---
schema: rendered-html/v1
title: "App Permissions | Developer Portal for YouTrack and Hub Documentation"
source_url: https://www.jetbrains.com/help/youtrack/devportal/app-permissions.html
generated_at: 2026-06-11T15:01:56.642967+00:00
---

Feedback

Thanks for your feedback!

Was this page helpful?

YesNo

Developer Portal for YouTrack and Hub

- Developer Portal
- Apps
- Get Started with Apps
- App Quick Start Guide
- Apps FAQ
- Enhanced DX for TypeScript Apps
- YouTrack App Architecture
- [App Package Overview](jetbrains__com__help__youtrack__devportal__app-overview.md)
- [App Manifest](jetbrains__com__help__youtrack__devportal__app-manifest.md)
- Widgets
- [App Settings](jetbrains__com__help__youtrack__devportal__app-settings.md)
- Extension Properties
- [App Permissions](app-permissions.html)
- Authentication for Apps
- [App Visibility](jetbrains__com__help__youtrack__devportal__app-visibility.md)
- Global and Project Scopes
- Launch Checklist
- App Use Cases
- App Reference
- MCP Tools
- YouTrack Workflows
- YouTrack Import Scripts
- YouTrack Form API
- YouTrack REST API
- Hub REST API

1. Apps
2. Get Started with Apps
3. [App Permissions](#0)

# App Permissions﻿

Last modified: 07 May 2026

The widget manifest supports a `permissions` field. This field lets you define permission-based visibility restrictions for each of the widgets supported by your app.

Permission-based visibility restrictions work like this:

- Users only need to be granted one of the required permissions to be able to view and interact with the widget, even when multiple permissions are specified in the manifest.
- For widget extension points with project scopes, project-category permissions are checked on a per-project basis. For example, if you require the project-category `LINK_ISSUE` permission to view a widget that uses the project-scoped `ISSUE_BELOW_SUMMARY` extension point, users will only see this widget when working with projects where they have been granted the `LINK_ISSUE` permission.

Permissions are listed in the `permissions` field of the widget manifest as an array. Each permission is referenced using its key.

> ### warning
>
> Widgets with REST Requests
>
> If a widget sends REST requests that can change or delete data, restrict the widget to users who are expected to perform these actions. Request confirmation is stored for the current user only, so each user who can open the widget can confirm these requests on their own behalf.

Here is an example of a widget description in an app manifest that is restricted based on user's permissions:

```
"widgets": [
    {
        "key": "main-menu",
        "name": "Main Menu Item",
        "indexPath": "admin/index.html",
        "place": "MAIN_MENU_ITEM",
        "permissions": ["READ_USER"]
    }
]
```

Use the list on this page to locate the key for each permission. To learn more about permissions in YouTrack, see Permissions.

| Entity | Permission | Key |
| --- | --- | --- |
| Article | Create Article | CREATE\_ARTICLE |
| Delete Article | DELETE\_ARTICLE |
| Read Article | READ\_ARTICLE |
| Update Article | UPDATE\_ARTICLE |
| Article Comment | Create Article Comment | CREATE\_ARTICLE\_COMMENT |
| Delete Article Comment | DELETE\_ARTICLE\_COMMENT |
| Read Article Comment | READ\_ARTICLE\_COMMENT |
| Update Article Comment | UPDATE\_ARTICLE\_COMMENT |
| Issue | Apply Commands Silently | APPLY\_COMMANDS\_SILENTLY |
| Create Issue | CREATE\_ISSUE |
| Delete Issue | DELETE\_ISSUE |
| Link Issues | LINK\_ISSUE |
| Override Visibility Restrictions | READ\_HIDDEN\_STUFF |
| Read Issue | READ\_ISSUE |
| Read Issue Private Fields | PRIVATE\_READ\_ISSUE |
| Update Issue | UPDATE\_ISSUE |
| Update Issue Private Fields | PRIVATE\_UPDATE\_ISSUE |
| Update Watchers | UPDATE\_WATCHERS |
| View Voters | VIEW\_VOTERS |
| View Watchers | VIEW\_WATCHERS |
| Issue Attachment | Add Attachment | CREATE\_ATTACHMENT\_ISSUE |
| Delete Attachment | DELETE\_ATTACHMENT\_ISSUE |
| Update Attachment | UPDATE\_ATTACHMENT\_ISSUE |
| Issue Comment | Create Issue Comment | CREATE\_COMMENT |
| Delete Issue Comment | DELETE\_COMMENT |
| Delete Not Own and  Permanent Comment Delete | DELETE\_NOT\_OWN\_COMMENT |
| Read Issue Comment | READ\_COMMENT |
| Update Issue Comment | UPDATE\_COMMENT |
| Update Not Own Issue Comment | UPDATE\_NOT\_OWN\_COMMENT |
| Issue Work Item | Create Not Own Work Item | CREATE\_NOT\_OWN\_WORK\_ITEM |
| Create Work Item | CREATE\_WORK\_ITEM |
| Read Work Item | READ\_WORK\_ITEM |
| Update Not Own Work Item | UPDATE\_NOT\_OWN\_WORK\_ITEM |
| Update Work Item | UPDATE\_WORK\_ITEM |
| Organization | Create Organization | CREATE\_ORGANIZATION |
| Delete Organization | DELETE\_ORGANIZATION |
| Read Organization | READ\_ORGANIZATION |
| Update Organization | UPDATE\_ORGANIZATION |
| Project | Create Project | CREATE\_PROJECT |
| Delete Project | DELETE\_PROJECT |
| Read Project Full | READ\_PROJECT |
| Read Project Basic | READ\_PROJECT\_BASIC |
| Update Project | UPDATE\_PROJECT |
| System | Low-level Admin Read | ADMIN\_READ\_APP |
| Low-level Admin Write | ADMIN\_UPDATE\_APP |
| User | Create User | CREATE\_USER |
| Delete User | DELETE\_USER |
| Read User Full | READ\_USER |
| Read User Basic | READ\_USER\_BASIC |
| Update Self | UPDATE\_PROFILE |
| Update User | UPDATE\_USER |
| Watch Folder | Create Tag or Saved Search | CREATE\_WATCH\_FOLDER |
| Delete Tag or Saved Search | DELETE\_WATCH\_FOLDER |
| Edit Tag or Saved Search | UPDATE\_WATCH\_FOLDER |
| Share Custom View | SHARE\_WATCH\_FOLDER |

Extension PropertiesAuthentication for Apps

- Privacy & Security
- Terms Of Use
- Trademarks
- Legal

Copyright © 2000–2026 JetBrains s.r.o.
