API Key Permissions

This page lists everything you can grant in a scoped API key’s policy. To create a scoped key, see Scope a key to specific resources.

Resources

Resource	Matches
`organizations/{org_id}/*`	Everything in the organization.
`projects/{project_id}/*`	Everything in the project.
`projects/{project_id}/{kind}/{id}`	One object. `kind` is `browsers`, `profiles`, `vaults`, or `proxies`.

Resources must be inside the new key’s organization, or its project for a project-scoped key. Kernel checks that every object ID exists when you create the key.

Actions

Browsers

Action	Allows
`browsers:create`	Create browsers. Grant it on a project or organization.
`browsers:use`	List, inspect, connect to, and control browsers.
`browsers:write`	Update browser configuration.
`browsers:delete`	Delete browsers.

Profiles

Action	Allows
`profiles:create`	Create profiles. Grant it on a project or organization.
`profiles:read`	List profiles and view their metadata.
`profiles:use`	Attach profiles to browsers and download them.
`profiles:write`	Rename profiles and save browser state into them.
`profiles:delete`	Delete profiles.

Vaults

Action	Allows
`vaults:create`	Create vaults. Grant it on a project or organization.
`vaults:read`	List vaults and view vault and item metadata.
`vaults:use`	Link vaults to browsers, fill credentials, and run vault item operations.
`vaults:write`	Create, update, and delete vault items.
`vaults:delete`	Delete vaults and their items.

Proxies

Action	Allows
`proxies:create`	Create proxies. Grant it on a project or organization.
`proxies:read`	List proxies and view their configuration, without credentials.
`proxies:use`	Select saved proxies for browsers and run health checks.
`proxies:write`	Rename proxies.
`proxies:delete`	Delete proxies.

Projects and organizations

Action	Allows
`projects:read`	View project metadata and limits.
`organizations:read`	View organization entitlements and limits.

Operations that need more than one action

Operation	Requires
Create a browser	`browsers:create` and `browsers:use` on the project or organization, because the response includes connection URLs. Add `profiles:use` on its profile, `profiles:write` if it saves profile changes, `vaults:use` on each linked vault, and `proxies:use` on a saved proxy.
Any operation on an existing browser	The browser action, plus `profiles:use` on its attached profile and `vaults:use` on every linked vault. If the browser saves profile changes, `profiles:write` on that profile too.
Update a browser	`browsers:write` and `browsers:use`, plus `use` on any profile, vault, or proxy the update adds.
Fill from a vault	`vaults:use` on the vault and `browsers:use` on the browser.
Run a proxy health check	`proxies:use` and `proxies:read`.

List endpoints return only the objects the key can access, so a key without a matching grant gets an empty list.

Not available to scoped keys

Scoped keys get 403 with insufficient_scope on:

API key management, including creating, listing, rotating, and deleting keys.
Browser pools.
Creating browsers that use saved extensions, telemetry export, or app invocations.
Any other endpoint not covered by the actions above.

Overview

Start building

How it works

Partnering with KERNEL

API Key Permissions

Resources

Actions

Browsers

Profiles

Vaults

Proxies

Projects and organizations

Operations that need more than one action

Not available to scoped keys

​Resources

​Actions

​Browsers

​Profiles

​Vaults

​Proxies

​Projects and organizations

​Operations that need more than one action

​Not available to scoped keys

Resources

Actions

Browsers

Profiles

Vaults

Proxies

Projects and organizations

Operations that need more than one action

Not available to scoped keys