# User Roles & Permissions

# General

### Common Actions
These are the common actions that are widely throughout all of the platform service. Exceptions may occur and they will be described within the documentation of each service as declared here in this document.

- **Count**
- **List**
- **Read**
- **Create**
- **Update**
- **Delete**
- **Trash**
- **Restore**
- **Upload**
- **Download**
- **Start**
- **Stop**
- **Import**
- **Export**
- **Preview**
- **Validate**

### Current User Roles

- **sys_admin**
- **org_admin**
- **org_operator**
- **la_operator**

# Zypline API

### GraphQL DTO Types:
Notation: <PepTypeName> (<GraphQL type>)

- **Annotation (Annotation)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - Can create if the current user has `sys_admin` role **OR** current user is not `sys_admin` but the annotation is of type `User` **ELSE** reject.
- **UPDATE** - Users with `sys_admin` role can do anything. Users without `sys_admin` role can not change the type of the annotation and can update only unprotected fields (i.e. `isIssue`)
- **DELETE** - Users with `sys_admin` role can delete. Users without `sys_admin` role must have the `delete` right and the annotation must be of type `User`. They can not delete `System` annotations.

- **AuditLogs (AuditEventConnection)**
- **READ** - Users with `sys_admin` role cand see all audit logs. Users without `sys_admin` role are checked if they have access to the requested model type.

- **AudioTrack (AudioTrackProperties)**
- **UPDATE** - no condition
- **AutoQC (runAutoQC -> Workflow)**
- **EXECUTE** - no condition
- **AutoQCReport (AutoQcReport)**
- **LIST** - no condition
- **READ** - no condition
- **BacklotRequest (BackLotRequest)**
- **LIST** - no condition
- **READ** - no condition
- **BacklotRequestDetails (BacklotRequestDetails)**
- **READ** - no condition
- **Batch (Batch)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **UPDATE** - no condition
- **RESET** - no condition
- **SEND_DELIVERY_REPORT** - no condition
- **IMPORT** - no condition
- **DELETE** - has delete right
- **BugProfile (BugProfile)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **CaptionProfile (CaptionProfile)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **Clip (Clip)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** & **UPDATE** - The owner of the `inputFile` can create and update a `Clip`. The rule looks like: _If the input file is not read only AND the user belongs to an organization AND the user is the creator of the file THEN the user can create/modify Clip_
- **DELETE** - In addition to the rule from Create/Update the user also must have the `delete` right.
- **EXTRACT** - no condition
- **Comment (Comment)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **UPDATE** - no condition
- **CompositionDefinition (CompositionDefinition)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **UPDATE** - no condition
- **CompositionTemplate (CompositionTemplate)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **DeepAnalysis (runDeepAnalysis -> Workflow)**
- **EXECUTE** - no condition
- **DeliverableTemplate (DeliverableTemplate)**
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **Deliverable (Deliverable)**
- **READ** - no condition
- **DemuxProfile (DemuxProfile)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **Demux**
- **READ (demuxLanguage -> DemuxLanguage)** - no condition
- **READ (suggestDemux -> DemuxOptions)** - no condition
- **EXECUTE (demuxFile -> Workflow)** - no condition
- **DRMProvider (DRMProvider)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **ErrorStack (GraphQLString)**
- **READ** - is sys admin.
- **ExtractedMedia (ExtractedMedia)**
- **LIST** - no condition
- **READ** - no condition
- **DELETE** - has delete right
- **File**
- **LIST (File)** - no condition
- **READ (File)** - no condition
- **CREATE (File/Workflow)** - no condition
- **UPDATE (File)** - no condition
- **DELETE (File)** - has delete right
- **RESTORE (restoreFileFromTrash -> File)** - no condition
- **IMPORT_METADATA_FILE (importMetadataFile/importFileWithMetadata -> Workflow)** - no condition
- **CONFORM (startConforming -> ConformingResponse)** - no condition
- **ARCHIVE (File)** - no condition
- **UNARCHIVE (File)** - no condition
- **IMPORT_PKL_FILE (importPklFile -> Package)** - no condition
- **INGEST (File)** - no condition
- **IMPORT_TRACK_TAGS (importTrackTags -> Workflow)** - no condition
- **CREATE_THUMBNAIL (File)** - no condition
- **REVERSE_TRANSCODE (reverseTranscode -> Workflow)** - no condition
- **ENCODE_IAB (encodeIab -> Workflow)** - no condition
- **TRANSCRIBE (transcribeFile -> Workflow)** - no condition
- **TRANSCODE (transcodeFile -> Workflow)** - no condition
- **PREVIEW (FilePreviewUrl)** - is sysadmin or has download right and user's IP is whitelisted
- **DOWNLOAD (FileDownloadUrl)** - is sysadmin or has download right and user's IP is whitelisted
- **UPLOAD (startUpload -> FileUploadResponse)** - has upload right
- **FileDelivery (FileDelivery)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **FileDesignation (FileDesignation)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **FileFileDesignation (FileFileDesignationEdge)**
- **CREATE** - no condition
- **DELETE** - no condition
- **FileNamingConvention (FileNamingConvention)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **FileStats (FileCount) - deprecated**
- **READ** - no condition

- **ImageSequenceFrameProperties (ImageSequenceFrameProperties)**
- **READ** - no condition

- **IngestQcRule (IngestQcRule)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **Job (Job)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **UPDATE** - no condition
- **DELETE** - has delete right
- **EXECUTE** - no condition
- **CANCEL** - no condition

- **JobStats (JobCount) - deprecated**
- **READ** - no condition

- **Macro (Macro)**
- **LIST** - no condition
- **READ** - no condition
- **UPDATE** - is sys admin or org admin

- **MacroExecution (MacroExecution)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **CANCEL** - no condition
- **DELETE** - has delete right

- **Marker (Marker)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **UPDATE** - no condition
- **DELETE** - has delete right

- **MasterDisplayValues (MasterDisplayValues)**
- **READ** - no condition

- **Package (Package)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **UPDATE** - no condition
- **EXECUTE** - no condition
- **CANCEL** - no condition
- **TRANSCODE** - no condition
- **DELETE** - has delete right

- **PackageDelivery (PackageDelivery/Workflow)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition

- **Platform (Platform)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right

- **PlatformPackageTemplate (PlatformPackageTemplate)**
- **CREATE** - no condition
- **UPDATE** - no condition

- **Plugin (Plugin)**
- **LIST** - is sys admin
- **CREATE** - is sys admin or org admin.
- **DELETE** - is sys admin or org admin and has delete right

- **PluginsPage (PluginsPage)**
- **LIST** - is sys admin or org admin

- **QcProfile (QcProfile)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right

- **SidecarCaptions (File)**
- **LIST** - no condition
- **READ** - no condition

- **Slate (generateSlate -> Workflow)**
- **CREATE** - no condition

- **SmartAgent (SmartAgent)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **EXECUTE** - is sys admin or org admin

- **StoreFile (StoreFileConnection)**
- **LIST** - no condition

- **TimedTextProfile (TimedTextProfile)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **CONVERT** - no condition

- **Title (Title)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **UPDATE** - no condition
- **IMPORT_IMF** - no condition
- **SYNC** - no condition
- **DELETE** - has delete right

- **TitleDesignation (TitleDesignation)**
- **CREATE** - no condition
- **DELETE** - no condition

- **TitleStats (TitleCount) - deprecated**
- **READ** - no condition

- **Track (Track)**
- **READ** - no condition
- **UPDATE** - no condition

- **TrackFileDesignation (TrackFileDesignation)**
- **CREATE** - no condition
- **UPDATE** - no condition

- **TranscoderProfile (TranscoderProfile)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right
- **IMPORT** - is sys admin or org admin
- **EXPORT** - is sys admin or org admin

- **TranscoderProvider (TranscoderProvider)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right

- **TranscribeLanguages (TranscribeLanguages)**
- **READ** - no condition

- **TransferProvider (TransferProvider)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - is sys admin or org admin
- **UPDATE** - is sys admin or org admin
- **DELETE** - is sys admin or org admin and has delete right

- **RrtqTask (Task)**
- **LIST** - no condition

- **VideoTrack (VideoTrackProperties)**
- **UPDATE** - no condition

- **VirtualAsset (VirtualAsset)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **UPDATE** - no condition
- **DELETE** - has delete right

- **VirtualFolder (VirtualFolder)**
- **LIST** - no condition
- **READ** - no condition
- **CREATE** - no condition
- **UPDATE** - no condition
- **DELETE** - has delete right

- **VirtualFolderContent (VirtualFolderContent)**
- **READ** - no condition

- **XMEML (CompositionDefinition)**
- **IMPORT** - no condition

- **Workflow (Workflow)**
- **LIST** - no condition
- **READ** - no condition
- **CANCEL** - no condition
- **SWF_SIGNAL** - no condition
- **DELETE** - no condition

### Specific Service Actions
- ARCHIVE
- CANCEL
- CONFORM
- CONVERT
- CREATE_THUMBNAIL
- ENCODE_IAB
- EXECUTE
- EXPORT
- EXTRACT
- IMPORT
- IMPORT_METADATA_FILE
- IMPORT_PKL_FILE
- IMPORT_TRACK_TAGS
- INGEST
- IMPORT_IMF
- REVERSE_TRANSCODE
- RESET
- TRANSCRIBE
- TRANSCODE
- UNARCHIVE
- UPLOAD
- SEND_DELIVERY_REPORT
- SYNC
- SWF_SIGNAL

# Streaming API

### GraphQL DTO Types:
- **UniqueUsersAnalyticsMetric, ActiveSessionsAnalyticsMetric, RegistrationsAnalyticsMetric, AverageSessionTimeAnalyticsMetric, HoursWatchedPerUserAnalyticsMetric, NumberOfUsersByCountryAnalyticsMetric, NumberOfUsersByCityAnalyticsMetric, NumberOfUsersByAgeAnalyticsMetric, TopTitlesAnalyticsMetric, TopGroupsAnalyticsMetric**:
- **List**: No conditions;
- **CustomTypes.STREAMING_ANALYTICS_PDF**:
- **GENERATE**: No conditions;
- **DOWNLOAD**: No conditions;
- **CustomTypes.STREAMING_ANALYTICS_PDF_STATUS**:
- **READ**: No conditions;
- **Application**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **NODE**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **EDGE**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **DELETE**: No conditions;
- **REORDER**: No conditions;
- **CustomTypes.STREAMING_THUMBNAIL**:
- **READ**: No conditions;
- **CustomTypes.STREAMING_REINDEX**:
- **READ**: No conditions;
- **REINDEX**: No conditions;
- **CustomTypes.STREAMING_NODE_METADATA**:
- **LIST**: No conditions;
- **CustomTypes.STREAMING_DYNAMIC_COLLECTION**:
- **LIST**: No conditions;
- **NodeUser**:
- **LIST**: No conditions;
- **UserFavorite**:
- **LIST**: No conditions;
- **UserHistory**:
- **LIST**: No conditions;
- **VIEW_COUNT**: No conditions;
- **Install**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **Instance**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **EntityType**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **EmailTemplate**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **Export**:
- **CHECK**: No conditions;
- **DOWNLOAD**: No conditions;
- **GENERATE**: No conditions;
- **DELETE**: No conditions;
- **UserSsoConfig**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **LocatorMapper**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **Media**:
- **READ**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **PROCESS**: No conditions;
- **PROCESS_ALL**: No conditions;
- **MediaWorkflow**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **NotificationTopic**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **Notification**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **SEND**: No conditions;
- **NotificationHistory**:
- **LIST**: No conditions;
- **CustomTypes.STREAMING_DEVICE_SUBSCRIPTION**:
- **LIST**: No conditions;
- **CustomTypes.STREAMING_NOTIFICATION_METRICS**:
- **LIST**: No conditions;
- **CustomTypes.STREAMING_DEVICE**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **UNREGISTER_DEVICE**: No conditions;
- **SUBSCRIBE**: No conditions;
- **UNSUBSCRIBE**: No conditions;
- **Theme**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **SEND**: No conditions;
- **CREATE_DEFAULT_NODE_THEME_MAPPINGS**: No conditions;
- **CREATE_TIMED_NODE_THEME_MAPPINGS**: No conditions;
- **NodeTheme**:
- **LIST**: No conditions;
- **DELETE**: No conditions;
- **ProductNode**:
- **LIST**: No conditions;
- **UserListNode**:
- **LIST**: No conditions;
- **ADD_USER_LIST_NODE**: No conditions;
- **REMOVE_USER_LIST_NODE**: No conditions;
- **UserList**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **UserPool**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **UserGroup**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **UserGroupLink**:
- **CREATE**: No conditions;
- **DELETE**: No conditions;
- **REMOVE_USER_GROUP_LINK**: No conditions;
- **CustomTypes.STREAMING_USER_SUBSCRIPTION**:
- **LIST**: No conditions;
- **User**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **RESEND_USER_INVITATION**: No conditions;
- **RESET_USER_PASSWORD**: No conditions;
- **Product**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **CLONE**: No conditions;
- **ProductPlan**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **ProductCharge**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **DOWNLOAD**: No conditions;
- **SEND**: No conditions;
- **REFUND**: No conditions;
- **ProductCoupon**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **EXPIRE_COUPON**: No conditions;
- **REDEEM_PRODUCT_COUPON_FOR_USER**: No conditions;
- **ProductContent**:
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **DELETE**: No conditions;
- **SET_DEFAULT**: No conditions;
- **ProductSubscription**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **GRAND_SUBSCRIPTION**: No conditions;
- **CANCEL_PRODUCT_SUBSCRIPTION**: No conditions;
- **TERMINATE_PRODUCT_SUBSCRIPTION**: No conditions;
- **NodeTag**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **DELETE**: No conditions;
- **CustomTypes.STREAMING_ORGANIZATION**:
- **READ**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **INITIALIZE**: No conditions;
- **EXPORT**: No conditions;
- **IMPORT**: No conditions;
- **CHECK_IMPORT**: No conditions;
- **CustomTypes.STREAMING_SERVER_INFO**:
- **READ**: No conditions;
- **Setting**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **TranscodeMap**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **CREATE**: No conditions;
- **UPDATE**: No conditions;
- **DELETE**: No conditions;
- **Workflow**:
- **READ**: No conditions;
- **LIST**: No conditions;
- **DELETE**: No conditions;

### Specific Service Actions
- **ADD_USER_LIST_NODE**
- **GENERATE**
- **CANCEL_PRODUCT_SUBSCRIPTION**
- **CHECK**
- **CHECK_IMPORT**
- **CLONE**
- **CREATE_DEFAULT_NODE_THEME_MAPPINGS**
- **CREATE_TIMED_NODE_THEME_MAPPINGS**
- **EXPIRE_COUPON**
- **GRAND_SUBSCRIPTION**
- **INITIALIZE**
- **PROCESS**
- **PROCESS_ALL**
- **REDEEM_PRODUCT_COUPON_FOR_USER**
- **REMOVE_USER_GROUP_LINK**
- **REMOVE_USER_LIST_NODE**
- **REFUND**
- **REORDER**
- **REINDEX**
- **RESEND_USER_INVITATION**
- **RESET_USER_PASSWORD**
- **SEND**
- **SET_DEFAULT**
- **SUBSCRIBE**
- **TERMINATE_PRODUCT_SUBSCRIPTION**
- **UPSERT**
- **VIEW_COUNT**
- **UNREGISTER_DEVICE**
- **UNSUBSCRIBE**

# IAM Service

*`Warning`* This service still needs validating the rules described below!

### GraphQL DTO Types:
- **ApiKeys**:
- **List**: No conditions;
- **Create, Update**: Either the user has API Keys Access rights and for update, the key is owned by the user making the request, or the user needs `sys_admin` role;
- **Organization**:
- **Read, List, Update**: No conditions;
- **Create, Delete**: User needs `sys_admin` role;
- **IdentityProviders**:
- **Read**: No conditions;
- **User**:
- **Read, List**: No conditions;
- **ListSysUsers**: User needs `sys_admin` role;
- **Create, Trash, Restore, SetSysAdmin, ResetToken**: User needs `sys_admin` role;
- **Update**: No conditions;
- **AvatarUpload**:
- **Start**: No conditions;

### Specific Service Actions

- **SetSysAdmin**
- **ResetToken**
- **ListSysUsers**

# Metadata Service

### GraphQL DTO Types:
- **Attribute**:
- **Read, List**: No conditions;
- **Create, Update, Delete, Copy**: User needs `org_admin` role;
- **LimitationsByType**:
- **List**: No conditions;
- **AttributeValue**:
- **Read, List, Create, Update, Delete**: No conditions;
- **BulkAttributeValues**:
- **List, Update**: No conditions;
- **Entity**:
- **Read, List, Create, Update, Delete**: No conditions;
- **EntityAttributeAndValue**:
- **List**: No conditions;
- **EntityType**:
- **Read, List**: No conditions;
- **Create, Update, Delete, DissolveHierarchy**: User needs `org_admin` role;
- **MetadataExport**
- **Export**: No conditions;
- **MetadataImport**
- **Import**: No conditions;
- **MetadataTemplate**
- **Read, List, Preview, GenerateEntityContext**: No conditions;
- **Create, Update, Delete**: User needs `org_admin` role;
- **MetadataValidateSchema**
- **Validate**: No conditions;
- **MetadataValidationErrors**
- **Read**: No conditions;

### Specific Service Actions
- **Copy**
- **Upsert**
- **DissolveHierarchy**
- **GenerateEntityContext**

# Task Service

### GraphQL DTO Types:
- **TaskServiceHeadersType**:
- **Read**: No conditions;
- **TaskServiceTaskType**:
- **List, Read, TaskClose, TaskComplete, TaskOnHold, TaskReject, TaskReopen, TaskApprove**: No conditions;
- **Create, Delete**: User needs `org_operator` role;
- **Update**: Either tha task is assigned to the user making the request or the user needs `org_operator` role;
- **TaskServiceMediaItemType**:
- **List, Read**: No conditions;
- **Create, Update, Delete**: User needs `org_operator` role;

### Specific Service Actions
- **TaskComplete**
- **TaskOnHold**
- **TaskClose**
- **TaskApprove**: On FE it's used as an Approve actions but the mutation is called taskServiceResolveTask, check if it's the same action.
- **TaskReject**
- **TaskReopen**

# Notification Service

### GraphQL DTO Types:
- **NotificationUserSettingsType**:
- **Read, Update**: No conditions;
- **NotificationEvent**:
- **List, Count, MarkViewed**: No conditions;

### Specific Service Actions
- **MarkViewed**

# History Service

### GraphQL DTO Types:
- **HistoryType**:
- **List**: No conditions;

# Search Service

### GraphQL DTO Types:
- **SearchResult**:
- **Read**: No conditions;
- **SearchFilters**:
- **Read**: No conditions;
- **SearchSync**:
- **Start**: No conditions;

# Billing Service

### GraphQL DTO Types:
- **BillableEventUser**:
- **List**: No conditions;
- **BillableEvent**:
- **List**: No conditions;
- **Create**: No conditions. Used from other back-end services;
- **EC2ComputeCostEvent**, Used from other back-end services:
- **Create**: No conditions;
- **MediaConvertCostEvent**, Used from other back-end services:
- **Create**: No conditions;
- **RekognitionCostEvent**, Used from other back-end services:
- **Create**: No conditions;
- **AsperaCostEven**, Used from other back-end services:
- **Create**: No conditions;
- **HybrikCostEvent**, Used from other back-end services:
- **Create**: No conditions;
- **BatonCostEvent**, Used from other back-end services:
- **Create**: No conditions;