Returns the full catalog of permission keys the system knows about -- everything you can grant or deny to a role, in either Set a Role's Fleet-Wide Perm...

Adds or removes a user from a role. Membership is per individual user account -- there's no AD-group-based membership; every caller (Windows/domain, Azu...

Grants, denies, or clears a permission for a role, fleet-wide ("Everywhere" scope -- applies to every job, folder, target server, and step). For a...

Grants (or denies) a permission to a role, restricted to one specific target server, folder, job, or step -- instead of fleet-wide. This is the one endpoint...

Tells you whether a given permission actually applies for a user, at an optional scope -- combining every role they're in, every fleet-wide and scoped g...

Walks one user's entire permission footprint -- every job, folder, target server, and step they have any grant on, through any role -- in a single call....

Registers another Minion Agent install as a peer this fleet can reference in a Job Sync Group. A peer is just a name, a base API URL, and the credential use...

A sync group is a named set of sync peers that a job can opt into (see Get / Set a Job's Sync Config). This is configuration only -- as of today, nothin...

Adds or removes one peer from an existing sync group, without recreating the whole group. Having trouble reaching the API, or logging in from another ma...

Reads or sets which sync group a job belongs to, and which parts of it (steps/name, security, schedules) opt into sync. As with the group itself, setting th...