp/enterprise/policies`	✓	✓	✓	–
`mdm.aosp.policy.get`	`GET /mdm/aosp/enterprise/policies/:aosPolicyId` `GET /mdm/aosp/enterprise/policies/:aosPolicyId/agent-config` `GET /mdm/aosp/enterprise/policies/templates/:templateId`	✓	✓	✓	✓
`mdm.aosp.policy.list`	`GET /mdm/aosp/enterprise/policies` `GET /mdm/aosp/enterprise/policies/templates`	✓	✓	✓	✓
`mdm.aosp.policy.remove`	`DELETE /mdm/aosp/enterprise/policies/:aosPolicyId`	✓	✓	–	–
`mdm.aosp.policy.update`	`PUT /mdm/aosp/enterprise/policies/:aosPolicyId`	✓	✓	✓	–

Permission	Endpoints	O	A	E	V
`mdm.windows.admxConfig.create`	`POST /mdm/windows/enterprise/admx-configs`	✓	✓	✓	–
`mdm.windows.admxConfig.get`	`GET /mdm/windows/enterprise/admx-configs/:winAdmxConfigId` `GET /mdm/windows/enterprise/admx-configs/:winAdmxConfigId/assignations`	✓	✓	✓	✓
`mdm.windows.admxConfig.list`	`GET /mdm/windows/enterprise/admx-configs`	✓	✓	✓	✓
`mdm.windows.admxConfig.regenerate`	`GET /mdm/windows/enterprise/admx-configs/:winAdmxConfigId/regenerate`	✓	✓	–	–
`mdm.windows.admxConfig.remove`	`DELETE /mdm/windows/enterprise/admx-configs/:winAdmxConfigId`	✓	✓	–	–
`mdm.windows.admxConfig.update`	—	✓	✓	✓	–
`mdm.windows.application.create`	`POST /mdm/windows/enterprise/applications`	✓	✓	✓	–
`mdm.windows.application.get`	`GET /mdm/windows/enterprise/applications/:winApplicationId`	✓	✓	✓	✓
`mdm.windows.application.list`	`GET /mdm/windows/enterprise/applications`	✓	✓	✓	✓
`mdm.windows.application.remove`	`DELETE /mdm/windows/enterprise/applications/:winApplicationId`	✓	✓	–	–
`mdm.windows.application.search`	`GET /mdm/windows/enterprise/applications/search`	✓	✓	✓	✓
`mdm.windows.application.update`	`PUT /mdm/windows/enterprise/applications/:winApplicationId`	✓	✓	✓	–
`mdm.windows.command.cancel`	`POST /mdm/windows/enterprise/devices/:winDeviceId/commands/:winCommandId/:cmdId/cancel`	✓	✓	–	–
`mdm.windows.command.create`	`POST /mdm/windows/enterprise/devices/:winDeviceId/commands`	✓	✓	–	–
`mdm.windows.command.get`	`GET /mdm/windows/enterprise/devices/:winDeviceId/commands/:winCommandId` `GET /mdm/windows/enterprise/devices/:winDeviceId/commands/:winCommandId/actions`	✓	✓	✓	–
`mdm.windows.command.list`	`GET /mdm/windows/enterprise/devices/:winDeviceId/commands`	✓	✓	✓	–
`mdm.windows.defaultDeviceConfig.create`	`POST /mdm/windows/enterprise/default-config`	✓	✓	–	–
`mdm.windows.defaultDeviceConfig.get`	`GET /mdm/windows/enterprise/default-config/:winDefaultDeviceConfigId`	✓	✓	–	–
`mdm.windows.defaultDeviceConfig.list`	`GET /mdm/windows/enterprise/default-config`	✓	✓	–	–
`mdm.windows.defaultDeviceConfig.remove`	`DELETE /mdm/windows/enterprise/default-config/:winDefaultDeviceConfigId`	✓	✓	–	–
`mdm.windows.defaultDeviceConfig.update`	`PUT /mdm/windows/enterprise/default-config/:winDefaultDeviceConfigId`	✓	✓	–	–
`mdm.windows.device.action`	`POST /mdm/windows/enterprise/devices/:winDeviceId/action`	✓	✓	–	–
`mdm.windows.device.cleanCache`	`POST /mdm/windows/enterprise/devices/:winDeviceId/clean-cache`	✓	✓	–	–
`mdm.windows.device.create`	—	✓	✓	–	–
`mdm.windows.device.get`	`GET /mdm/windows/enterprise/devices/:winDeviceId` `GET /mdm/windows/enterprise/devices/:winDeviceId/agent-config` `GET /mdm/windows/enterprise/devices/:winDeviceId/agent-config-assets` `GET /mdm/windows/enterprise/devices/:winDeviceId/agent-tokens` `GET /mdm/windows/enterprise/devices/:winDeviceId/applications` `GET /mdm/windows/enterprise/devices/:winDeviceId/applications/history` `GET /mdm/windows/enterprise/devices/:winDeviceId/scheduler-scripts`	✓	✓	✓	✓
`mdm.windows.device.getBitlockerRecoveryKey`	`GET /mdm/windows/enterprise/devices/:winDeviceId/bitlocker-recovery-key`	✓	✓	–	–
`mdm.windows.device.info`	`POST /mdm/windows/enterprise/devices/:winDeviceId/info`	✓	✓	✓	✓
`mdm.windows.device.list`	`GET /mdm/windows/enterprise/devices`	✓	✓	✓	✓
`mdm.windows.device.move`	`PUT /mdm/windows/enterprise/devices/:winDeviceId/move`	✓	✓	–	–
`mdm.windows.device.remove`	`DELETE /mdm/windows/enterprise/devices/:winDeviceId`	✓	✓	–	–
`mdm.windows.device.update`	`PUT /mdm/windows/enterprise/devices/:winDeviceId`	✓	✓	✓	–
`mdm.windows.deviceNotification.action`	`POST /mdm/windows/enterprise/devices/:winDeviceId/notifications`	✓	✓	–	–
`mdm.windows.deviceScriptLog.get`	`GET /mdm/windows/enterprise/devices/:winDeviceId/script-logs/:winDeviceScriptLogId`	✓	✓	✓	✓
`mdm.windows.deviceScriptLog.invalidate`	`POST /mdm/windows/enterprise/devices/:winDeviceId/script-logs/:winDeviceScriptLogId/invalidate` `POST /mdm/windows/enterprise/devices/:winDeviceId/script-logs/invalidate-once`	✓	✓	✓	✓
`mdm.windows.deviceScriptLog.list`	`GET /mdm/windows/enterprise/devices/:winDeviceId/script-logs` `GET /mdm/windows/enterprise/devices/:winDeviceId/script-logs/summary`	✓	✓	✓	✓
`mdm.windows.directProvisioning.create`	`POST /mdm/windows/enterprise/enrollment-templates/:winEnrollmentTemplateId/direct-provisionings`	✓	✓	✓	–
`mdm.windows.directProvisioning.get`	`GET /mdm/windows/enterprise/enrollment-templates/:winEnrollmentTemplateId/direct-provisionings/:winDirectProvisioningId`	✓	✓	✓	✓
`mdm.windows.directProvisioning.list`	`GET /mdm/windows/enterprise/enrollment-templates/:winEnrollmentTemplateId/direct-provisionings`	✓	✓	✓	✓
`mdm.windows.directProvisioning.remove`	`DELETE /mdm/windows/enterprise/enrollment-templates/:winEnrollmentTemplateId/direct-provisionings/:winDirectProvisioningId`	✓	✓	–	–
`mdm.windows.directProvisioning.update`	`PUT /mdm/windows/enterprise/enrollment-templates/:winEnrollmentTemplateId/direct-provisionings/:winDirectProvisioningId`	✓	✓	✓	–
`mdm.windows.enrollmentTemplate.create`	`POST /mdm/windows/enterprise/enrollment-templates`	✓	✓	✓	–
`mdm.windows.enrollmentTemplate.get`	`GET /mdm/windows/enterprise/enrollment-templates/:winEnrollmentTemplateId`	✓	✓	✓	✓
`mdm.windows.enrollmentTemplate.list`	`GET /mdm/windows/enterprise/enrollment-templates`	✓	✓	✓	✓
`mdm.windows.enrollmentTemplate.remove`	`DELETE /mdm/windows/enterprise/enrollment-templates/:winEnrollmentTemplateId`	✓	✓	–	–
`mdm.windows.enrollmentTemplate.update`	`PUT /mdm/windows/enterprise/enrollment-templates/:winEnrollmentTemplateId`	✓	✓	✓	–
`mdm.windows.enrollmentToken.create`	`POST /mdm/windows/enterprise/enrollment-tokens` `POST /mdm/windows/enterprise/enrollment-tokens/bulk`	✓	✓	–	–
`mdm.windows.enrollmentToken.get`	`GET /mdm/windows/enterprise/enrollment-tokens/:winEnrollmentTokenId`	✓	✓	✓	✓
`mdm.windows.enrollmentToken.list`	`GET /mdm/windows/enterprise/enrollment-tokens`	✓	✓	✓	✓
`mdm.windows.enrollmentToken.remove`	`DELETE /mdm/windows/enterprise/enrollment-tokens/:winEnrollmentTokenId`	✓	✓	–	–
`mdm.windows.enrollmentToken.update`	`PUT /mdm/windows/enterprise/enrollment-tokens/:winEnrollmentTokenId`	✓	✓	✓	–
`mdm.windows.enterprise.create`	`POST /mdm/windows/enterprise`	✓	✓	–	–
`mdm.windows.enterprise.get`	`GET /mdm/windows/enterprise`	✓	✓	✓	✓
`mdm.windows.enterprise.update`	`PUT /mdm/windows/enterprise`	✓	✓	–	–
`mdm.windows.policy.composition`	`POST /mdm/windows/enterprise/policies/composition`	✓	✓	✓	✓
`mdm.windows.policy.create`	`POST /mdm/windows/enterprise/policies`	✓	✓	✓	–
`mdm.windows.policy.default`	`GET /mdm/windows/enterprise/policies/default`	✓	✓	✓	✓
`mdm.windows.policy.get`	`GET /mdm/windows/enterprise/policies/:winPolicyId` `GET /mdm/windows/enterprise/policies/:winPolicyId/assignations`	✓	✓	✓	✓
`mdm.windows.policy.list`	`GET /mdm/windows/enterprise/policies`	✓	✓	✓	✓
`mdm.windows.policy.remove`	`DELETE /mdm/windows/enterprise/policies/:winPolicyId`	✓	✓	–	–
`mdm.windows.policy.update`	`PUT /mdm/windows/enterprise/policies/:winPolicyId`	✓	✓	✓	–

Permission	Endpoints	O	A	E	V
`mdm.application.management.get`	—	✓	✓	✓	✓
`mdm.application.management.list`	—	✓	✓	✓	✓

Permission	Endpoints	O	A	E	V
`mdm.build.management.get`	—	✓	✓	✓	✓
`mdm.build.management.list`	—	✓	✓	✓	✓

Permission	Endpoints	O	A	E	V
`mdm.integration.harmonyMobile.get`	`GET /integrations/harmony-mobile`	✓	✓	✓	–
`mdm.integration.harmonyMobile.reset`	`DELETE /integrations/harmony-mobile`	✓	✓	–	–
`mdm.integration.harmonyMobile.update`	`PUT /integrations/harmony-mobile`	✓	✓	–	–

Permission	Endpoints	O	A	E	V
`inventory.item.management.create`	`POST /inventory-items`	✓	✓	✓	✓
`inventory.item.management.get`	`GET /inventory-items/:inventoryItemId`	✓	✓	✓	✓
`inventory.item.management.list`	`GET /inventory-items` `GET /inventory-items/csv` `GET /inventory-items/csv/sample`	✓	✓	✓	✓
`inventory.item.management.remove`	`DELETE /inventory-items/:inventoryItemId`	✓	✓	–	–
`inventory.item.management.update`	`PUT /inventory-items/:inventoryItemId` `POST /inventory-items/:inventoryItemId/notes` `DELETE /inventory-items/:inventoryItemId/notes/:noteId`	✓	✓	✓	✓

Permission	Endpoints	O	A	E	V	App A	App E	App V
`mad.application.configuration.create`	—	✓	✓	–	–	✓	–	–
`mad.application.configuration.deleteFile`	`DELETE /apps/:applicationId/configuration/:applicationConfigurationType/file/:applicationConfigurationFile`	✓	✓	–	–	✓	–	–
`mad.application.configuration.get`	`GET /apps/:applicationId/configuration/:applicationConfigurationType`	✓	✓	–	–	✓	–	–
`mad.application.configuration.getStatus`	`GET /apps/:applicationId/configuration/:applicationConfigurationType/status`	✓	✓	✓	–	✓	✓	–
`mad.application.configuration.remove`	`DELETE /apps/:applicationId/configuration/:applicationConfigurationType`	✓	✓	–	–	✓	–	–
`mad.application.configuration.update`	`PUT /apps/:applicationId/configuration/:applicationConfigurationType`	✓	✓	–	–	✓	–	–
`mad.application.configuration.uploadFile`	`POST /apps/:applicationId/configuration/:applicationConfigurationType/file`	✓	✓	–	–	✓	–	–
`mad.application.management.actions` ¹	`GET /apps/:applicationId/actions`	✓	✓	✓	✓	✓	✓	✓
`mad.application.management.checkSlug` ¹	`GET /apps/check-slug/:slug`	✓	✓	✓	✓	✓	✓	✓
`mad.application.management.create`	`POST /apps`	✓	✓	–	–	–	–	–
`mad.application.management.get`	`GET /apps/:applicationId`	✓	✓	✓	✓	✓	✓	✓
`mad.application.management.list`	`GET /apps` `GET /apps/downloads/csv`	✓	✓	✓	✓	✓	✓	✓
`mad.application.management.listGroups`	`GET /apps/:applicationId/groups`	✓	✓	✓	✓	✓	✓	✓
`mad.application.management.listTypes`	`GET /apps/:applicationId/list/:applicationType`	✓	✓	✓	✓	✓	✓	✓
`mad.application.management.remove`	`DELETE /apps/:applicationId`	✓	✓	–	–	✓	–	–
`mad.application.management.update`	`PUT /apps/:applicationId` `PUT /apps/:applicationId/picture`	✓	✓	–	–	✓	–	–
`mad.application.notification.create`	`POST /apps/:applicationId/notifications`	✓	✓	–	–	✓	–	–
`mad.application.notification.get`	`GET /apps/:applicationId/notifications/:applicationNotificationId`	✓	✓	✓	–	✓	✓	–
`mad.application.notification.list`	`GET /apps/:applicationId/notifications`	✓	✓	✓	–	✓	✓	–
`mad.application.notification.remove`	`DELETE /apps/:applicationId/notifications/:applicationNotificationId`	✓	✓	–	–	✓	–	–
`mad.application.notification.update`	`PUT /apps/:applicationId/notifications/:applicationNotificationId`	✓	✓	–	–	✓	–	–
`mad.application.token.create`	`POST /apps/:applicationId/tokens`	✓	✓	–	–	✓	–	–
`mad.application.token.get`	`GET /apps/:applicationId/tokens/:tokenId`	✓	✓	✓	–	✓	✓	–
`mad.application.token.list`	`GET /apps/:applicationId/tokens`	✓	✓	✓	–	✓	✓	–
`mad.application.token.remove`	`DELETE /apps/:applicationId/tokens/:tokenId`	✓	✓	–	–	✓	–	–
`mad.application.token.update`	`PUT /apps/:applicationId/tokens/:tokenId`	✓	✓	–	–	✓	–	–

¹ Also allowed for: mad.application.management.actions: Device Management Viewer; mad.application.management.checkSlug: No Role.

Permission	Endpoints	O	A	E	V	App A	App E	App V
`mad.build.management.addFile`	`POST /apps/:applicationId/builds/:buildId/edge/file`	✓	✓	–	–	✓	✓	–
`mad.build.management.create`	`POST /apps/:applicationId/builds` `POST /apps/:applicationId/builds/edge/build` `GET /apps/:applicationId/builds/edge/prepare`	✓	✓	✓	–	✓	✓	–
`mad.build.management.get`	`GET /apps/:applicationId/builds/:buildId` `GET /apps/:applicationId/builds/:buildId/emm-json`	✓	✓	✓	✓	✓	✓	✓
`mad.build.management.getDownloadToken`	`GET /apps/:applicationId/builds/:buildId/downloadToken`	✓	✓	✓	✓	✓	✓	✓
`mad.build.management.list`	`GET /apps/:applicationId/builds`	✓	✓	✓	✓	✓	✓	✓
`mad.build.management.listPackageNames`	`GET /apps/:applicationId/builds/list/packageName`	✓	✓	✓	✓	✓	✓	✓
`mad.build.management.listVersionCodes`	`GET /apps/:applicationId/builds/list/versionCode`	✓	✓	✓	✓	✓	✓	✓
`mad.build.management.listVersionNames`	`GET /apps/:applicationId/builds/list/versionName`	✓	✓	✓	✓	✓	✓	✓
`mad.build.management.remove`	`DELETE /apps/:applicationId/builds/:buildId`	✓	✓	–	–	✓	–	–
`mad.build.management.removeFile`	`DELETE /apps/:applicationId/builds/:buildId/files/:fileId`	✓	✓	–	–	✓	–	–
`mad.build.management.update`	`PUT /apps/:applicationId/builds/:buildId`	✓	✓	✓	–	✓	✓	–
`mad.build.management.updateFile`	`PUT /apps/:applicationId/builds/:buildId/files/:fileId`	✓	✓	✓	–	✓	✓	–

Permission	Endpoints	O	A	E	V	App A	App E	App V
`mad.download.management.get`	`GET /apps/:applicationId/builds/:buildId/downloads/:downloadId` `GET /organizations/organizationId/apps/applicationId/downloads/:downloadId`	✓	✓	✓	✓	✓	✓	✓
`mad.download.management.list`	`GET /apps/:applicationId/builds/:buildId/downloads` `GET /apps/:applicationId/builds/:buildId/downloads/by-user` `GET /apps/:applicationId/builds/:buildId/downloads/csv` `GET /organizations/organizationId/apps/applicationId/downloads` `GET /organizations/organizationId/apps/applicationId/downloads/by-user` `GET /organizations/organizationId/apps/applicationId/downloads/csv`	✓	✓	✓	✓	✓	✓	✓

Permission	Endpoints	O	A	E	V	App A	App E	App V
`mad.feedback.management.create`	`POST /apps/:applicationId/feedbacks`	✓	✓	✓	–	✓	✓	–
`mad.feedback.management.get`	`GET /apps/:applicationId/feedbacks/:feedbackId` `GET /apps/:applicationId/feedbacks/:feedbackId/image` `GET /apps/:applicationId/feedbacks/:feedbackId/video`	✓	✓	✓	✓	✓	✓	✓
`mad.feedback.management.list`	`GET /apps/:applicationId/feedbacks`	✓	✓	✓	✓	✓	✓	✓
`mad.feedback.management.remove`	`DELETE /apps/:applicationId/feedbacks/:feedbackId`	✓	✓	✓	–	✓	✓	–
`mad.feedback.management.update`	`PUT /apps/:applicationId/feedbacks/:feedbackId`	✓	✓	✓	–	✓	✓	–

Permission	Endpoints	O	A	E	V	App A	App E	App V
`mad.store.management.create`	—	✓	✓	–	–	–	–	–
`mad.store.management.get`	`GET /stores/:storeId`	✓	✓	✓	✓	✓	✓	✓
`mad.store.management.list`	`GET /stores`	✓	✓	✓	✓	✓	✓	✓
`mad.store.management.remove`	`DELETE /stores/:storeId`	✓	✓	–	–	–	–	–
`mad.store.management.update`	`PUT /stores/:storeId`	✓	✓	–	–	–	–	–
`mad.store.otpUsers.create`	`POST /organizations/:organizationSlug/stores/:storeId/otp-users`	✓	✓	–	–	✓	–	–
`mad.store.otpUsers.get`	`GET /organizations/:organizationSlug/stores/:storeId/otp-users/:otpUserId`	✓	✓	✓	✓	✓	✓	✓
`mad.store.otpUsers.list`	`GET /organizations/:organizationSlug/stores/:storeId/otp-users`	✓	✓	✓	✓	✓	✓	✓
`mad.store.otpUsers.remove`	`DELETE /organizations/:organizationSlug/stores/:storeId/otp-users/:otpUserId`	✓	✓	–	–	✓	–	–
`mad.store.otpUsers.update`	`PUT /organizations/:organizationSlug/stores/:storeId/otp-users/:otpUserId`	✓	✓	–	–	✓	–	–
`mad.store.publishedApplication.create`	`POST /stores/:storeId/pubApps`	✓	✓	–	–	✓	–	–
`mad.store.publishedApplication.get`	`GET /stores/:storeId/pubApps/:publishedApplicationId`	✓	✓	✓	✓	✓	✓	✓
`mad.store.publishedApplication.list`	`GET /stores/:storeId/pubApps`	✓	✓	✓	✓	✓	✓	✓
`mad.store.publishedApplication.notify`	`POST /stores/:storeId/pubApps/:publishedApplicationId/notify`	✓	✓	–	–	✓	–	–
`mad.store.publishedApplication.remove`	`DELETE /stores/:storeId/pubApps/:publishedApplicationId`	✓	✓	–	–	✓	–	–
`mad.store.publishedApplication.target`	`GET /stores/:storeId/pubApps/:publishedApplicationId/target`	✓	✓	✓	✓	✓	–	–
`mad.store.publishedApplication.update`	`PUT /stores/:storeId/pubApps/:publishedApplicationId`	✓	✓	–	–	✓	–	–

Permission	Endpoints	O	A	E	V	App A	App E	App V
`mad.userAudience.application.create`	`POST /apps/:applicationId/user-audiences`	✓	✓	–	–	✓	✓	–
`mad.userAudience.application.get`	`GET /apps/:applicationId/user-audiences/:userAudienceId`	✓	✓	✓	✓	✓	✓	✓
`mad.userAudience.application.list`	`GET /apps/:applicationId/user-audiences`	✓	✓	✓	✓	✓	✓	✓
`mad.userAudience.application.preview`	`POST /apps/:applicationId/user-audiences/preview`	✓	✓	✓	✓	✓	✓	✓
`mad.userAudience.application.remove`	`DELETE /apps/:applicationId/user-audiences/:userAudienceId`	✓	✓	–	–	✓	✓	–
`mad.userAudience.application.target`	`GET /apps/:applicationId/user-audiences/:userAudienceId/target`	✓	✓	✓	✓	✓	✓	✓
`mad.userAudience.application.update`	`PUT /apps/:applicationId/user-audiences/:userAudienceId`	✓	✓	–	–	✓	✓	–
`mad.userAudience.organization.create`	`POST /user-audiences`	✓	✓	–	–	–	–	–
`mad.userAudience.organization.get`	`GET /user-audiences/:userAudienceId`	✓	✓	✓	✓	✓	✓	✓
`mad.userAudience.organization.list`	`GET /user-audiences`	✓	✓	✓	✓	✓	–	–
`mad.userAudience.organization.preview`	`POST /user-audiences/preview`	✓	✓	✓	✓	✓	–	–
`mad.userAudience.organization.remove`	`DELETE /user-audiences/:userAudienceId`	✓	✓	–	–	–	–	–
`mad.userAudience.organization.target`	`GET /user-audiences/:userAudienceId/target`	✓	✓	–	–	✓	–	–
`mad.userAudience.organization.update`	`PUT /user-audiences/:userAudienceId`	✓	✓	–	–	–	–	–

Permission	Endpoints	O	A	E	V	App A	App E	App V
`mad.helheim.management.create`	—	✓	✓	–	–	✓	–	–
`mad.helheim.management.get`	—	✓	✓	✓	–	✓	✓	–
`mad.helheim.management.list`	—	✓	✓	✓	–	✓	✓	–
`mad.helheim.management.process`	—	✓	✓	–	–	✓	–	–
`mad.helheim.management.remove`	—	✓	✓	–	–	✓	–	–
`mad.helheim.management.update`	—	✓	✓	–	–	✓	–	–

Permission	Endpoints	O	A	E	V	App A	App E	App V
`people.mad.applicationCollaborator.create`	`POST /apps/:applicationId/collaborators`	✓	✓	–	–	✓	–	–
`people.mad.applicationCollaborator.get`	`GET /apps/:applicationId/collaborators/:applicationCollaboratorId`	✓	✓	✓	✓	✓	✓	✓
`people.mad.applicationCollaborator.invitations`	`GET /apps/:applicationId/collaborators/invitations`	✓	✓	✓	✓	✓	✓	✓
`people.mad.applicationCollaborator.list`	`GET /apps/:applicationId/collaborators`	✓	✓	✓	✓	✓	✓	✓
`people.mad.applicationCollaborator.remove`	`DELETE /apps/:applicationId/collaborators/:applicationCollaboratorId`	✓	✓	–	–	✓	–	–
`people.mad.applicationCollaborator.removeInvitations`	`DELETE /apps/:applicationId/collaborators/invitations/:invitationId`	✓	✓	–	–	✓	–	–
`people.mad.applicationCollaborator.update`	`PUT /apps/:applicationId/collaborators/:applicationCollaboratorId`	✓	✓	–	–	✓	–	–
`people.mad.applicationEmployee.create`	`POST /apps/:applicationId/employees`	✓	✓	–	–	✓	–	–
`people.mad.applicationEmployee.get`	`GET /apps/:applicationId/employees/:applicationEmployeeId`	✓	✓	✓	✓	✓	✓	✓
`people.mad.applicationEmployee.list`	`GET /apps/:applicationId/employees`	✓	✓	✓	✓	✓	✓	✓
`people.mad.applicationEmployee.remove`	`DELETE /apps/:applicationId/employees/:applicationEmployeeId`	✓	✓	–	–	✓	–	–
`people.mad.applicationEmployee.update`	`PUT /apps/:applicationId/employees/:applicationEmployeeId`	✓	✓	–	–	✓	–	–
`people.mad.organizationEmployee.create`	`POST /employees`	✓	✓	–	–	–	–	–
`people.mad.organizationEmployee.get`	`GET /employees/:organizationEmployeeId`	✓	✓	✓	✓	–	–	–
`people.mad.organizationEmployee.list`	`GET /employees` `GET /employees/apps`	✓	✓	✓	✓	–	–	–
`people.mad.organizationEmployee.listAll`	`GET /employees/all` `GET /employees/all-csv`	✓	✓	✓	✓	–	–	–
`people.mad.organizationEmployee.listGroups`	`GET /employees/groups`	✓	✓	✓	✓	✓	✓	✓
`people.mad.organizationEmployee.remove`	`DELETE /employees/:organizationEmployeeId`	✓	✓	–	–	–	–	–
`people.mad.organizationEmployee.update`	`PUT /employees/:organizationEmployeeId`	✓	✓	✓	–	–	–	–

Device Management roles

Permission	Endpoints	O	A	E	V
`base.organization.assistant.action`	`POST /assistant/:action`	✓	✓	✓	✓
`base.organization.audit.get`	`GET /audit/:auditId`	✓	✓	–	–
`base.organization.audit.list`	`GET /audit`	✓	✓	–	–
`base.organization.certificateProvider.assignations`	`GET /certificate-providers/:certificateProviderId/assignations`	✓	✓	–	–
`base.organization.certificateProvider.create`	`POST /certificate-providers`	✓	✓	–	–
`base.organization.certificateProvider.get`	`GET /certificate-providers/:certificateProviderId`	✓	✓	–	–
`base.organization.certificateProvider.list`	`GET /certificate-providers`	✓	✓	–	–
`base.organization.certificateProvider.purge`	`DELETE /certificate-providers/:certificateProviderId/purge`	✓	✓	–	–
`base.organization.certificateProvider.remove`	`DELETE /certificate-providers/:certificateProviderId`	✓	✓	–	–
`base.organization.certificateProvider.update`	`PUT /certificate-providers/:certificateProviderId`	✓	✓	–	–
`base.organization.emails.list`	`GET /emails/:scope`	✓	✓	✓	–
`base.organization.loginProvider.create`	`POST /providers`	✓	✓	–	–
`base.organization.loginProvider.get`	`GET /providers/:providerId`	✓	✓	–	–
`base.organization.loginProvider.list`	`GET /providers`	✓	✓	–	–
`base.organization.loginProvider.remove`	`DELETE /providers/:providerId`	✓	✓	–	–
`base.organization.loginProvider.update`	`PUT /providers/:providerId`	✓	✓	–	–
`base.organization.loginProvider.updateSamlUris`	`PUT /providers/:providerId/saml-uris`	✓	✓	–	–
`base.organization.management.checkSlug`	`GET /organizations/check-slug/:slug`	✓	✓	✓	✓
`base.organization.management.create`	`POST /organizations`	✓	✓	✓	–
`base.organization.management.get`	`GET /` `GET /actions` `GET /workspace`	✓	✓	✓	✓
`base.organization.management.getStorageProviders`	`GET /storage-providers`	✓	✓	✓	✓
`base.organization.management.list`	`GET /organizations`	✓	✓	✓	✓
`base.organization.management.listGroups`	`GET /groups`	✓	✓	✓	✓
`base.organization.management.manageIntegrations`	—	✓	✓	–	–
`base.organization.management.sendSupportEmail`	`GET /support-email/:action`	✓	✓	✓	✓
`base.organization.management.update`	`PUT /`	✓	✓	–	–
`base.organization.notification.create`	`POST /notifications`	✓	✓	–	–
`base.organization.notification.get`	`GET /notifications/:organizationNotificationId`	✓	✓	✓	–
`base.organization.notification.list`	`GET /notifications`	✓	✓	✓	–
`base.organization.notification.remove`	`DELETE /notifications/:organizationNotificationId`	✓	✓	–	–
`base.organization.notification.update`	`PUT /notifications/:organizationNotificationId`	✓	✓	–	–
`base.organization.pushNotificationProvider.create`	—	✓	✓	–	–
`base.organization.pushNotificationProvider.get`	—	✓	✓	–	–
`base.organization.pushNotificationProvider.list`	—	✓	✓	–	–
`base.organization.pushNotificationProvider.remove`	—	✓	✓	–	–
`base.organization.pushNotificationProvider.update`	—	✓	✓	–	–
`base.organization.scim.create`	`POST /providers/:providerId/scim`	✓	✓	–	–
`base.organization.scim.get`	`GET /providers/:providerId/scim`	✓	✓	✓	✓
`base.organization.scim.list`	—	✓	✓	✓	✓
`base.organization.scim.remove`	`DELETE /providers/:providerId/scim`	✓	✓	–	–
`base.organization.scim.update`	`PUT /providers/:providerId/scim`	✓	✓	–	–
`base.organization.segment.actions`	`GET /segments/:segmentId/actions`	✓	✓	✓	✓
`base.organization.segment.counts`	`GET /segments/:segmentId/counts` `GET /segments/:segmentId/counts-by-entity/:entity`	✓	✓	✓	✓
`base.organization.segment.create`	`POST /segments`	✓	✓	–	–
`base.organization.segment.get`	`GET /segments/:segmentId`	✓	✓	–	–
`base.organization.segment.list`	`GET /segments`	✓	✓	–	–
`base.organization.segment.remove`	`DELETE /segments/:segmentId`	✓	✓	–	–
`base.organization.segment.update`	`PUT /segments/:segmentId`	✓	✓	–	–
`base.organization.segmentPermission.create`	`POST /segment-permissions`	✓	✓	–	–
`base.organization.segmentPermission.get`	`GET /segment-permissions/:permissionId`	✓	✓	✓	✓
`base.organization.segmentPermission.list`	`GET /segment-permissions`	✓	✓	✓	✓
`base.organization.segmentPermission.preview`	`POST /segment-permissions/preview`	✓	✓	–	–
`base.organization.segmentPermission.remove`	`DELETE /segment-permissions/:permissionId`	✓	✓	–	–
`base.organization.segmentPermission.update`	`PUT /segment-permissions/:permissionId`	✓	✓	–	–
`base.organization.segmentPermission.userList`	`GET /segment-permissions/users`	✓	✓	–	–
`base.organization.segmentRole.create`	`POST /segment-roles`	✓	✓	–	–
`base.organization.segmentRole.get`	`GET /segment-roles/:roleId`	✓	✓	✓	✓
`base.organization.segmentRole.list`	`GET /segment-roles`	✓	✓	✓	✓
`base.organization.segmentRole.remove`	`DELETE /segment-roles/:roleId`	✓	✓	–	–
`base.organization.segmentRole.update`	`PUT /segment-roles/:roleId`	✓	✓	–	–
`base.organization.stats.get`	`GET /stats` `GET /stats/by-day`	✓	✓	✓	✓
`base.organization.storageProvider.create`	`POST /storage-providers`	✓	✓	–	–
`base.organization.storageProvider.delete`	`DELETE /storage-providers/:storageProviderId`	✓	✓	–	–
`base.organization.storageProvider.list`	`GET /storage-providers`	✓	✓	–	–
`base.organization.storageProvider.test`	`GET /storage-providers/:storageProviderId/test`	✓	✓	–	–
`base.organization.storageProvider.update`	`PUT /storage-providers/:storageProviderId`	✓	✓	–	–

App Distribution roles

Permission	Endpoints	O	A	E	V	App A	App E	App V
`base.organization.assistant.action`	`POST /assistant/:action`	✓	✓	✓	✓	✓	✓	✓
`base.organization.audit.get`	`GET /audit/:auditId`	✓	✓	–	–	–	–	–
`base.organization.audit.list`	`GET /audit`	✓	✓	–	–	–	–	–
`base.organization.certificateProvider.assignations`	`GET /certificate-providers/:certificateProviderId/assignations`	✓	–	–	–	–	–	–
`base.organization.certificateProvider.create`	`POST /certificate-providers`	✓	–	–	–	–	–	–
`base.organization.certificateProvider.get`	`GET /certificate-providers/:certificateProviderId`	✓	–	–	–	–	–	–
`base.organization.certificateProvider.list`	`GET /certificate-providers`	✓	–	–	–	–	–	–
`base.organization.certificateProvider.purge`	`DELETE /certificate-providers/:certificateProviderId/purge`	✓	–	–	–	–	–	–
`base.organization.certificateProvider.remove`	`DELETE /certificate-providers/:certificateProviderId`	✓	–	–	–	–	–	–
`base.organization.certificateProvider.update`	`PUT /certificate-providers/:certificateProviderId`	✓	–	–	–	–	–	–
`base.organization.emails.list`	`GET /emails/:scope`	✓	✓	✓	–	✓	✓	–
`base.organization.loginProvider.create`	`POST /providers`	✓	✓	–	–	–	–	–
`base.organization.loginProvider.get`	`GET /providers/:providerId`	✓	✓	–	–	–	–	–
`base.organization.loginProvider.list`	`GET /providers`	✓	✓	–	–	–	–	–
`base.organization.loginProvider.remove`	`DELETE /providers/:providerId`	✓	✓	–	–	–	–	–
`base.organization.loginProvider.update`	`PUT /providers/:providerId`	✓	✓	–	–	–	–	–
`base.organization.loginProvider.updateSamlUris`	`PUT /providers/:providerId/saml-uris`	✓	✓	–	–	–	–	–
`base.organization.management.checkSlug` ¹	`GET /organizations/check-slug/:slug`	✓	✓	✓	✓	✓	✓	✓
`base.organization.management.create` ¹	`POST /organizations`	✓	✓	✓	–	✓	✓	–
`base.organization.management.get` ¹	`GET /` `GET /actions` `GET /workspace`	✓	✓	✓	✓	✓	✓	✓
`base.organization.management.getStorageProviders` ¹	`GET /storage-providers`	✓	✓	✓	✓	✓	✓	✓
`base.organization.management.list` ¹	`GET /organizations`	✓	✓	✓	✓	✓	✓	✓
`base.organization.management.listGroups`	`GET /groups`	✓	✓	✓	✓	✓	✓	✓
`base.organization.management.manageIntegrations`	—	✓	✓	–	–	–	–	–
`base.organization.management.sendSupportEmail`	`GET /support-email/:action`	✓	✓	✓	✓	✓	✓	✓
`base.organization.management.update`	`PUT /`	✓	✓	–	–	–	–	–
`base.organization.notification.create`	`POST /notifications`	✓	✓	–	–	–	–	–
`base.organization.notification.get`	`GET /notifications/:organizationNotificationId`	✓	✓	✓	–	–	–	–
`base.organization.notification.list`	`GET /notifications`	✓	✓	✓	–	–	–	–
`base.organization.notification.remove`	`DELETE /notifications/:organizationNotificationId`	✓	✓	–	–	–	–	–
`base.organization.notification.update`	`PUT /notifications/:organizationNotificationId`	✓	✓	–	–	–	–	–
`base.organization.pushNotificationProvider.create`	—	✓	–	–	–	–	–	–
`base.organization.pushNotificationProvider.get`	—	✓	–	–	–	–	–	–
`base.organization.pushNotificationProvider.list`	—	✓	–	–	–	–	–	–
`base.organization.pushNotificationProvider.remove`	—	✓	–	–	–	–	–	–
`base.organization.pushNotificationProvider.update`	—	✓	–	–	–	–	–	–
`base.organization.scim.create`	`POST /providers/:providerId/scim`	✓	✓	–	–	✓	–	–
`base.organization.scim.get`	`GET /providers/:providerId/scim`	✓	✓	✓	✓	✓	✓	✓
`base.organization.scim.list`	—	✓	✓	✓	✓	✓	✓	✓
`base.organization.scim.remove`	`DELETE /providers/:providerId/scim`	✓	✓	–	–	✓	–	–
`base.organization.scim.update`	`PUT /providers/:providerId/scim`	✓	✓	–	–	✓	–	–
`base.organization.segment.actions` ¹	`GET /segments/:segmentId/actions`	✓	✓	✓	✓	✓	✓	✓
`base.organization.segment.counts` ¹	`GET /segments/:segmentId/counts` `GET /segments/:segmentId/counts-by-entity/:entity`	✓	✓	✓	✓	✓	✓	✓
`base.organization.segment.create`	`POST /segments`	✓	–	–	–	–	–	–
`base.organization.segment.get`	`GET /segments/:segmentId`	✓	–	–	–	–	–	–
`base.organization.segment.list`	`GET /segments`	✓	–	–	–	–	–	–
`base.organization.segment.remove`	`DELETE /segments/:segmentId`	✓	–	–	–	–	–	–
`base.organization.segment.update`	`PUT /segments/:segmentId`	✓	–	–	–	–	–	–
`base.organization.segmentPermission.create`	`POST /segment-permissions`	✓	–	–	–	–	–	–
`base.organization.segmentPermission.get`	`GET /segment-permissions/:permissionId`	✓	–	–	–	–	–	–
`base.organization.segmentPermission.list`	`GET /segment-permissions`	✓	–	–	–	–	–	–
`base.organization.segmentPermission.preview`	`POST /segment-permissions/preview`	✓	–	–	–	–	–	–
`base.organization.segmentPermission.remove`	`DELETE /segment-permissions/:permissionId`	✓	–	–	–	–	–	–
`base.organization.segmentPermission.update`	`PUT /segment-permissions/:permissionId`	✓	–	–	–	–	–	–
`base.organization.segmentPermission.userList`	`GET /segment-permissions/users`	✓	–	–	–	–	–	–
`base.organization.segmentRole.create`	`POST /segment-roles`	✓	–	–	–	–	–	–
`base.organization.segmentRole.get`	`GET /segment-roles/:roleId`	✓	–	–	–	–	–	–
`base.organization.segmentRole.list`	`GET /segment-roles`	✓	–	–	–	–	–	–
`base.organization.segmentRole.remove`	`DELETE /segment-roles/:roleId`	✓	–	–	–	–	–	–
`base.organization.segmentRole.update`	`PUT /segment-roles/:roleId`	✓	–	–	–	–	–	–
`base.organization.stats.get`	`GET /stats` `GET /stats/by-day`	✓	✓	✓	✓	✓	✓	✓
`base.organization.storageProvider.create`	`POST /storage-providers`	✓	✓	–	–	–	–	–
`base.organization.storageProvider.delete`	`DELETE /storage-providers/:storageProviderId`	✓	✓	–	–	–	–	–
`base.organization.storageProvider.list`	`GET /storage-providers`	✓	✓	–	–	✓	–	–
`base.organization.storageProvider.test`	`GET /storage-providers/:storageProviderId/test`	✓	✓	–	–	–	–	–
`base.organization.storageProvider.update`	`PUT /storage-providers/:storageProviderId`	✓	✓	–	–	–	–	–

¹ Also allowed for: base.organization.management.checkSlug: Unassigned, No Role; base.organization.management.create: No Role; base.organization.management.get: Unassigned; base.organization.management.getStorageProviders: No Role; base.organization.management.list: Unassigned, No Role; base.organization.segment.actions: Unassigned, No Role; base.organization.segment.counts: Unassigned, No Role.

Device Management roles

Permission	Endpoints	O	A	E	V
`people.base.audit.audit`	`GET /members/audit`	✓	–	–	–
`people.base.audit.merge`	`POST /members/audit/merge`	✓	–	–	–
`people.base.management.list`	`GET /people`	✓	✓	✓	✓
`people.base.organizationCollaborator.create`	`POST /collaborators`	✓	✓	–	–
`people.base.organizationCollaborator.get`	`GET /collaborators/:organizationCollaboratorId`	✓	✓	✓	✓
`people.base.organizationCollaborator.invitations`	`GET /collaborators/invitations`	✓	✓	✓	✓
`people.base.organizationCollaborator.list`	`GET /collaborators` `GET /collaborators/apps`	✓	✓	✓	✓
`people.base.organizationCollaborator.listAll`	`GET /collaborators/all` `GET /collaborators/all-csv`	✓	✓	✓	✓
`people.base.organizationCollaborator.listGroups`	`GET /collaborators/groups`	✓	✓	✓	✓
`people.base.organizationCollaborator.remove`	`DELETE /collaborators/:organizationCollaboratorId`	✓	✓	–	–
`people.base.organizationCollaborator.removeInvitations`	`DELETE /collaborators/invitations/:invitationId`	✓	✓	–	–
`people.base.organizationCollaborator.update`	`PUT /collaborators/:organizationCollaboratorId`	✓	✓	–	–
`people.base.serviceAccount.create`	`POST /service-accounts`	✓	✓	–	–
`people.base.serviceAccount.get`	`GET /service-accounts/:serviceAccountId`	✓	✓	✓	–
`people.base.serviceAccount.list`	`GET /service-accounts`	✓	✓	✓	–
`people.base.serviceAccount.regenerate`	`PUT /service-accounts/:serviceAccountId/session`	✓	✓	✓	–
`people.base.serviceAccount.remove`	`DELETE /service-accounts/:serviceAccountId`	✓	✓	–	–

App Distribution roles

Permission	Endpoints	O	A	E	V	App A	App E	App V
`people.base.audit.audit`	`GET /members/audit`	✓	✓	–	–	–	–	–
`people.base.audit.merge`	`POST /members/audit/merge`	✓	✓	–	–	–	–	–
`people.base.management.list`	`GET /people`	✓	✓	✓	✓	–	–	–
`people.base.organizationCollaborator.create`	`POST /collaborators`	✓	✓	–	–	–	–	–
`people.base.organizationCollaborator.get`	`GET /collaborators/:organizationCollaboratorId`	✓	✓	✓	✓	–	–	–
`people.base.organizationCollaborator.invitations`	`GET /collaborators/invitations`	✓	✓	✓	✓	–	–	–
`people.base.organizationCollaborator.list`	`GET /collaborators` `GET /collaborators/apps`	✓	✓	✓	✓	–	–	–
`people.base.organizationCollaborator.listAll`	`GET /collaborators/all` `GET /collaborators/all-csv`	✓	✓	✓	✓	–	–	–
`people.base.organizationCollaborator.listGroups`	`GET /collaborators/groups`	✓	✓	✓	✓	✓	✓	✓
`people.base.organizationCollaborator.remove`	`DELETE /collaborators/:organizationCollaboratorId`	✓	✓	–	–	–	–	–
`people.base.organizationCollaborator.removeInvitations`	`DELETE /collaborators/invitations/:invitationId`	✓	✓	–	–	–	–	–
`people.base.organizationCollaborator.update`	`PUT /collaborators/:organizationCollaboratorId`	✓	✓	–	–	–	–	–
`people.base.serviceAccount.create`	`POST /service-accounts`	✓	✓	–	–	–	–	–
`people.base.serviceAccount.get`	`GET /service-accounts/:serviceAccountId`	✓	✓	✓	–	–	–	–
`people.base.serviceAccount.list`	`GET /service-accounts`	✓	✓	✓	–	–	–	–
`people.base.serviceAccount.regenerate`	`PUT /service-accounts/:serviceAccountId/session`	✓	✓	✓	–	–	–	–
`people.base.serviceAccount.remove`	`DELETE /service-accounts/:serviceAccountId`	✓	✓	–	–	–	–	–

Device Management roles

Permission	Endpoints	O	A	E	V
`base.bulk.management.check`	`POST /bulk-tasks/check`	✓	✓	✓	–
`base.bulk.management.create`	`POST /bulk-tasks/edge/create`	✓	✓	✓	–
`base.bulk.management.get`	`GET /bulk-tasks/:bulkTaskId` `GET /bulk-tasks/edge/prepare`	✓	✓	✓	–
`base.bulk.management.list`	`GET /bulk-tasks`	✓	✓	✓	–
`base.bulk.management.remove`	—	✓	✓	✓	–
`base.bulk.management.update`	—	✓	✓	✓	–

App Distribution roles

Permission	Endpoints	O	A	E	V	App A	App E	App V
`base.bulk.management.check`	`POST /bulk-tasks/check`	✓	✓	✓	–	–	–	–
`base.bulk.management.create`	`POST /bulk-tasks/edge/create`	✓	✓	✓	–	–	–	–
`base.bulk.management.get`	`GET /bulk-tasks/:bulkTaskId` `GET /bulk-tasks/edge/prepare`	✓	✓	✓	–	–	–	✓
`base.bulk.management.list`	`GET /bulk-tasks`	✓	✓	✓	–	–	–	✓
`base.bulk.management.remove`	—	✓	✓	✓	–	–	–	–
`base.bulk.management.update`	—	✓	✓	✓	–	–	–	–

Device Management roles

Permission	Endpoints	O	A	E	V
`base.upload.action.uploadLogo`	`POST /upload/logo/logo`	✓	✓	✓	–

App Distribution roles

Permission	Endpoints	O	A	E	V	App A	App E	App V
`base.upload.action.uploadLogo` ¹	`POST /upload/logo/logo`	✓	✓	✓	–	✓	✓	–

¹ Also allowed for: base.upload.action.uploadLogo: No Role.

Device Management roles

Permission	Endpoints	O	A	E	V
`base.billing.management.get`	—	✓	✓	–	–
`base.billing.management.list`	—	✓	✓	–	–

App Distribution roles

Permission	Endpoints	O	A	E	V	App A	App E	App V
`base.billing.management.get`	—	✓	✓	–	–	–	–	–
`base.billing.management.list`	—	✓	✓	–	–	–	–	–

Device Management roles

Permission	Endpoints	O	A	E	V
`billing.base.invoice.create`	—	✓	–	–	–
`billing.base.invoice.get`	—	✓	–	–	–
`billing.base.invoice.list`	—	✓	–	–	–
`billing.base.invoice.remove`	—	✓	–	–	–
`billing.base.invoice.update`	—	✓	–	–	–
`billing.base.management.checkVatNumber`	—	✓	–	–	–
`billing.base.management.create`	—	✓	–	–	–
`billing.base.management.get`	—	✓	–	–	–
`billing.base.management.getCountries`	—	✓	–	–	–
`billing.base.management.list`	—	✓	–	–	–
`billing.base.management.remove`	—	✓	–	–	–
`billing.base.management.update`	—	✓	–	–	–
`billing.base.plan.addPlan`	—	✓	–	–	–
`billing.base.plan.cancelPlan`	—	✓	–	–	–
`billing.base.plan.reactivatePlan`	—	✓	–	–	–
`billing.base.plan.retryPayment`	—	✓	–	–	–
`billing.base.plan.updatePlan`	—	✓	–	–	–
`billing.base.source.create`	—	✓	–	–	–
`billing.base.source.get`	—	✓	–	–	–
`billing.base.source.list`	—	✓	–	–	–
`billing.base.source.remove`	—	✓	–	–	–
`billing.base.source.setDefault`	—	✓	–	–	–
`billing.base.source.update`	—	✓	–	–	–

App Distribution roles

Permission	Endpoints	O	A	E	V	App A	App E	App V
`billing.base.invoice.create`	—	✓	–	–	–	–	–	–
`billing.base.invoice.get`	—	✓	–	–	–	–	–	–
`billing.base.invoice.list`	—	✓	–	–	–	–	–	–
`billing.base.invoice.remove`	—	✓	–	–	–	–	–	–
`billing.base.invoice.update`	—	✓	–	–	–	–	–	–
`billing.base.management.checkVatNumber`	—	✓	–	–	–	–	–	–
`billing.base.management.create`	—	✓	–	–	–	–	–	–
`billing.base.management.get`	—	✓	–	–	–	–	–	–
`billing.base.management.getCountries`	—	✓	–	–	–	–	–	–
`billing.base.management.list`	—	✓	–	–	–	–	–	–
`billing.base.management.remove`	—	✓	–	–	–	–	–	–
`billing.base.management.update`	—	✓	–	–	–	–	–	–
`billing.base.plan.addPlan`	—	✓	–	–	–	–	–	–
`billing.base.plan.cancelPlan`	—	✓	–	–	–	–	–	–
`billing.base.plan.reactivatePlan`	—	✓	–	–	–	–	–	–
`billing.base.plan.retryPayment`	—	✓	–	–	–	–	–	–
`billing.base.plan.updatePlan`	—	✓	–	–	–	–	–	–
`billing.base.source.create`	—	✓	–	–	–	–	–	–
`billing.base.source.get`	—	✓	–	–	–	–	–	–
`billing.base.source.list`	—	✓	–	–	–	–	–	–
`billing.base.source.remove`	—	✓	–	–	–	–	–	–
`billing.base.source.setDefault`	—	✓	–	–	–	–	–	–
`billing.base.source.update`	—	✓	–	–	–	–	–	–

Device Management roles

Permission	Endpoints	O	A	E	V
`owner.organization.management.ownerChange`	`POST /change-owner`	✓	–	–	–
`owner.organization.management.remove`	`DELETE /`	✓	–	–	–

App Distribution roles

Permission	Endpoints	O	A	E	V	App A	App E	App V
`owner.organization.management.ownerChange`	`POST /change-owner`	✓	–	–	–	–	–	–
`owner.organization.management.remove`	`DELETE /`	✓	–	–	–	–	–	–

Which API endpoints and actions each Applivery role can use

How roles and permissions work

Endpoints by role

Permissions by area

Key Takeaways