> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devin.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions & RBAC

> Permission reference for the Devin API

Every API endpoint except [`GET /v3/self`](/api-reference/v3/self/self) is gated by a specific permission. A [service user](/api-reference/authentication#service-users-recommended-for-automation) gets its permissions from its assigned role; a [personal access token](/api-reference/personal-access-tokens) has the permissions of the user who created it. The required permission for each endpoint is documented on its individual API reference page. This page provides a summary of all permissions by scope.

**Base URLs:**

* `https://api.devin.ai/v3/organizations/*` — endpoints scoped to a single organization
* `https://api.devin.ai/v3/enterprise/*` — endpoints that require enterprise-level permissions

<Note>
  **Devin Enterprise** customers with a dedicated deployment should replace `api.devin.ai` with their custom API domain (e.g., `api.your-company.devinenterprise.com`). See the [Enterprise quick start](/api-reference/getting-started/enterprise-quickstart) for setup details.
</Note>

<Tip>
  Find your organization ID at the top of the **Settings → Devin API** page.
</Tip>

<Note>
  Some enterprise endpoints operate on specific organizations using paths like
  `/v3/enterprise/organizations/{org_id}/...` (for example, audit logs and tags).
  Even though they include an `org_id` parameter, they require **enterprise-level** permissions.
</Note>

## Enterprise permissions

| Permission | Controls |
| - | - |
| `ManageEnterpriseSettings` | Organization tags |
| `ViewOrganizations` | List and get organizations, Get organization group limits (read-only; also granted by `ManageOrganizations`) |
| `ManageOrganizations` | Create, update, and delete organizations, Update organization group limits; also grants `ViewOrganizations` |
| `ManageAccountMembership` | Roles, Enterprise users, Enterprise IdP groups, Enterprise service user membership, Enterprise IdP group registration |
| `ViewAccountMembership` | List roles, enterprise users, IdP groups, and service users (read-only; also granted by `ManageAccountMembership`) |
| `ManageAccountServiceUsers` | Service user provisioning (enterprise) |
| `UseAccountTools` | List and get knowledge notes, knowledge folders, and playbooks (enterprise, read-only; also granted by `ManageAccountKnowledge` for knowledge and `ManageAccountPlaybooks` for playbooks) |
| `ManageAccountKnowledge` | Create, update, and delete knowledge notes (enterprise); also grants read access |
| `ManageAccountPlaybooks` | Create, update, and delete playbooks (enterprise); also grants read access |
| `ViewGitIntegrations` | Git connections and connection repositories (read-only; also granted by `ManageGitIntegrations`) |
| `ManageGitIntegrations` | Create, edit, and delete Git integrations; also grants `ViewGitIntegrations` |
| `ViewRepoPermissions` | Git permissions (read-only; also granted by `ManageRepoPermissions`) |
| `ManageRepoPermissions` | Create, replace, update, and delete Git permissions |
| `ManageBilling` | ACU limits |
| `ViewAccountAuditLogs` | Audit logs (enterprise, read-only) |
| `ViewAccountConsumption` | Consumption cycles, Daily consumption breakdowns (Enterprise plan only) |
| `ViewAccountMetrics` | Usage metrics (DAU/WAU/MAU, PRs, sessions, searches, active users), Queue status |
| `ViewEnterpriseInfraDetails` | Hypervisors |
| `ViewAccountSessions` | Sessions list and detail (enterprise, read-only) |
| `ManageAccountSessions` | Send messages to sessions (enterprise) |
| `ViewAccountCodeScans` | [Code scans](/api-reference/v3/code-scans/enterprise-code-scans-list), [profiles](/api-reference/v3/code-scans/enterprise-code-scans-profiles) and [profile details](/api-reference/v3/code-scans/enterprise-code-scans-profile), [findings](/api-reference/v3/code-scans/enterprise-code-scans-findings), and [metrics](/api-reference/v3/code-scans/enterprise-code-scans-metrics) (enterprise, read-only) |
| `UseAccountCodeScans` | [Start code scans](/api-reference/v3/code-scans/enterprise-code-scans-start), [start ingestion scans](/api-reference/v3/code-scans/enterprise-code-scans-start-ingestion), and [remediate findings](/api-reference/v3/code-scans/enterprise-code-scans-remediate) (enterprise) |

## Organization permissions

| Permission | Controls |
| - | - |
| `ManageOrgSecrets` | Secrets CRUD |
| `ManageOrgSettings` | [Set the organization default platform](/api-reference/v3/organization-settings/put-organization-default-platform) |
| `ManageOrgKnowledge` | Create, update, and delete knowledge notes (organization) |
| `ManageOrgPlaybooks` | Create, update, and delete playbooks (organization) |
| `ManageOrgServiceUsers` | Service user provisioning (organization) |
| `ManageOrgSchedules` | Scheduled sessions |
| `ViewOrgAutomations` | Automations list and detail (organization, read-only) |
| `ManageOrgAutomations` | Create, edit, delete automations |
| `UsePersonalAutomations` | Personal automations (`run_as: creator`) |
| `ViewOrgConsumption` | Daily consumption breakdowns (organization, all plans) |
| `ViewOrgSessions` | Sessions list and detail (organization, read-only) |
| `ManageOrgSessions` | Send messages, terminate, archive sessions |
| `UseDevinSessions` | Create sessions; list and get knowledge notes, knowledge folders, and playbooks (organization, read-only) |
| `ImpersonateOrgSessions` | Create sessions on behalf of other users (`create_as_user_id`) |
| `ViewCodeScans` | [Code scans](/api-reference/v3/code-scans/organizations-code-scans-list), [profiles](/api-reference/v3/code-scans/organizations-code-scans-profiles) and [profile details](/api-reference/v3/code-scans/organizations-code-scans-profile), [findings](/api-reference/v3/code-scans/organizations-code-scans-findings), and [metrics](/api-reference/v3/code-scans/organizations-code-scans-metrics) (organization, read-only) |
| `UseCodeScans` | [Start code scans](/api-reference/v3/code-scans/organizations-code-scans-start), [start ingestion scans](/api-reference/v3/code-scans/organizations-code-scans-start-ingestion), and [remediate findings](/api-reference/v3/code-scans/organizations-code-scans-remediate) (organization) |

## Permission inheritance

**Enterprise service users** authenticate with `/v3/enterprise/*` endpoints and can operate across all organizations. They are assigned enterprise-level roles and automatically inherit the corresponding org-level permissions in every organization (for example, `ViewAccountSessions` grants `ViewOrgSessions` in all orgs).

**Organization service users** are scoped to a single organization and authenticate with `/v3/organizations/{org_id}/*` endpoints only. They are assigned org-level roles.

## Creating service users

Service users are created through the Devin UI:

1. **Enterprise service users**: Enterprise settings → Devin API (**Service users** tab)
2. **Organization service users**: Organization settings → Devin API (**Service users** tab)

For setup instructions, see the [Teams quick start](/api-reference/getting-started/teams-quickstart) or [Enterprise quick start](/api-reference/getting-started/enterprise-quickstart).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.