> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom role permissions reference

<Note> This is feature is only available if you are on the **Enterprise** tier or above. See [Astro Plans and Pricing](https://www.astronomer.io/pricing/).</Note>

This document contains all available permissions that you can assign to a [custom Deployment role](/docs/astro/customize-deployment-roles) or a [custom Dag role](/docs/astro/dag-level-access-control#create-a-custom-dag-role). Permissions are organized by scope and object.

## Deployment

* `deployment.get`: Get information about the Deployment, including its details and resource configurations.
* `deployment.update`: Update information about the Deployment, including its details and resource configurations.
* `deployment.delete`: Delete the Deployment.

## Deployment Agents

<Note>
  **Airflow 3**

  This feature is only available for Airflow 3.x Deployments.
</Note>

Remote Execution Agents are Airflow Workers, Triggerers, and Dag processors running in your remote environment with an Airflow 3 Deployment.

* `deployment.agents.get`: Able to get the information about Remote Execution Agents running in Remote Deployments.
* `deployment.agents.update`: Allow users with permissions to cordon and uncordon Remote Execution Agents in Remote Deployments.
* `deployment.agents.delete`: Allow users with permissions to delete Remote Execution Agents in Remote Deployments.

## Deployment Agents Tokens

<Note>
  **Airflow 3**

  This feature is only available for Airflow 3.x Deployments.
</Note>

Tokens used by external Airflow agents, including the Remote Execution Agent, to access Airflow APIs for remote task execution.

* `deployment.agentTokens.get`: View access tokens for Remote Agents.
* `deployment.agentTokens.create`: Create an access token to your Deployment for a Remote Execution Agent.
* `deployment.agentTokens.delete`: Delete access tokens for Remote Agents.

## Deployment Airflow AdminMenu

* `deployment.airflow.adminMenu.get`: View the **Admin** menu in the Airflow UI.

## Deployment Airflow Astronomer

* `deployment.airflow.astronomer.get`: View the **Astronomer** menu in the Airflow UI.

## Deployment Airflow AuditLog

* `deployment.airflow.auditLog.get`: View the **Audit Log** menu in the Airflow UI.

## Deployment Airflow Backfill

* `deployment.airflow.backfill.get`: View backfills in the Airflow UI.
* `deployment.airflow.backfill.create`: Create backfills in the Airflow UI.
* `deployment.airflow.backfill.update`: Update backfills in the Airflow UI.
* `deployment.airflow.backfill.delete`: Delete backfills in the Airflow UI.

## Deployment Airflow BrowseMenu

* `deployment.airflow.browseMenu.get`: View the **Browse** menu in the Airflow UI.

## Deployment Airflow ClusterActivity

* `deployment.airflow.clusterActivity.get`: View the **Cluster Activity** menu in the Airflow UI.

## Deployment Airflow Config

* `deployment.airflow.config.get`: View the **Config** menu in the Airflow UI.

## Deployment Airflow custom menu

* `deployment.airflow.customMenu.get`: Create and use custom plugins for the Airflow UI menu.

### Deployment Airflow Connection

* `deployment.airflow.connection.get`: View connections in the Airflow UI.
* `deployment.airflow.connection.create`: Create connections in the Airflow UI.
* `deployment.airflow.connection.update`: Update connections in the Airflow UI.
* `deployment.airflow.connection.delete`: Delete connections in the Airflow UI.

### Deployment Airflow dag

* `deployment.airflow.dag.get`: View dags in the Airflow UI.
* `deployment.airflow.dag.update`: Update dags in the Airflow UI.
* `deployment.airflow.dag.delete`: Delete dags in the Airflow UI.

## Deployment Airflow DagCode

* `deployment.airflow.dagCode.get`: View the source code for dags in the Airflow UI.

## Deployment Airflow DagDependencies

* `deployment.airflow.dagDependencies.get`: View the task dependencies for dags in the Airflow UI.

### Deployment Airflow DAGRun

* `deployment.airflow.dagRun.get`: View dag runs in the Airflow UI.
* `deployment.airflow.dagRun.create`: Create dag runs in the Airflow UI.
* `deployment.airflow.dagRun.update`: Update dag runs in the Airflow UI.
* `deployment.airflow.dagRun.delete`: Delete dag runs in the Airflow UI.

## Deployment Airflow Datasets

* `deployment.airflow.datasets.get`: View the datasets for dags in the Airflow UI.
* `deployment.airflow.datasets.create`: Create datasets in the Airflow UI.
* `deployment.airflow.datasets.delete`: Delete datasets in the Airflow UI.

## Deployment Airflow Docs

* `deployment.airflow.docs.get`: View the documentation for dags in the Airflow UI.

## Deployment Airflow HITL detail

* `deployment.airflow.hitlDetail.get`: View human-in-the-loop task details in the Airflow UI.
* `deployment.airflow.hitlDetail.update`: Approve human-in-the-loop task actions in the Airflow UI.

## Deployment Airflow ImportError

* `deployment.airflow.importError.get`: View any import errors for dags in the Airflow UI.

## Deployment Airflow Job

* `deployment.airflow.job.get`: View scheduler jobs in the Airflow UI.

## Deployment Airflow Plugin

* `deployment.airflow.plugin.get`: View plugins in the Airflow UI.

## Deployment Airflow Pool

* `deployment.airflow.pool.get`: View pools in the Airflow UI.
* `deployment.airflow.pool.create`: Create pools in the Airflow UI.
* `deployment.airflow.pool.update`: Update pools in the Airflow UI.
* `deployment.airflow.pool.delete`: Delete pools in the Airflow UI.

## Deployment Airflow Provider

* `deployment.airflow.provider.get`: View installed provider packages in the Airflow UI.

## Deployment Airflow RequiredActionsMenu

* `deployment.airflow.requiredActionsMenu.get`: View the **Required Actions** menu in the Airflow UI.

## Deployment Airflow SlaMiss

* `deployment.airflow.slaMiss.get`: View details about SLA misses in the Airflow UI.

## Deployment Airflow task

* `deployment.airflow.task.get`: View tasks in the Airflow UI.
* `deployment.airflow.task.create`: Create tasks in the Airflow UI.
* `deployment.airflow.task.update`: Update tasks in the Airflow UI.
* `deployment.airflow.task.delete`: Delete tasks in the Airflow UI.

## Deployment Airflow TaskInstance

* `deployment.airflow.taskInstance.get`: View task instances in the Airflow UI.
* `deployment.airflow.taskInstance.create`: Create task instances in the Airflow UI.
* `deployment.airflow.taskInstance.update`: Update task instances in the Airflow UI.
* `deployment.airflow.taskInstance.delete`: Delete task instances in the Airflow UI.

## Deployment Airflow TaskLog

* `deployment.airflow.taskLog.get`: View task logs in the Airflow UI.

## Deployment Airflow TaskReschedule

* `deployment.airflow.taskReschedule.get`: View task reschedules in the Airflow UI.

## Deployment Airflow Trigger

* `deployment.airflow.trigger.get`: View information about triggers in the Airflow UI.

## Deployment Airflow Variable

* `deployment.airflow.variable.get`: View variables in the Airflow UI.
* `deployment.airflow.variable.create`: Create variables in the Airflow UI.
* `deployment.airflow.variable.update`: Update variables in the Airflow UI.
* `deployment.airflow.variable.delete`: Delete variables in the Airflow UI.

## Deployment Airflow version

* `deployment.airflow.version.get`: View Dag version information in the Airflow UI.

## Deployment Airflow warning

* `deployment.airflow.warning.get`: View Dag warnings in the Airflow UI.
* `deployment.airflow.warning.delete`: Delete Dag warnings in the Airflow UI.

## Deployment Airflow Website

* `deployment.airflow.website.get`: Access the Airflow UI homepage.

## Deployment Airflow XCom

* `deployment.airflow.xcom.get`: View XComs data in the Airflow UI.
* `deployment.airflow.xcom.create`: Create XCom entries in the Airflow UI.
* `deployment.airflow.xcom.update`: Update XCom entries in the Airflow UI.
* `deployment.airflow.xcom.delete`: Delete XCom data in the Airflow UI.

## Deployment Alerts

* `deployment.alerts.get`: View configured Deployment alerts.
* `deployment.alerts.create`: Create Deployment-level Astro alerts in the Astro UI or through the Astro API.
* `deployment.alerts.update`: Update Deployment-level Astro alerts in the Astro UI or through the Astro API.
* `deployment.alerts.delete`: Delete Deployment-level Astro alerts in the Astro UI or through the Astro API.

## Deployment ApiTokens

* `deployment.apiTokens.get`: View Deployment API tokens in the Astro UI or through the Astro API.
* `deployment.apiTokens.create`: Create Deployment API tokens in the Astro UI or through the Astro API.
* `deployment.apiTokens.update`: Update Deployment API tokens in the Astro UI or through the Astro API.
* `deployment.apiTokens.delete`: Delete Deployment API tokens in the Astro UI or through the Astro API.
* `deployment.apiTokens.rotate`: Rotate Deployment API tokens in the Astro UI or through the Astro API.

## Deployment Deploys

* `deployment.deploys.get`: View deploy history for the Deployment in the Astro UI or through the Astro API.
* `deployment.deploys.create`: Make Deploys to the Deployment.
* `deployment.deploys.update`: Roll back deploys to the Deployment.

## Deployment EnvObjects

* `deployment.envObjects.get`: View Airflow objects created in the Astro **Environments** page.
* `deployment.envObjects.create`: Create Airflow objects in the Astro **Environments** page.
* `deployment.envObjects.update`: Update Airflow objects in the Astro **Environments** page.
* `deployment.envObjects.delete`: Delete Airflow objects in the Astro **Environments** page.

## Deployment Image

* `deployment.image.push`: Push an image to the Deployment.
* `deployment.image.pull`: Pull the Deployment's image.

<Note>
  `astro deploy` checks these permissions when it runs. Pushing an image often requires both `deployment.image.push` and `deployment.image.pull`, because the push can reference pieces of a previously pushed image.
</Note>

## Deployment incidents

* `deployment.incidents.get`: View incidents affecting the Deployment in the Astro UI.

## Deployment Logs

* `deployment.logs.get`: View Deployment logs in the Astro UI.

## Deployment Metrics

* `deployment.metrics.get`: View Deployment **Analytics** in the Astro UI.

## Deployment notification channels

* `deployment.notificationChannels.get`: View notification channels configured for the Deployment.
* `deployment.notificationChannels.create`: Create notification channels for the Deployment.
* `deployment.notificationChannels.update`: Update notification channels for the Deployment.
* `deployment.notificationChannels.delete`: Delete notification channels for the Deployment.

## Deployment Observability

* `deployment.observability.event.create`: Upload OpenLineage events.
* `deployment.observability.metrics.create`: Upload OpenLineage metrics.

## Deployment Teams

* `deployment.teams.get`: View Teams belonging to a Deployment.
* `deployment.teams.update`: Update Team membership to a Deployment.

## Deployment Users

* `deployment.users.get`: View users belonging to a Deployment.
* `deployment.users.update`: Update user membership to a Deployment.

## Deployment webhook

* `deployment.webhook.get`: View webhooks configured for the Deployment.
* `deployment.webhook.create`: Create webhooks for the Deployment.
* `deployment.webhook.update`: Update webhooks for the Deployment.
* `deployment.webhook.delete`: Delete webhooks for the Deployment.

## Dag scope permissions

The following permissions are available when creating a custom role with the **Scope** set to **Dag**. Unlike Deployment-scope permissions that apply to all Dags in a Deployment, Dag-scope permissions apply only to the Dags that the role is bound to by Dag tag or Dag ID. See [Dag-level access control](/docs/astro/dag-level-access-control) for more information about creating and assigning custom Dag roles.

### Dag Airflow AuditLog

* `dag.airflow.auditLog.get`: View the audit log for the assigned Dags.

### Dag Airflow Dag

* `dag.airflow.dag.get`: View the assigned Dags in the Airflow UI.
* `dag.airflow.dag.update`: Update the assigned Dags in the Airflow UI.
* `dag.airflow.dag.delete`: Delete the assigned Dags in the Airflow UI.

### Dag Airflow DagCode

* `dag.airflow.dagCode.get`: View the source code for the assigned Dags in the Airflow UI.

### Dag Airflow DagDependencies

* `dag.airflow.dagDependencies.get`: View the task dependencies for the assigned Dags in the Airflow UI.

### Dag Airflow DagRun

* `dag.airflow.dagRun.get`: View Dag runs for the assigned Dags in the Airflow UI.
* `dag.airflow.dagRun.create`: Create Dag runs for the assigned Dags in the Airflow UI.
* `dag.airflow.dagRun.update`: Update Dag runs for the assigned Dags in the Airflow UI.
* `dag.airflow.dagRun.delete`: Delete Dag runs for the assigned Dags in the Airflow UI.

### Dag Airflow HitlDetail

* `dag.airflow.hitlDetail.get`: View human-in-the-loop task details for the assigned Dags.
* `dag.airflow.hitlDetail.update`: Update human-in-the-loop task details for the assigned Dags.

### Dag Airflow Task

* `dag.airflow.task.get`: View tasks for the assigned Dags in the Airflow UI.

### Dag Airflow TaskInstance

* `dag.airflow.taskInstance.get`: View task instances for the assigned Dags in the Airflow UI.
* `dag.airflow.taskInstance.update`: Update task instances for the assigned Dags in the Airflow UI.
* `dag.airflow.taskInstance.delete`: Delete task instances for the assigned Dags in the Airflow UI.

### Dag Airflow TaskLog

* `dag.airflow.taskLog.get`: View task logs for the assigned Dags in the Airflow UI.

### Dag Airflow Version

* `dag.airflow.version.get`: View version details for the assigned Dags.

### Dag Airflow Warning

* `dag.airflow.warning.get`: View warnings for the assigned Dags.

### Dag Airflow Xcom

* `dag.airflow.xcom.get`: View XCom data for the assigned Dags in the Airflow UI.
* `dag.airflow.xcom.create`: Create XCom entries for the assigned Dags in the Airflow UI.
* `dag.airflow.xcom.update`: Update XCom entries for the assigned Dags in the Airflow UI.