Skip to main content

requiresPermission

Machine-readable auth scope required to call this field. Enforcement is via server-side guards, not directive execution; super admins bypass org/app permission checks. The field description carries the same requirement in prose.

directive @requiresPermission(
  scope: String!
  permission: String!
  scopeArg: String
) on FIELD_DEFINITION

Arguments​

requiresPermission.scope ● String! non-null scalar​

Permission scope: "org" | "app" | "operator" | "super_admin" | "group" | "runtime" | "authenticated".

requiresPermission.permission ● String! non-null scalar​

The required permission key (an org/group/runtime permission key, or a platform flag like is_operator / is_super_admin).

requiresPermission.scopeArg ● String scalar​

GraphQL argument path holding the id the permission is checked against (e.g. "orgId", "input.appId", "groupId").