For the complete documentation index, see /llms.txt. This page is also available as raw Markdown at /cloud/manage-access/permissions-reference.md. Append .md to any page URL to fetch its Markdown.

Permissions reference

View Markdown

Temporal Cloud access controls are organized across three scopes:

• Account-level role permissions
• Project-level permissions
• Namespace-level permissions

Within each scope, permissions apply to publicly documented Temporal Cloud Ops API endpoints and to additional non-Cloud Ops capabilities, such as Temporal Cloud UI and internal automation behaviors.

Account-level access

Account-level access is granted to users and service accounts by assigning them an account-level role. Temporal Cloud supports the following account-level roles:

• Account Owner
• Global Admin
• Developer
• Finance Admin
• Read-Only
• Metrics Read-Only

Cloud Ops API permissions

The Metrics Read-Only role grants no Cloud Ops API permissions, so it is not included in the following table. For its permissions and API key requirements, see Metrics Read-Only role.

This table provides API-level details for permissions granted through account-level roles. These permissions are configured per user.

Permission	Read-only	Developer	Finance Admin	Global Admin	Account Owner
AddUserGroupMember				✅	✅
CreateAccountAuditLogSink				✅	✅
CreateApiKey	✅*	✅*	✅*	✅*	✅*
CreateBillingReport			✅		✅
CreateConnectivityRule				✅	✅
CreateNamespace		✅		✅	✅
CreateNexusEndpoint		✅		✅	✅
CreateProject		✅		✅	✅
CreateServiceAccount	✅†	✅†	✅†	✅†	✅†
CreateUser				✅	✅
CreateUserGroup				✅	✅
DeleteAccountAuditLogSink				✅	✅
DeleteApiKey	✅*	✅*	✅*	✅*	✅*
DeleteConnectivityRule				✅	✅
DeleteNexusEndpoint		✅		✅	✅
DeleteServiceAccount	✅†	✅†	✅†	✅†	✅†
DeleteUser				✅	✅
DeleteUserGroup				✅	✅
GetAccount	✅	✅	✅	✅	✅
GetAccountAuditLogSink				✅	✅
GetAccountAuditLogSinks				✅	✅
GetApiKey	✅*	✅*	✅*	✅*	✅*
GetApiKeys	✅*	✅*	✅*	✅*	✅*
GetAsyncOperation	✅	✅	✅	✅	✅
GetAuditLogs				✅	✅
GetBillingReport			✅		✅
GetConnectivityRule		✅		✅	✅
GetConnectivityRules		✅		✅	✅
GetCurrentIdentity	✅	✅	✅	✅	✅
GetNamespaces	✅	✅	✅	✅	✅
GetNexusEndpoint	✅	✅	✅	✅	✅
GetNexusEndpoints	✅	✅	✅	✅	✅
GetProjects	✅	✅	✅	✅	✅
GetRegion	✅	✅	✅	✅	✅
GetRegions	✅	✅	✅	✅	✅
GetServiceAccount	✅†	✅†	✅†	✅†	✅†
GetServiceAccounts	✅†	✅†	✅†	✅†	✅†
GetUsage			✅	✅	✅
GetUser	✅‡	✅‡	✅‡	✅‡	✅‡
GetUserGroup	✅	✅	✅	✅	✅
GetUserGroupMembers	✅	✅	✅	✅	✅
GetUserGroups	✅	✅	✅	✅	✅
GetUsers	✅‡	✅‡	✅‡	✅‡	✅‡
RemoveUserGroupMember				✅	✅
UpdateAccount				✅	✅
UpdateAccountAuditLogSink				✅	✅
UpdateApiKey	✅*	✅*	✅*	✅*	✅*
UpdateNamespaceTags				✅	✅
UpdateNexusEndpoint		✅		✅	✅
UpdateServiceAccount	✅†	✅†	✅†	✅†	✅†
UpdateUser				✅	✅
UpdateUserGroup				✅	✅
ValidateAccountAuditLogSink				✅	✅

• * See API Key Authorization Behavior
• † See Service Account Authorization Behavior
• ‡ See User authorization behavior

Namespace-level permissions

Namespace-level permissions are granted to users and service accounts by assigning them a Namespace-level permission. Temporal Cloud supports the following Namespace-level permissions:

• Namespace Admin
• Write
• Read

Users with the Global Admin and Account Owner roles automatically have Namespace Admin permissions on all Namespaces in the account.

Cloud Ops API permissions

This table provides API-level details for permissions granted through Namespace-level permissions. These permissions are configured per Namespace per user.

Permission	Read	Write	Namespace Admin
AddNamespaceRegion			✅
CreateNamespaceExportSink			✅
DeleteNamespace			✅
DeleteNamespaceExportSink			✅
DeleteNamespaceRegion			✅
FailoverNamespaceRegion			✅
GetNamespace	✅	✅	✅
GetNamespaceCapacityInfo	✅	✅	✅
GetNamespaceExportSink	✅	✅	✅
GetNamespaceExportSinks	✅	✅	✅
GetUserNamespaceAssignments			✅
RenameCustomSearchAttribute			✅
SetServiceAccountNamespaceAccess			✅
SetUserGroupNamespaceAccess			✅
SetUserNamespaceAccess			✅
UpdateNamespace			✅
UpdateNamespaceExportSink			✅
ValidateNamespaceExportSink			✅

Workflow-level permissions

This table provides API-level details for Workflow-level Data Plane permissions granted through Namespace-level permissions. These permissions are configured per Namespace per user.

Permission	Read	Write	Namespace Admin
CountActivityExecutions	✅	✅	✅
CountSchedules	✅	✅	✅
CountWorkflowExecutions	✅	✅	✅
CreateSchedule		✅	✅
CreateWorkflowRule		✅	✅
DeleteActivityExecution		✅	✅
DeleteSchedule		✅	✅
DeleteWorkerDeployment		✅	✅
DeleteWorkerDeploymentVersion		✅	✅
DeleteWorkflowExecution		✅	✅
DeleteWorkflowRule		✅	✅
DescribeActivityExecution	✅	✅	✅
DescribeBatchOperation	✅	✅	✅
DescribeNamespace	✅	✅	✅
DescribeSchedule	✅	✅	✅
DescribeTaskQueue	✅	✅	✅
DescribeWorker	✅	✅	✅
DescribeWorkerDeployment	✅	✅	✅
DescribeWorkerDeploymentVersion	✅	✅	✅
DescribeWorkflowExecution	✅	✅	✅
DescribeWorkflowRule	✅	✅	✅
ExecuteMultiOperation		✅	✅
FetchWorkerConfig	✅	✅	✅
GetSearchAttributes	✅	✅	✅
GetWorkerBuildIdCompatibility	✅	✅	✅
GetWorkerTaskReachability	✅	✅	✅
GetWorkerVersioningRules	✅	✅	✅
GetWorkflowExecutionHistory	✅	✅	✅
GetWorkflowExecutionHistoryReverse	✅	✅	✅
ListActivityExecutions	✅	✅	✅
ListBatchOperations	✅	✅	✅
ListClosedWorkflowExecutions	✅	✅	✅
ListOpenWorkflowExecutions	✅	✅	✅
ListScheduleMatchingTimes	✅	✅	✅
ListSchedules	✅	✅	✅
ListTaskQueuePartitions	✅	✅	✅
ListWorkerDeployments	✅	✅	✅
ListWorkers	✅	✅	✅
ListWorkflowExecutions	✅	✅	✅
ListWorkflowRules	✅	✅	✅
PatchSchedule		✅	✅
PauseActivity		✅	✅
PauseWorkflowExecution		✅	✅
PollActivityExecution		✅	✅
PollActivityTaskQueue		✅	✅
PollNexusTaskQueue		✅	✅
PollWorkflowExecutionUpdate		✅	✅
PollWorkflowTaskQueue		✅	✅
QueryWorkflow	✅	✅	✅
RecordActivityTaskHeartbeat		✅	✅
RecordActivityTaskHeartbeatById		✅	✅
RecordWorkerHeartbeat		✅	✅
RequestCancelActivityExecution		✅	✅
RequestCancelWorkflowExecution		✅	✅
ResetActivity		✅	✅
ResetStickyTaskQueue		✅	✅
ResetWorkflowExecution		✅	✅
RespondActivityTaskCanceled		✅	✅
RespondActivityTaskCanceledById		✅	✅
RespondActivityTaskCompleted		✅	✅
RespondActivityTaskCompletedById		✅	✅
RespondActivityTaskFailed		✅	✅
RespondActivityTaskFailedById		✅	✅
RespondNexusTaskCompleted		✅	✅
RespondNexusTaskFailed		✅	✅
RespondQueryTaskCompleted		✅	✅
RespondWorkflowTaskCompleted		✅	✅
RespondWorkflowTaskFailed		✅	✅
SetWorkerDeploymentCurrentVersion		✅	✅
SetWorkerDeploymentManager		✅	✅
SetWorkerDeploymentRampingVersion		✅	✅
ShutdownWorker		✅	✅
SignalWithStartWorkflowExecution		✅	✅
SignalWorkflowExecution		✅	✅
StartActivityExecution		✅	✅
StartBatchOperation		✅	✅
StartWorkflowExecution		✅	✅
StopBatchOperation		✅	✅
TerminateActivityExecution		✅	✅
TerminateWorkflowExecution		✅	✅
TriggerWorkflowRule		✅	✅
UnpauseActivity		✅	✅
UnpauseWorkflowExecution		✅	✅
UpdateActivityOptions		✅	✅
UpdateSchedule		✅	✅
UpdateTaskQueueConfig		✅	✅
UpdateWorkerBuildIdCompatibility		✅	✅
UpdateWorkerConfig		✅	✅
UpdateWorkerDeploymentVersionMetadata		✅	✅
UpdateWorkerVersioningRules		✅	✅
UpdateWorkflowExecution		✅	✅
UpdateWorkflowExecutionOptions		✅	✅

Project-level permissions

Project-level permissions are granted to users, groups, and service accounts by assigning them a Project-level role. Temporal Cloud supports the following Project-level roles:

• Project Admin
• Project Write
• Project Read
• Project Contribute
• Project List
• Project Member

Users with the Global Admin and Account Owner roles automatically have Project Admin on all Projects in the account.

Project Admin, Project Write, and Project Read also grant Namespace Admin, Write, and Read respectively on every Namespace in the Project. Project Contribute, Project List, and Project Member grant no Namespace-level access. This is why Project Read and Project List grant the same Cloud Ops API permissions, as do Project Write and Project Contribute: they differ in the Namespace-level and Workflow-level permissions they carry, not in the Cloud Ops API endpoints they can call.

Cloud Ops API permissions

This table provides API-level details for permissions granted through Project-level roles. These permissions are configured per Project per user.

These permissions control who can manage Nexus Endpoints in the Project. They do not restrict which Namespaces can call an Endpoint at runtime, which continues to be controlled by the Endpoint allowlist. See Use Nexus across Projects.

Permission	Member	List	Read	Contribute	Write	Project Admin
CreateConnectivityRule				✅	✅	✅
CreateNamespace				✅	✅	✅
CreateNexusEndpoint				✅	✅	✅
CreateServiceAccount						✅†
DeleteConnectivityRule				✅	✅	✅
DeleteNexusEndpoint				✅	✅	✅
DeleteProject						✅
GetConnectivityRule		✅	✅	✅	✅	✅
GetConnectivityRules		✅	✅	✅	✅	✅
GetNamespaces	✅	✅	✅	✅	✅	✅
GetNexusEndpoint		✅	✅	✅	✅	✅
GetNexusEndpoints		✅	✅	✅	✅	✅
GetProject	✅	✅	✅	✅	✅	✅
GetProjectScopedServiceAccounts						✅
GetServiceAccount		✅†	✅†	✅†	✅†	✅†
GetServiceAccountProjectAssignments						✅
GetServiceAccounts		✅†	✅†	✅†	✅†	✅†
GetUserGroupProjectAssignments						✅
GetUserProjectAssignments						✅
SetServiceAccountProjectAccess						✅
SetUserGroupProjectAccess						✅
SetUserProjectAccess						✅
UpdateNexusEndpoint				✅	✅	✅
UpdateProject						✅

• † See Service Account Authorization Behavior

Project Developer is a compatibility role that users with the Account Developer role inherit automatically. It cannot be assigned directly. It grants everything Project Contribute grants except CreateConnectivityRule and DeleteConnectivityRule, and carries no Namespace-level access. For details, see Project roles.

Custom Role permissions reference

The following tables list the permission action strings available when defining Custom Roles. Use these strings in the actions field of a Custom Role permission grant.

Not all Cloud Ops API operations can be assigned to a Custom Role. For details on which operations are excluded and why, see Available permissions.

Account permissions

Permission	Cloud Ops API	Resource type
cloud.account.get	GetAccount	Account
cloud.account.update	UpdateAccount	Account
cloud.asyncoperation.get	GetAsyncOperation	Account
cloud.auditlog.createSink	CreateAccountAuditLogSink	Account
cloud.auditlog.deleteSink	DeleteAccountAuditLogSink	Account
cloud.auditlog.getSink	GetAccountAuditLogSink	Account
cloud.auditlog.list	GetAuditLogs	Account
cloud.auditlog.listSinks	GetAccountAuditLogSinks	Account
cloud.auditlog.updateSink	UpdateAccountAuditLogSink	Account
cloud.auditlog.validateSink	ValidateAccountAuditLogSink	Account
cloud.billingreport.create	CreateBillingReport	Account
cloud.billingreport.get	GetBillingReport	Account
cloud.connectivityrule.list	GetConnectivityRules	Account, Project
cloud.customrole.create	CreateCustomRole	Account, Project
cloud.customrole.list	GetCustomRoles	Account, Project
cloud.migration.abort	AbortMigration	Account
cloud.migration.confirm	ConfirmMigration	Account
cloud.migration.get	GetMigration	Account
cloud.migration.handover	HandoverNamespace	Account
cloud.migration.list	GetMigrations	Account
cloud.migration.start	StartMigration	Account
cloud.namespace.list	GetNamespaces	Account, Project
cloud.nexusendpoint.list	GetNexusEndpoints	Account, Project
cloud.region.get	GetRegion	Account
cloud.region.list	GetRegions	Account
cloud.usage.get	GetUsage	Account
cloud.user.create	CreateUser	Account
cloud.user.delete	DeleteUser	Account
cloud.user.get	GetUser	Account
cloud.user.list	GetUsers	Account
cloud.usergroup.addMember	AddUserGroupMember	Account
cloud.usergroup.create	CreateUserGroup	Account
cloud.usergroup.delete	DeleteUserGroup	Account
cloud.usergroup.get	GetUserGroup	Account
cloud.usergroup.getMembers	GetUserGroupMembers	Account
cloud.usergroup.list	GetUserGroups	Account
cloud.usergroup.removeMember	RemoveUserGroupMember	Account

Namespace permissions

Permission	Cloud Ops API	Resource type
cloud.namespace.addRegion	AddNamespaceRegion	Namespace
cloud.namespace.capacityinfo.get	GetNamespaceCapacityInfo	Namespace
cloud.namespace.delete	DeleteNamespace	Namespace
cloud.namespace.deleteRegion	DeleteNamespaceRegion	Namespace
cloud.namespace.exportsink.create	CreateNamespaceExportSink	Namespace
cloud.namespace.exportsink.delete	DeleteNamespaceExportSink	Namespace
cloud.namespace.exportsink.get	GetNamespaceExportSink	Namespace
cloud.namespace.exportsink.list	GetNamespaceExportSinks	Namespace
cloud.namespace.exportsink.update	UpdateNamespaceExportSink	Namespace
cloud.namespace.exportsink.validate	ValidateNamespaceExportSink	Namespace
cloud.namespace.failoverRegion	FailoverNamespaceRegion	Namespace
cloud.namespace.get	GetNamespace	Namespace
cloud.namespace.getServiceAccountNamespaceAssignments	GetServiceAccountNamespaceAssignments	Namespace
cloud.namespace.getUserGroupNamespaceAssignments	GetUserGroupNamespaceAssignments	Namespace
cloud.namespace.getUserNamespaceAssignments	GetUserNamespaceAssignments	Namespace
cloud.namespace.renameCustomSearchAttribute	RenameCustomSearchAttribute	Namespace
cloud.namespace.setUserAccess	SetUserNamespaceAccess	Namespace
cloud.namespace.setUserGroupAccess	SetUserGroupNamespaceAccess	Namespace
cloud.namespace.update	UpdateNamespace	Namespace
cloud.namespace.updateTags	UpdateNamespaceTags	Namespace

Project permissions

Permission	Cloud Ops API	Resource type
cloud.connectivityrule.create	CreateConnectivityRule	Project
cloud.connectivityrule.list	GetConnectivityRules	Account, Project
cloud.customrole.create	CreateCustomRole	Account, Project
cloud.customrole.list	GetCustomRoles	Account, Project
cloud.namespace.create	CreateNamespace	Project
cloud.namespace.list	GetNamespaces	Account, Project
cloud.nexusendpoint.create	CreateNexusEndpoint	Project
cloud.nexusendpoint.list	GetNexusEndpoints	Account, Project

Nexus Endpoint permissions

Permission	Cloud Ops API	Resource type
cloud.nexusendpoint.delete	DeleteNexusEndpoint	Nexus Endpoint
cloud.nexusendpoint.get	GetNexusEndpoint	Nexus Endpoint
cloud.nexusendpoint.update	UpdateNexusEndpoint	Nexus Endpoint

Connectivity Rule permissions

Permission	Cloud Ops API	Resource type
cloud.connectivityrule.delete	DeleteConnectivityRule	Connectivity Rule
cloud.connectivityrule.get	GetConnectivityRule	Connectivity Rule

Custom Role permissions

Permission	Cloud Ops API	Resource type
cloud.customrole.delete	DeleteCustomRole	Custom Role
cloud.customrole.get	GetCustomRole	Custom Role
cloud.customrole.update	UpdateCustomRole	Custom Role

Additional authorization behaviors

Some APIs are granted to all account-level roles but enforce additional authorization rules at runtime. The action group grants access to call the API, but the scope of what the caller can interact with depends on their role.

API key authorization behavior

All roles can create and manage their own API keys. An API key inherits the permissions of its owner — it cannot grant access beyond what the owning user or service account already has.

Behavior	Read-only	Developer	Finance Admin	Global Admin	Account Owner
Create, view, update, and delete own API keys	✅	✅	✅	✅	✅
View, update, and delete any API key in the account				✅	✅

Affected APIs: CreateApiKey, GetApiKey, GetApiKeys, UpdateApiKey, DeleteApiKey

Service account authorization behavior

All roles can list service accounts within their account. However, the ability to create, update, and delete service accounts depends on the scope of the service account and the caller's role.

Behavior	Read-only	Developer	Finance Admin	Global Admin	Account Owner
List all service accounts in the account	✅	✅	✅	✅	✅
Manage unscoped (account-level) service accounts				✅	✅
Manage Namespace-scoped service accounts	§	§	§	✅	✅
Manage Project-scoped service accounts	†	†	†	✅	✅

§ Requires Namespace Admin permission on the target Namespace. Any role can manage Namespace-scoped service accounts if they hold Namespace Admin on that Namespace.

† Requires Project Admin permission on the target Project. Any role can manage Project-scoped service accounts if they hold Project Admin on that Project.

Affected APIs: CreateServiceAccount, GetServiceAccount, GetServiceAccounts, UpdateServiceAccount, DeleteServiceAccount

User authorization behavior

Every account-level role can call GetUser and GetUsers. The response includes the user's ID, email, and state.

Another user's access (account role, Namespace permissions, Project access, and Custom Roles) and invitation are returned only to Account Owner and Global Admin. Namespace Admin does not change this.

GetUser of the caller always includes that caller's own access.

To list who has access to a Namespace, use GetUserNamespaceAssignments.

Affected APIs: GetUser, GetUsers