# How do the "Permissions" options work?

**URL:** <https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030>\
**Category:** Support\
**Created:** [August 6, 2021, 11:45am UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030 "2021-08-06T11:45:00Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![abernh](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/abernh/32/859_2.png) [@abernh](https://discourse.getcockpit.com/u/abernh)\
**Post date:** [August 6, 2021, 1:17pm UTC](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030/2 "2021-08-06T13:17:42Z")

</div>

The permissions are for access to the data via the API (and the admin interface) and they are split up into specific “actions”.

### Actions and their API endpoints

#### Collections

- Edit collection : `/api/collections/updateCollection/COLLECTION_NAME` + `{data: ...}`
- View entries : `/api/collections/entries/COLLECTION_NAME` / `/api/collections/entry/COLLECTION_NAME/ENTRY_ID`
- Edit entries : `/api/collections/save/COLLECTION_NAME` + `{data: {_id: ENTRY_ID, ...}}`
- Create entries : `/api/collections/save/COLLECTION_NAME` + `{data: {_id: undefined, ...}}`
- Delete entries : `/api/collections/remove/COLLECTION_NAME` + {filter: …}

#### Singletons

- Form : admin interface only; no api route - edit the singletons values
- Edit : admin interface only; no api route - edit the singletons fields
- Get data (like “view”) : `/api/singletons/get/SINGLETON_NAME[/FIELD_NAME]`

### Public (and other groups)

You can set those permissions on a group level.  
By default only the “public” group is shown; as soon as you have [other groups specified (in your `config.php`](https://discourse.getcockpit.com/t/where-to-create-user-groups/1182/7) ) you can set also permissions for those other groups; this also means if you have other groups than admin you are setting the permission for those group-users to access that data via the API as well as the admin interface (if the group has admin interface access).

_IMPORTANT_: If you enable any of the permissions to be public anyone can execute that action on your API without the need of a token or any authentication. E.g. “view entries” → this will make the whole contents of your collection available to anyone who wants to query it.

### Collection rule “scripts”

For “create”, “read”, “update”, “delete” you have the possibility to run the request through an additional script. Those are en/abled below the general permissions.

Those scripts are included when the request is processed and receive a `$context` of the query (data sent, filters set, etc) and allow you to edit that `$context` (filter, enhance, validate, …) before it is send to the user (on read) / the database (on write)

See

> <https://github.com/agentejo/cockpit/blob/568b0124352f6d27df359e8c19a70d2dd1961e87/modules/Collections/bootstrap.php#L659>

### Content preview

This can be found here [Missing documentation of Content Preview](https://discourse.getcockpit.com/t/missing-documentation-of-content-preview/1890)

---

_[View the full topic](https://discourse.getcockpit.com/t/how-do-the-permissions-options-work/2030)._