diff --git a/src/content/ace/getting-started/account-setup.mdx b/src/content/ace/getting-started/account-setup.mdx index 4d7e0ef314c..f56b32580bf 100644 --- a/src/content/ace/getting-started/account-setup.mdx +++ b/src/content/ace/getting-started/account-setup.mdx @@ -5,7 +5,7 @@ date: Last Modified metadata: description: "Set up your Chainlink ACE account: create an organization on app.chain.link, get your API key, create CRE Connect Wallets, and prepare for your first ACE deployment." datePublished: "2026-03-31" - lastModified: "2026-10-20" + lastModified: "2026-10-26" --- import { Aside, ClickToZoom, MethodTabs } from "@components" @@ -51,35 +51,29 @@ Share your Organization ID with your Chainlink contact so they can enable the AC Once your account has been provisioned for the ACE service, create an API key. - ## Prerequisites - You must be logged in to app.chain.link - You must have a role that includes the invite permission, such as Platform Admin or Owner -- The email addresses you're inviting must belong to whitelisted domains ## Step 1: Navigate to Organization settings -In the top navbar, click on your account icon, and then navigate to **"Org settings"**. +In the top navbar, click on your account icon, and then navigate to **Org settings**. ## Step 3: Start the invitation process -Click the **"Invite member"** link in the top right corner. +Click the **Invite member** link in the top right corner. ## Step 5: Send invitations -Once you've set all the roles you want to define for the invited member, click the **"Send invite"** button in the bottom right corner. +Once you've set all the roles you want to define for the invited member, click the **Send invite** button in the bottom right corner. - The email addresses you invite must belong to domains that are whitelisted for CRE access. If an invited member's - domain is not whitelisted, they won't be able to complete the account creation process. - +1. **Access**: They'll immediately have access to your organization's resources, according to the roles you set. ## Related guides diff --git a/src/content/chainlink-platform/rbac.mdx b/src/content/chainlink-platform/rbac.mdx index ccea5b2c6f1..3a6543fe0e8 100644 --- a/src/content/chainlink-platform/rbac.mdx +++ b/src/content/chainlink-platform/rbac.mdx @@ -6,7 +6,7 @@ metadata: title: "RBAC (Role-Based Access Control)" description: "Learn how role-based access control (RBAC) works on the Chainlink Platform, including the roles available for each product and how to manage them." datePublished: "2026-10-15" - lastModified: "2026-10-15" + lastModified: "2026-10-26" --- import { Aside, ProductOnly, ProductSection } from "@components" @@ -23,47 +23,53 @@ Each organization member is assigned a role for each product. The role determine ## The Owner role -The first user to create an organization is automatically assigned the **Owner** role. The Owner role includes every permission for every product, including all future products. This covers: +The first user to create an organization is automatically assigned the Owner role. The Owner role includes every permission for every product, including all future products. This covers: - Managing members and their roles for every product - Creating and managing API keys -- Managing organization settings, billing, and addresses +- Managing organization settings and addresses There is exactly one Owner per organization, and the Owner role cannot be transferred. ## Roles and permissions -The tables below list the permissions included in each role. A check mark indicates that the role includes the permission. The Owner role includes every permission in every table. +Each product section below starts with a summary of its roles, followed by a table of the permissions each role includes. The **Name** column matches the label shown in the app when you preview a role's permissions or select API key permissions. A check mark indicates that the role includes the permission. The Owner role includes every permission in every table. + +### Reading permission IDs + +Each permission has an ID in the format `product:resource:action`. You see these IDs when you choose API key permissions, and in error messages when a request is missing a permission. Most IDs follow the same few patterns: + +- **`read`** permissions let you view a resource. **`write`** permissions let you create and update it. +- **`archive:write`** permissions let you archive a resource. Archiving is separate from `write` because archiving some resources also affects everything built on them. For this reason, some roles can create and update a resource but not archive it. +- A suffix after a slash limits a permission to one scope. For example, `platform:member_role:write/cre` allows changing CRE roles only, and `platform:member_role:write/*` allows changing roles for every product. +- Permissions that start with `platform:` but end with a product scope, such as `platform:limits:write/cre`, are organization-level permissions limited to that product. They appear in that product's table. ### Chainlink Platform -Chainlink Platform roles control access to organization-level features such as members, API keys, addresses, billing, and limits. - -| Name | Action | Permission ID | Admin | User | -| --------------------- | ------ | ---------------------------------------- | ----- | ---- | -| Organization | Read | `platform:organization:read` | ✓ | ✓ | -| Organization | Write | `platform:organization:write` | ✓ | | -| Billing | Read | `platform:billing:read/*` | ✓ | ✓ | -| Billing | Write | `platform:billing:write/*` | ✓ | | -| Payments | Read | `platform:payments:read` | ✓ | ✓ | -| Payments | Write | `platform:payments:write` | ✓ | | -| Member | Read | `platform:member:read` | ✓ | ✓ | -| Member invite | Write | `platform:member_invite:write` | ✓ | | -| Member | Write | `platform:member:write` | ✓ | | -| Member role | Write | `platform:member_role:write/*` | ✓ | | -| Owner address | Read | `platform:owner_address:read` | ✓ | ✓ | -| Owner address | Write | `platform:owner_address:write` | ✓ | | -| API key | Read | `platform:api_key:read` | ✓ | ✓ | -| API key | Write | `platform:api_key:write` | ✓ | ✓ | -| Limits | Read | `platform:limits:read/platform` | ✓ | ✓ | -| Limits | Write | `platform:limits:write/platform` | ✓ | | -| Owner address linking | Write | `platform:owner_address:linking:write/*` | | | -| Limits | Read | `platform:limits:read/*` | | | -| Limits | Write | `platform:limits:write/*` | | | - -The last three permissions in the table are cross-product permissions that no Platform role includes. Product roles grant their product-scoped versions instead: for example, the CRE Admin role includes `platform:owner_address:linking:write/cre` and `platform:limits:write/cre`. +Chainlink Platform roles control access to organization-level features such as members, API keys, addresses, and limits. Every member has a Platform role. + +| Role | Description | +| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------- | +| Admin | Full access to manage the Chainlink Platform for your organization: invite and remove members, change any member's roles, and manage API keys. | +| User | For developers and operations team members. Can view organization information and members, and can view and create API keys. | + +| Name | Permission | Description | Admin | User | +| --------------------------------- | -------------------------------- | ----------------------------------------------------------------- | ----- | ---- | +| Organization: Read | `platform:organization:read` | View organization information. | ✓ | ✓ | +| Organization: Write | `platform:organization:write` | Edit organization information. | ✓ | | +| Member: Read | `platform:member:read` | View the members of the organization. | ✓ | ✓ | +| Member invite: Write | `platform:member_invite:write` | Invite new members to the organization. | ✓ | | +| Member: Write | `platform:member:write` | Remove members from the organization. | ✓ | | +| Member role: Write (All products) | `platform:member_role:write/*` | Change members' roles for every product. | ✓ | | +| Owner address: Read | `platform:owner_address:read` | View the organization's addresses in the address book. | ✓ | ✓ | +| API key: Read | `platform:api_key:read` | View the organization's API keys. | ✓ | ✓ | +| API key: Write | `platform:api_key:write` | Create and edit API keys. | ✓ | ✓ | +| Limits: Read (Platform) | `platform:limits:read/platform` | View organization-level limits, such as the maximum overdraft. | ✓ | ✓ | +| Limits: Write (Platform) | `platform:limits:write/platform` | Change organization-level limits that support self-serve changes. | ✓ | | + +Only the Owner can change limits for every product (`platform:limits:write/*`). Product Admin roles include the product-scoped version instead. For example, the CRE Admin role includes `platform:limits:write/cre`. Only limits that support self-serve changes can be changed this way. To change other limits, contact Chainlink. @@ -73,18 +79,24 @@ The last three permissions in the table are cross-product permissions that no Pl CRE roles control access to workflows, secrets, limits, and workflow owner addresses. -| Name | Action | Permission ID | Admin | Developer | Viewer | -| --------------------- | ------ | ------------------------------------------ | ----- | --------- | ------ | -| Workflow | Read | `cre:workflow:read` | ✓ | ✓ | ✓ | -| Workflow artifact | Read | `cre:workflow:artifact:read` | ✓ | ✓ | ✓ | -| Workflow artifact | Write | `cre:workflow:artifact:write` | ✓ | ✓ | | -| Workflow | Write | `cre:workflow:write/private_registry` | ✓ | ✓ | | -| Secret | Read | `cre:secret:read` | ✓ | ✓ | ✓ | -| Secret | Write | `cre:secret:write` | ✓ | ✓ | | -| Member role | Write | `platform:member_role:write/cre` | ✓ | | | -| Owner address linking | Write | `platform:owner_address:linking:write/cre` | ✓ | | | -| Limits | Read | `platform:limits:read/cre` | ✓ | ✓ | ✓ | -| Limits | Write | `platform:limits:write/cre` | ✓ | | | +| Role | Description | +| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Admin | Full CRE access, including managing secrets, changing CRE limits and roles, and linking workflow owner addresses, which is required to deploy workflows to the onchain registry. | +| Developer | Deploy, pause, and delete workflows in the private registry, and manage secrets. Cannot link workflow owner addresses, so cannot deploy to the onchain registry. | +| Viewer | View-only access to CRE, for monitoring workflows in the UI. | + +| Name | Permission | Description | Admin | Developer | Viewer | +| ---------------------------------- | ------------------------------------------ | -------------------------------------------------------------------------------------------------------- | ----- | --------- | ------ | +| Workflow: Read | `cre:workflow:read` | View workflows. | ✓ | ✓ | ✓ | +| Workflow artifact: Read | `cre:workflow:artifact:read` | Download workflow artifacts. | ✓ | ✓ | ✓ | +| Workflow artifact: Write | `cre:workflow:artifact:write` | Upload workflow artifacts, which is required to deploy a workflow. | ✓ | ✓ | | +| Workflow: Write (Private registry) | `cre:workflow:write/private_registry` | Deploy, pause, activate, and delete workflows in the private registry. | ✓ | ✓ | | +| Secret: Read | `cre:secret:read` | List secrets. | ✓ | ✓ | ✓ | +| Secret: Write | `cre:secret:write` | Create, update, and delete secrets. | ✓ | ✓ | | +| Owner address linking: Write (CRE) | `platform:owner_address:linking:write/cre` | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. | ✓ | | | +| Limits: Read (CRE) | `platform:limits:read/cre` | View CRE limits, such as the maximum spend per workflow execution. | ✓ | ✓ | ✓ | +| Limits: Write (CRE) | `platform:limits:write/cre` | Change CRE limits that support self-serve changes, such as the maximum spend per workflow execution. | ✓ | | | +| Member role: Write (CRE) | `platform:member_role:write/cre` | Change members' CRE roles. | ✓ | | | @@ -94,83 +106,94 @@ CRE roles control access to workflows, secrets, limits, and workflow owner addre ACE roles control access to policy engines, policies, targets, identities, evaluations, and active monitoring. +| Role | Description | +| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Admin | Full ACE access, including archiving policy engines and registries, granting cross-org access, and changing members' ACE roles. | +| Operator | Create and manage policies, targets, identities, evaluations, and active monitoring. Cannot archive policy engines, registries, extractors, or policy types, create wallets, or grant cross-org access. | +| Viewer | View-only access to ACE. | + **Policy manager** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ------------------------------------- | ------ | ------------------------------------------------- | ----- | -------- | ------ | -| Policy manager policy engine | Read | `ace:policy_manager:policy_engine:read` | ✓ | ✓ | ✓ | -| Policy manager policy engine | Write | `ace:policy_manager:policy_engine:write` | ✓ | ✓ | | -| Policy manager policy engine archive | Write | `ace:policy_manager:policy_engine:archive:write` | ✓ | | | -| Policy manager policy | Read | `ace:policy_manager:policy:read` | ✓ | ✓ | ✓ | -| Policy manager policy | Write | `ace:policy_manager:policy:write` | ✓ | ✓ | | -| Policy manager policy archive | Write | `ace:policy_manager:policy:archive:write` | ✓ | ✓ | | -| Policy manager target | Read | `ace:policy_manager:target:read` | ✓ | ✓ | ✓ | -| Policy manager target | Write | `ace:policy_manager:target:write` | ✓ | ✓ | | -| Policy manager target archive | Write | `ace:policy_manager:target:archive:write` | ✓ | ✓ | | -| Policy manager target access | Read | `ace:policy_manager:target_access:read` | ✓ | | | -| Policy manager target access | Write | `ace:policy_manager:target_access:write` | ✓ | | | -| Policy manager implementation | Read | `ace:policy_manager:implementation:read` | ✓ | ✓ | ✓ | -| Policy manager implementation | Write | `ace:policy_manager:implementation:write` | ✓ | ✓ | | -| Policy manager implementation archive | Write | `ace:policy_manager:implementation:archive:write` | ✓ | | | +| Name | Permission | Description | Admin | Operator | Viewer | +| -------------------------------------------- | ------------------------------------------------- | --------------------------------------------------------------------------------------- | ----- | -------- | ------ | +| Policy manager policy engine: Read | `ace:policy_manager:policy_engine:read` | Read policy engines. | ✓ | ✓ | ✓ | +| Policy manager policy engine: Write | `ace:policy_manager:policy_engine:write` | Create and update policy engine. | ✓ | ✓ | | +| Policy manager policy engine archive: Write | `ace:policy_manager:policy_engine:archive:write` | Archive policy engine (affects everything deployed under it). | ✓ | | | +| Policy manager policy: Read | `ace:policy_manager:policy:read` | Read policies and data validator instances. | ✓ | ✓ | ✓ | +| Policy manager policy: Write | `ace:policy_manager:policy:write` | Create and update policy and data validator instances. | ✓ | ✓ | | +| Policy manager policy archive: Write | `ace:policy_manager:policy:archive:write` | Archive policy and data validator instances. | ✓ | ✓ | | +| Policy manager target: Read | `ace:policy_manager:target:read` | Read targets and their protections. | ✓ | ✓ | ✓ | +| Policy manager target: Write | `ace:policy_manager:target:write` | Create and update target and its protections. | ✓ | ✓ | | +| Policy manager target archive: Write | `ace:policy_manager:target:archive:write` | Archive target and its protections. | ✓ | ✓ | | +| Policy manager target access: Read | `ace:policy_manager:target_access:read` | Read a target's cross-org evaluation access grants. | ✓ | | | +| Policy manager target access: Write | `ace:policy_manager:target_access:write` | Grant and revoke cross-org evaluation access to a target. | ✓ | | | +| Policy manager implementation: Read | `ace:policy_manager:implementation:read` | Read extractors and policy types. | ✓ | ✓ | ✓ | +| Policy manager implementation: Write | `ace:policy_manager:implementation:write` | Create and update extractor or policy type (updates affect every instance built on it). | ✓ | ✓ | | +| Policy manager implementation archive: Write | `ace:policy_manager:implementation:archive:write` | Archive extractor or policy type (affects every instance built on it). | ✓ | | | **Identity manager** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------------------------- | ------ | --------------------------------------------- | ----- | -------- | ------ | -| Identity manager registry | Read | `ace:identity_manager:registry:read` | ✓ | ✓ | ✓ | -| Identity manager registry | Write | `ace:identity_manager:registry:write` | ✓ | ✓ | | -| Identity manager registry archive | Write | `ace:identity_manager:registry:archive:write` | ✓ | | | -| Identity manager registry access | Read | `ace:identity_manager:registry_access:read` | ✓ | | | -| Identity manager registry access | Write | `ace:identity_manager:registry_access:write` | ✓ | | | -| Identity manager identity | Read | `ace:identity_manager:identity:read` | ✓ | ✓ | ✓ | -| Identity manager identity | Write | `ace:identity_manager:identity:write` | ✓ | ✓ | | -| Identity manager identity archive | Write | `ace:identity_manager:identity:archive:write` | ✓ | ✓ | | - -**Reporting and evaluation** - -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------------- | ------ | -------------------------------- | ----- | -------- | ------ | -| Reporting policy | Read | `ace:reporting:policy:read` | ✓ | ✓ | ✓ | -| Reporting identity | Read | `ace:reporting:identity:read` | ✓ | ✓ | ✓ | -| Reporting target | Read | `ace:reporting:target:read` | ✓ | ✓ | ✓ | -| Reporting transaction | Read | `ace:reporting:transaction:read` | ✓ | ✓ | ✓ | -| Reporting permit | Read | `ace:reporting:permit:read` | ✓ | ✓ | ✓ | -| Reporting registry | Read | `ace:reporting:registry:read` | ✓ | ✓ | ✓ | -| Evaluation permit | Read | `ace:evaluation:permit:read` | ✓ | ✓ | ✓ | -| Evaluation permit | Write | `ace:evaluation:permit:write` | ✓ | ✓ | | +| Name | Permission | Description | Admin | Operator | Viewer | +| ---------------------------------------- | --------------------------------------------- | ------------------------------------------------------------------------------- | ----- | -------- | ------ | +| Identity manager registry: Read | `ace:identity_manager:registry:read` | Read identity and credential registries, and credential types. | ✓ | ✓ | ✓ | +| Identity manager registry: Write | `ace:identity_manager:registry:write` | Create and update identity or credential registry, and credential types. | ✓ | ✓ | | +| Identity manager registry archive: Write | `ace:identity_manager:registry:archive:write` | Archive identity or credential registry (affects everything deployed under it). | ✓ | | | +| Identity manager registry access: Read | `ace:identity_manager:registry_access:read` | Read a registry's cross-org access grants. | ✓ | | | +| Identity manager registry access: Write | `ace:identity_manager:registry_access:write` | Grant and revoke cross-org read access to a registry. | ✓ | | | +| Identity manager identity: Read | `ace:identity_manager:identity:read` | Read identities and credentials. | ✓ | ✓ | ✓ | +| Identity manager identity: Write | `ace:identity_manager:identity:write` | Create and update identity, and assign credentials. | ✓ | ✓ | | +| Identity manager identity archive: Write | `ace:identity_manager:identity:archive:write` | Archive identity and credentials. | ✓ | ✓ | | + +**Reporting** + +| Name | Permission | Description | Admin | Operator | Viewer | +| --------------------------- | -------------------------------- | ------------------------------------------------- | ----- | -------- | ------ | +| Reporting policy: Read | `ace:reporting:policy:read` | Read the reporting service's policy view. | ✓ | ✓ | ✓ | +| Reporting identity: Read | `ace:reporting:identity:read` | Read the reporting service's identity view. | ✓ | ✓ | ✓ | +| Reporting target: Read | `ace:reporting:target:read` | Read the reporting service's target view. | ✓ | ✓ | ✓ | +| Reporting transaction: Read | `ace:reporting:transaction:read` | Read the reporting service's transaction view. | ✓ | ✓ | ✓ | +| Reporting permit: Read | `ace:reporting:permit:read` | Read the reporting service's permit view. | ✓ | ✓ | ✓ | +| Reporting registry: Read | `ace:reporting:registry:read` | Read the reporting service's registry usage view. | ✓ | ✓ | ✓ | + +**Evaluation** + +| Name | Permission | Description | Admin | Operator | Viewer | +| ------------------------ | ----------------------------- | ------------------------- | ----- | -------- | ------ | +| Evaluation permit: Read | `ace:evaluation:permit:read` | Read evaluation permits. | ✓ | ✓ | ✓ | +| Evaluation permit: Write | `ace:evaluation:permit:write` | Create evaluation permit. | ✓ | ✓ | | **Core** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------- | ------ | -------------------------- | ----- | -------- | ------ | -| Core org config | Read | `ace:core:org_config:read` | ✓ | ✓ | ✓ | -| Core network | Read | `ace:core:network:read` | ✓ | ✓ | ✓ | -| Core wallet | Read | `ace:core:wallet:read` | ✓ | ✓ | ✓ | -| Core wallet | Write | `ace:core:wallet:write` | ✓ | | | +| Name | Permission | Description | Admin | Operator | Viewer | +| --------------------- | -------------------------- | -------------------------- | ----- | -------- | ------ | +| Core org config: Read | `ace:core:org_config:read` | Read organization details. | ✓ | ✓ | ✓ | +| Core network: Read | `ace:core:network:read` | Read supported networks. | ✓ | ✓ | ✓ | +| Core wallet: Read | `ace:core:wallet:read` | Read wallets. | ✓ | ✓ | ✓ | +| Core wallet: Write | `ace:core:wallet:write` | Create wallet. | ✓ | | | **Active monitoring** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ------------------------------------ | ------ | ------------------------------------------------ | ----- | -------- | ------ | -| Active monitoring action variable | Read | `ace:active_monitoring:action_variable:read` | ✓ | ✓ | ✓ | -| Active monitoring contract group | Read | `ace:active_monitoring:contract_group:read` | ✓ | ✓ | ✓ | -| Active monitoring contract group | Write | `ace:active_monitoring:contract_group:write` | ✓ | ✓ | | -| Active monitoring rule group | Read | `ace:active_monitoring:rule_group:read` | ✓ | ✓ | ✓ | -| Active monitoring rule group | Write | `ace:active_monitoring:rule_group:write` | ✓ | ✓ | | -| Active monitoring monitored address | Read | `ace:active_monitoring:monitored_address:read` | ✓ | ✓ | ✓ | -| Active monitoring monitored address | Write | `ace:active_monitoring:monitored_address:write` | ✓ | ✓ | | -| Active monitoring screening interval | Read | `ace:active_monitoring:screening_interval:read` | ✓ | ✓ | ✓ | -| Active monitoring screening interval | Write | `ace:active_monitoring:screening_interval:write` | ✓ | ✓ | | -| Active monitoring decision log | Read | `ace:active_monitoring:decision_log:read` | ✓ | ✓ | ✓ | -| Active monitoring decision log | Write | `ace:active_monitoring:decision_log:write` | ✓ | ✓ | | -| Active monitoring provider api key | Read | `ace:active_monitoring:provider_api_key:read` | ✓ | ✓ | ✓ | -| Active monitoring provider api key | Write | `ace:active_monitoring:provider_api_key:write` | ✓ | | | +| Name | Permission | Description | Admin | Operator | Viewer | +| ------------------------------------------- | ------------------------------------------------ | --------------------------------------------------- | ----- | -------- | ------ | +| Active monitoring action variable: Read | `ace:active_monitoring:action_variable:read` | Read action variables. | ✓ | ✓ | ✓ | +| Active monitoring contract group: Read | `ace:active_monitoring:contract_group:read` | Read contract groups. | ✓ | ✓ | ✓ | +| Active monitoring contract group: Write | `ace:active_monitoring:contract_group:write` | Create contract groups. | ✓ | ✓ | | +| Active monitoring rule group: Read | `ace:active_monitoring:rule_group:read` | Read rule groups. | ✓ | ✓ | ✓ | +| Active monitoring rule group: Write | `ace:active_monitoring:rule_group:write` | Create and update rule groups. | ✓ | ✓ | | +| Active monitoring monitored address: Read | `ace:active_monitoring:monitored_address:read` | Read monitored addresses. | ✓ | ✓ | ✓ | +| Active monitoring monitored address: Write | `ace:active_monitoring:monitored_address:write` | Add addresses to the screening watch list. | ✓ | ✓ | | +| Active monitoring screening interval: Read | `ace:active_monitoring:screening_interval:read` | Read the screening interval. | ✓ | ✓ | ✓ | +| Active monitoring screening interval: Write | `ace:active_monitoring:screening_interval:write` | Set, remove, start and stop the screening interval. | ✓ | ✓ | | +| Active monitoring decision log: Read | `ace:active_monitoring:decision_log:read` | Read decision logs. | ✓ | ✓ | ✓ | +| Active monitoring decision log: Write | `ace:active_monitoring:decision_log:write` | Dismiss and enforce decision logs. | ✓ | ✓ | | +| Active monitoring provider API key: Read | `ace:active_monitoring:provider_api_key:read` | Read screening-provider API key metadata. | ✓ | ✓ | ✓ | +| Active monitoring provider API key: Write | `ace:active_monitoring:provider_api_key:write` | Set and remove screening-provider API keys. | ✓ | ✓ | | **Administration** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ----------- | ------ | -------------------------------- | ----- | -------- | ------ | -| Member role | Write | `platform:member_role:write/ace` | ✓ | | | +| Name | Permission | Description | Admin | Operator | Viewer | +| ------------------------ | -------------------------------- | -------------------------- | ----- | -------- | ------ | +| Member role: Write (ACE) | `platform:member_role:write/ace` | Change members' ACE roles. | ✓ | | | @@ -180,25 +203,63 @@ ACE roles control access to policy engines, policies, targets, identities, evalu CRE Connect roles control access to operations, wallets, channels, watchers, queries, and events. -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ------------------- | ------ | --------------------------------- | ----- | -------- | ------ | -| Network | Read | `crec:network:read` | ✓ | ✓ | ✓ | -| Operation | Read | `crec:operation:read` | ✓ | ✓ | ✓ | -| Operation | Write | `crec:operation:write` | ✓ | ✓ | | -| Operation signature | Write | `crec:operation:signature:write` | ✓ | ✓ | | -| Wallet | Read | `crec:wallet:read` | ✓ | ✓ | ✓ | -| Wallet | Write | `crec:wallet:write` | ✓ | ✓ | | -| Wallet archive | Write | `crec:wallet:archive:write` | ✓ | | | -| Channel | Read | `crec:channel:read` | ✓ | ✓ | ✓ | -| Channel | Write | `crec:channel:write` | ✓ | ✓ | | -| Channel archive | Write | `crec:channel:archive:write` | ✓ | | | -| Watcher | Read | `crec:watcher:read` | ✓ | ✓ | ✓ | -| Watcher | Write | `crec:watcher:write` | ✓ | ✓ | | -| Watcher archive | Write | `crec:watcher:archive:write` | ✓ | | | -| Query | Read | `crec:query:read` | ✓ | ✓ | ✓ | -| Query | Write | `crec:query:write` | ✓ | ✓ | | -| Event | Read | `crec:event:read` | ✓ | ✓ | ✓ | -| Member role | Write | `platform:member_role:write/crec` | ✓ | | | +| Role | Description | +| -------- | ---------------------------------------------------------------------------------------------------------------------- | +| Admin | Full CRE Connect access, including archiving wallets, channels, and watchers, and changing members' CRE Connect roles. | +| Operator | Create and manage operations, wallets, channels, watchers, and queries. Cannot archive resources. | +| Viewer | View-only access to CRE Connect. | + +**Core** + +| Name | Permission | Description | Admin | Operator | Viewer | +| --------------------- | --------------------------- | ----------------------------------- | ----- | -------- | ------ | +| Network: Read | `crec:network:read` | Read available blockchain networks. | ✓ | ✓ | ✓ | +| Wallet: Read | `crec:wallet:read` | Read wallets. | ✓ | ✓ | ✓ | +| Wallet: Write | `crec:wallet:write` | Create or update wallet. | ✓ | ✓ | | +| Wallet archive: Write | `crec:wallet:archive:write` | Archive wallet. | ✓ | | | + +**Operations** + +| Name | Permission | Description | Admin | Operator | Viewer | +| -------------------------- | -------------------------------- | --------------------------------------------------------- | ----- | -------- | ------ | +| Operation: Read | `crec:operation:read` | Read operations and search by initiator/signer/canceller. | ✓ | ✓ | ✓ | +| Operation: Write | `crec:operation:write` | Create operation (draft or pre-signed). | ✓ | ✓ | | +| Operation signature: Write | `crec:operation:signature:write` | Sign (finalize) or cancel operation. | ✓ | ✓ | | + +**Channels** + +| Name | Permission | Description | Admin | Operator | Viewer | +| ---------------------- | ---------------------------- | ------------------------- | ----- | -------- | ------ | +| Channel: Read | `crec:channel:read` | Read channels. | ✓ | ✓ | ✓ | +| Channel: Write | `crec:channel:write` | Create or update channel. | ✓ | ✓ | | +| Channel archive: Write | `crec:channel:archive:write` | Archive channel. | ✓ | | | + +**Watchers** + +| Name | Permission | Description | Admin | Operator | Viewer | +| ---------------------- | ---------------------------- | ------------------------- | ----- | -------- | ------ | +| Watcher: Read | `crec:watcher:read` | Read watchers. | ✓ | ✓ | ✓ | +| Watcher: Write | `crec:watcher:write` | Create or update watcher. | ✓ | ✓ | | +| Watcher archive: Write | `crec:watcher:archive:write` | Archive watcher. | ✓ | | | + +**Queries** + +| Name | Permission | Description | Admin | Operator | Viewer | +| ------------ | ------------------ | ------------- | ----- | -------- | ------ | +| Query: Read | `crec:query:read` | Read queries. | ✓ | ✓ | ✓ | +| Query: Write | `crec:query:write` | Create query. | ✓ | ✓ | | + +**Events** + +| Name | Permission | Description | Admin | Operator | Viewer | +| ----------- | ----------------- | -------------------------------------------- | ----- | -------- | ------ | +| Event: Read | `crec:event:read` | Read events, run history, and search events. | ✓ | ✓ | ✓ | + +**Administration** + +| Name | Permission | Description | Admin | Operator | Viewer | +| -------------------------------- | --------------------------------- | ---------------------------------- | ----- | -------- | ------ | +| Member role: Write (CRE Connect) | `platform:member_role:write/crec` | Change members' CRE Connect roles. | ✓ | | | @@ -208,9 +269,13 @@ CRE Connect roles control access to operations, wallets, channels, watchers, que Data Streams has a single role. -| Name | Action | Permission ID | Admin | -| ----------- | ------ | ---------------------------------------- | ----- | -| Member role | Write | `platform:member_role:write/datastreams` | ✓ | +| Role | Description | +| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Admin | Access to your organization's Data Streams subscription, and the ability to assign other members as Data Streams Admins. Each member gets their own API credentials while sharing access to the organization's Data Streams. | + +| Name | Permission | Description | Admin | +| --------------------------------- | ---------------------------------------- | ----------------------------------- | ----- | +| Member role: Write (Data Streams) | `platform:member_role:write/datastreams` | Change members' Data Streams roles. | ✓ | @@ -223,9 +288,9 @@ Data Streams has a single role. Members with the appropriate permissions can assign and change roles for other members: -- **Platform Admins** can manage member roles for all products. -- **Product Admins** (for example, CRE Admins) can manage member roles for their product. -- The **Owner** can manage member roles for all products. +- Platform Admins can manage member roles for all products. +- Product Admins (for example, CRE Admins) can manage member roles for their product. +- The Owner can manage member roles for all products. To assign or change a member's roles, see [Assigning and Modifying Roles](/chainlink-platform/assigning-and-modifying-roles). diff --git a/src/content/chainlink-platform/understanding-organizations.mdx b/src/content/chainlink-platform/understanding-organizations.mdx index 641baa42b9d..467c4913d92 100644 --- a/src/content/chainlink-platform/understanding-organizations.mdx +++ b/src/content/chainlink-platform/understanding-organizations.mdx @@ -4,16 +4,16 @@ date: Last Modified title: "Understanding Organizations" metadata: title: "Understanding Organizations" - description: "Understand Chainlink Platform organizations: learn about the Owner role, per-product member roles, API keys, and how teams collaborate on workflows." + description: "Understand Chainlink Platform organizations: learn about the Owner role, per-product member roles, API keys, and how teams collaborate across products." datePublished: "2025-11-04" - lastModified: "2026-10-15" + lastModified: "2026-10-26" --- import { ProductOnly } from "@components" ## What is an organization? -A Chainlink Platform organization is a collaborative workspace that allows multiple team members to deploy, manage, and monitor workflows together. When you create an account, you either start a new organization (becoming the _Owner_) or join an existing one (becoming a member). +A Chainlink Platform organization is a shared workspace where your team works together across Chainlink products. When you create an account, you either start a new organization (becoming the Owner) or join an existing one (becoming a member). An organization serves as a container for: @@ -22,7 +22,7 @@ An organization serves as a container for: - **Product resources** such as CRE workflows, ACE policies, and CRE Connect channels, visible to members according to their roles - **API keys** for programmatic access to products -Organizations enable teams to collaborate on workflows while maintaining individual control over their own wallet addresses and secrets. +Organizations enable teams to collaborate across Chainlink products. ## Organization structure @@ -37,13 +37,7 @@ Every organization has exactly **one Owner**: the person who first created the o ### Multiple Members -Members are users invited to join the organization. Each member: - -- Joins automatically after accepting the invitation and creating their account -- Has a role for each product, such as CRE, ACE, or CRE Connect -- Can link their own wallet addresses to the organization -- Can deploy and manage their own workflows, depending on their roles -- Views product resources, such as CRE workflows, when their role for that product includes view access +Members are users invited to join the organization. A member joins automatically after accepting the invitation and creating their account. Each member has a role for each product, such as CRE, ACE, or CRE Connect, and can do only what those roles allow. ### Shared visibility @@ -69,7 +63,11 @@ The Owner role includes every permission for every product. See [RBAC](/chainlin ## API keys -Organizations can create API keys for programmatic access to products, such as the CRE CLI and the ACE APIs. A single API key can include permissions for multiple products. See [API Keys](/chainlink-platform/api-keys) to learn how to create and manage API keys. +Organizations can create API keys for programmatic access to products, such as the CRE CLI and the ACE APIs. A single API key can include permissions for multiple products. + + + See [API Keys](/chainlink-platform/api-keys) to learn how to create and manage API keys. + ## Learn more diff --git a/src/content/cre/guides/operations/activating-pausing-workflows.mdx b/src/content/cre/guides/operations/activating-pausing-workflows.mdx index 1a34b472c13..72151997bef 100644 --- a/src/content/cre/guides/operations/activating-pausing-workflows.mdx +++ b/src/content/cre/guides/operations/activating-pausing-workflows.mdx @@ -5,7 +5,7 @@ title: "Activating & Pausing Workflows" metadata: description: "Control when your workflows run: learn to activate workflows to start responding to triggers or pause them for maintenance." datePublished: "2025-11-04" - lastModified: "2025-11-04" + lastModified: "2026-10-26" --- import { Aside } from "@components" @@ -22,6 +22,7 @@ After deploying a workflow, you can control its operational state using the `cre Before activating or pausing workflows, ensure you have: - **A [deployed workflow](/cre/guides/operations/deploying-workflows)**: You must have a workflow that has been successfully deployed to the registry selected by `deployment-registry`. +- **CRE Developer or CRE Admin role (private registry)**: Managing private registry workflows requires the `cre:workflow:write/private_registry` permission. CRE Viewers can view workflows but not change them. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **Workflow authorization**: You must be authorized to manage the workflow. Public onchain registry workflows use the linked workflow owner address. Private registry workflows use your CRE organization login session. - **Local workflow folder**: You must run these commands from your project directory. The CLI reads the workflow name and configuration from your `workflow.yaml` file to identify which workflow to activate or pause. - **[Logged in](/cre/reference/cli/authentication#cre-login)**: Authenticated with the platform by running `cre login`. To check your authentication status, run `cre whoami`. diff --git a/src/content/cre/guides/operations/deleting-workflows.mdx b/src/content/cre/guides/operations/deleting-workflows.mdx index 0832c40a011..8700e0c5ce1 100644 --- a/src/content/cre/guides/operations/deleting-workflows.mdx +++ b/src/content/cre/guides/operations/deleting-workflows.mdx @@ -5,7 +5,7 @@ title: "Deleting Workflows" metadata: description: "Remove workflows permanently: learn how to safely delete deployed workflows from their configured registry when no longer needed." datePublished: "2025-11-04" - lastModified: "2025-11-04" + lastModified: "2026-10-26" --- import { Aside } from "@components" @@ -17,6 +17,7 @@ Deleting a workflow permanently removes it from the registry selected by `deploy Before deleting a workflow, ensure you have: - **A [deployed workflow](/cre/guides/operations/deploying-workflows)**: The workflow must exist in the registry selected by `deployment-registry`. +- **CRE Developer or CRE Admin role (private registry)**: Managing private registry workflows requires the `cre:workflow:write/private_registry` permission. CRE Viewers can view workflows but not change them. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **Workflow authorization**: You must be authorized to manage the workflow. Public onchain registry workflows use the linked workflow owner address. Private registry workflows use your CRE organization login session. - **Local workflow folder**: You must run this command from your project directory. The CLI reads the workflow name and configuration from your `workflow.yaml` file to identify which workflow to delete. - **[Logged in](/cre/reference/cli/authentication#cre-login)**: Authenticated with the platform by running `cre login`. To check if you are logged in, run `cre whoami`. diff --git a/src/content/cre/guides/operations/deploying-to-onchain-registry-go.mdx b/src/content/cre/guides/operations/deploying-to-onchain-registry-go.mdx index 4bc49066eb5..72d25a06f87 100644 --- a/src/content/cre/guides/operations/deploying-to-onchain-registry-go.mdx +++ b/src/content/cre/guides/operations/deploying-to-onchain-registry-go.mdx @@ -7,7 +7,7 @@ pageId: "operations-deploying-to-onchain-registry" metadata: description: "Deploy CRE workflows to the public Workflow Registry contract on Ethereum Mainnet using a linked wallet key." datePublished: "2026-05-06" - lastModified: "2026-05-12" + lastModified: "2026-10-26" --- import { Aside } from "@components" @@ -32,6 +32,7 @@ Before deploying to the onchain registry, ensure you have: - **Deploy access approval**: Run `cre account access` to check your status or submit a request. See [Requesting Deploy Access](/cre/guides/operations/deploy-access). - **[Authenticated](/cre/reference/cli/authentication)**: Logged in via `cre login` or using an [API key](/cre/reference/cli/authentication#api-key-authentication) (`CRE_API_KEY`). To verify, run `cre whoami`. +- **CRE Admin role, or a key linked by an Admin**: Only CRE Admins (and the Owner) can link workflow owner addresses. Once an Admin has linked your key, a CRE Developer can deploy with it. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **[Linked your key](/cre/guides/operations/linking-wallet-keys)**: Linked your EOA or multi-sig wallet to your CRE organization by running `cre account link-key`. See [Linking Wallet Keys](/cre/guides/operations/linking-wallet-keys) for instructions. - **A funded wallet**: The account you are deploying from must hold ETH on Ethereum Mainnet to pay gas for the registration transaction. - **`CRE_ETH_PRIVATE_KEY` in your `.env`**: Your wallet's private key, used by the CLI to sign registry transactions. diff --git a/src/content/cre/guides/operations/deploying-to-onchain-registry-ts.mdx b/src/content/cre/guides/operations/deploying-to-onchain-registry-ts.mdx index bd5e2814e49..31711de45e9 100644 --- a/src/content/cre/guides/operations/deploying-to-onchain-registry-ts.mdx +++ b/src/content/cre/guides/operations/deploying-to-onchain-registry-ts.mdx @@ -7,7 +7,7 @@ pageId: "operations-deploying-to-onchain-registry" metadata: description: "Deploy CRE workflows to the public Workflow Registry contract on Ethereum Mainnet using a linked wallet key." datePublished: "2026-05-06" - lastModified: "2026-05-12" + lastModified: "2026-10-26" --- import { Aside } from "@components" @@ -32,6 +32,7 @@ Before deploying to the onchain registry, ensure you have: - **Deploy access approval**: Run `cre account access` to check your status or submit a request. See [Requesting Deploy Access](/cre/guides/operations/deploy-access). - **[Authenticated](/cre/reference/cli/authentication)**: Logged in via `cre login` or using an [API key](/cre/reference/cli/authentication#api-key-authentication) (`CRE_API_KEY`). To verify, run `cre whoami`. +- **CRE Admin role, or a key linked by an Admin**: Only CRE Admins (and the Owner) can link workflow owner addresses. Once an Admin has linked your key, a CRE Developer can deploy with it. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **[Linked your key](/cre/guides/operations/linking-wallet-keys)**: Linked your EOA or multi-sig wallet to your CRE organization by running `cre account link-key`. See [Linking Wallet Keys](/cre/guides/operations/linking-wallet-keys) for instructions. - **A funded wallet**: The account you are deploying from must hold ETH on Ethereum Mainnet to pay gas for the registration transaction. - **`CRE_ETH_PRIVATE_KEY` in your `.env`**: Your wallet's private key, used by the CLI to sign registry transactions. diff --git a/src/content/cre/guides/operations/deploying-to-private-registry-go.mdx b/src/content/cre/guides/operations/deploying-to-private-registry-go.mdx index c518cf9c8ce..55c7f081e83 100644 --- a/src/content/cre/guides/operations/deploying-to-private-registry-go.mdx +++ b/src/content/cre/guides/operations/deploying-to-private-registry-go.mdx @@ -7,7 +7,7 @@ pageId: "operations-deploying-to-private-registry" metadata: description: "Deploy and manage CRE workflows using the Chainlink-hosted private registry — no linked wallet, no gas, and no Ethereum Mainnet RPC required for registry operations." datePublished: "2026-05-06" - lastModified: "2026-05-28" + lastModified: "2026-10-26" --- import { Aside } from "@components" @@ -35,6 +35,7 @@ For a comparison of both registry options, see [Deploying Workflows](/cre/guides Before deploying to the private registry, ensure you have: +- **CRE Developer or CRE Admin role**: Deploying to the private registry requires the `cre:workflow:write/private_registry` and `cre:workflow:artifact:write` permissions. If you use an API key, it needs the same permissions. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **CRE CLI v1.15.0 or later**: Run `cre version` to check. See the [Installation Guide](/cre/getting-started/cli-installation/macos-linux) to install or update. - **[Logged in](/cre/guides/cli/cli-login)**: Run `cre login` and complete the browser authentication flow. API keys also work: set `CRE_API_KEY` in your environment. diff --git a/src/content/cre/guides/operations/deploying-to-private-registry-ts.mdx b/src/content/cre/guides/operations/deploying-to-private-registry-ts.mdx index 5c2037fda07..00c0f2212d2 100644 --- a/src/content/cre/guides/operations/deploying-to-private-registry-ts.mdx +++ b/src/content/cre/guides/operations/deploying-to-private-registry-ts.mdx @@ -7,7 +7,7 @@ pageId: "operations-deploying-to-private-registry" metadata: description: "Deploy and manage CRE workflows using the Chainlink-hosted private registry — no linked wallet, no gas, and no Ethereum Mainnet RPC required for registry operations." datePublished: "2026-05-06" - lastModified: "2026-05-28" + lastModified: "2026-10-26" --- import { Aside } from "@components" @@ -35,6 +35,7 @@ For a comparison of both registry options, see [Deploying Workflows](/cre/guides Before deploying to the private registry, ensure you have: +- **CRE Developer or CRE Admin role**: Deploying to the private registry requires the `cre:workflow:write/private_registry` and `cre:workflow:artifact:write` permissions. If you use an API key, it needs the same permissions. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **CRE CLI v1.15.0 or later**: Run `cre version` to check. See the [Installation Guide](/cre/getting-started/cli-installation/macos-linux) to install or update. - **[Logged in](/cre/guides/cli/cli-login)**: Run `cre login` and complete the browser authentication flow. API keys also work: set `CRE_API_KEY` in your environment. diff --git a/src/content/cre/guides/workflow/secrets/using-secrets-deployed.mdx b/src/content/cre/guides/workflow/secrets/using-secrets-deployed.mdx index e94d60ec759..a561897f3cb 100644 --- a/src/content/cre/guides/workflow/secrets/using-secrets-deployed.mdx +++ b/src/content/cre/guides/workflow/secrets/using-secrets-deployed.mdx @@ -5,7 +5,7 @@ date: Last Modified metadata: description: "Secure your deployed workflows: learn to store and manage secrets in the Vault DON for deployed workflows running on DONs." datePublished: "2025-11-04" - lastModified: "2026-01-20" + lastModified: "2026-10-26" --- import { Aside, CodeHighlightBlockMulti } from "@components" @@ -25,6 +25,7 @@ Before managing secrets for deployed workflows, ensure you have: 1. **CRE CLI installed**: See the [Installation Guide](/cre/getting-started/cli-installation/macos-linux) 1. **Authentication**: You must be logged in with `cre login` +1. **A CRE role with secret access**: Listing secrets requires `cre:secret:read` (every CRE role). Creating, updating, or deleting secrets requires `cre:secret:write` (CRE Developer or CRE Admin). See [RBAC](/chainlink-platform/rbac?parent=cre#cre). 1. **(Web3-keyed flow only) Owner address configured**: When managing secrets owned by a workflow owner address (the onchain registry flow), your `workflow-owner-address` must be set. Browser-auth flows on the private registry use your CRE login session and don't require this. ## Auth modes: web3 key vs. browser auth diff --git a/src/content/cre/llms-full-go.txt b/src/content/cre/llms-full-go.txt index 564bf9c1262..3cb693a6a9e 100644 --- a/src/content/cre/llms-full-go.txt +++ b/src/content/cre/llms-full-go.txt @@ -5470,7 +5470,7 @@ For detailed CLI command documentation, see: # Using Secrets with Deployed Workflows Source: https://docs.chain.link/cre/guides/workflow/secrets/using-secrets-deployed -Last Updated: 2026-01-20 +Last Updated: 2026-10-26 When your workflow is deployed, it cannot access your local `.env` file or environment variables. Instead, secrets must be stored in the **Vault DON**—a decentralized, secure secret storage system that your deployed workflows can access at runtime. @@ -5486,7 +5486,8 @@ Before managing secrets for deployed workflows, ensure you have: 1. **CRE CLI installed**: See the [Installation Guide](/cre/getting-started/cli-installation/macos-linux) 2. **Authentication**: You must be logged in with `cre login` -3. **(Web3-keyed flow only) Owner address configured**: When managing secrets owned by a workflow owner address (the onchain registry flow), your `workflow-owner-address` must be set. Browser-auth flows on the private registry use your CRE login session and don't require this. +3. **A CRE role with secret access**: Listing secrets requires `cre:secret:read` (every CRE role). Creating, updating, or deleting secrets requires `cre:secret:write` (CRE Developer or CRE Admin). See [RBAC](/chainlink-platform/rbac?parent=cre#cre). +4. **(Web3-keyed flow only) Owner address configured**: When managing secrets owned by a workflow owner address (the onchain registry flow), your `workflow-owner-address` must be set. Browser-auth flows on the private registry use your CRE login session and don't require this. ## Auth modes: web3 key vs. browser auth @@ -6991,7 +6992,7 @@ See [Confidential Workflows in CRE](/cre/concepts/confidential-workflows) for a # Activating & Pausing Workflows Source: https://docs.chain.link/cre/guides/operations/activating-pausing-workflows -Last Updated: 2025-11-04 +Last Updated: 2026-10-26 After deploying a workflow, you can control its operational state using the `cre workflow activate` and `cre workflow pause` commands. These commands modify the workflow's status in the registry selected by `deployment-registry`, determining whether it can respond to triggers. @@ -7005,6 +7006,7 @@ After deploying a workflow, you can control its operational state using the `cre Before activating or pausing workflows, ensure you have: - **A [deployed workflow](/cre/guides/operations/deploying-workflows)**: You must have a workflow that has been successfully deployed to the registry selected by `deployment-registry`. +- **CRE Developer or CRE Admin role (private registry)**: Managing private registry workflows requires the `cre:workflow:write/private_registry` permission. CRE Viewers can view workflows but not change them. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **Workflow authorization**: You must be authorized to manage the workflow. Public onchain registry workflows use the linked workflow owner address. Private registry workflows use your CRE organization login session. - **Local workflow folder**: You must run these commands from your project directory. The CLI reads the workflow name and configuration from your `workflow.yaml` file to identify which workflow to activate or pause. - **[Logged in](/cre/reference/cli/authentication#cre-login)**: Authenticated with the platform by running `cre login`. To check your authentication status, run `cre whoami`. @@ -7227,7 +7229,7 @@ For complete setup instructions, configuration requirements, and step-by-step gu # Deleting Workflows Source: https://docs.chain.link/cre/guides/operations/deleting-workflows -Last Updated: 2025-11-04 +Last Updated: 2026-10-26 Deleting a workflow permanently removes it from the registry selected by `deployment-registry`. This action cannot be undone, and the workflow will no longer be able to respond to triggers. @@ -7236,6 +7238,7 @@ Deleting a workflow permanently removes it from the registry selected by `deploy Before deleting a workflow, ensure you have: - **A [deployed workflow](/cre/guides/operations/deploying-workflows)**: The workflow must exist in the registry selected by `deployment-registry`. +- **CRE Developer or CRE Admin role (private registry)**: Managing private registry workflows requires the `cre:workflow:write/private_registry` permission. CRE Viewers can view workflows but not change them. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **Workflow authorization**: You must be authorized to manage the workflow. Public onchain registry workflows use the linked workflow owner address. Private registry workflows use your CRE organization login session. - **Local workflow folder**: You must run this command from your project directory. The CLI reads the workflow name and configuration from your `workflow.yaml` file to identify which workflow to delete. - **[Logged in](/cre/reference/cli/authentication#cre-login)**: Authenticated with the platform by running `cre login`. To check if you are logged in, run `cre whoami`. @@ -8824,7 +8827,7 @@ The typical workflow development process uses these commands in sequence: # Authentication Commands Source: https://docs.chain.link/cre/reference/cli/authentication -Last Updated: 2026-10-20 +Last Updated: 2026-10-26 The CRE CLI supports two authentication methods: @@ -8889,15 +8892,9 @@ For CI/CD pipelines, automated scripts, or any environment where a browser is no ### Creating an API key -> **NOTE: To create an API key for CRE** -> -> - You must be the organization **Owner** -> -> **OR** -> -> - Have the CRE **Admin** role. +> **NOTE: Roles needed to create a CRE API key** > -> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=cre#cre). To invite team members and assign roles, see [Invite members](/chainlink-platform/inviting-team-members?parent=cre). +> Creating an API key requires a Platform role that includes API key permissions: Platform User, Platform Admin, or Owner. You can only give a key permissions that your own roles include, so to grant the CRE permissions below you also need the CRE Admin role. CRE Developers can grant every permission below except owner address linking. See [RBAC](/chainlink-platform/rbac?parent=cre#cre) for what each role includes, and [Inviting Team Members](/chainlink-platform/inviting-team-members?parent=cre) to invite members and assign roles. 1. [Create an account](/chainlink-platform/creating-an-account?parent=cre) or sign in to [app.chain.link](https://app.chain.link). @@ -8905,14 +8902,14 @@ For CI/CD pipelines, automated scripts, or any environment where a browser is no 3. Click **Create API Key** and enter a name for the key. -4. In the **API Scope** section, expand the **CRE** accordion and grant the key the permissions that the CLI uses. For the Organization permission, expand the **Chainlink Platform** accordion. +4. In the **API Scope** section, expand the **CRE** section and grant the key the permissions that the CLI uses. For `platform:organization:read`, expand the **Chainlink Platform** section. - | Name | Action | Permission ID | - | --------------------- | ------ | ------------------------------------------ | - | Workflow | Write | `cre:workflow:write/private_registry` | - | Workflow artifact | Write | `cre:workflow:artifact:write` | - | Owner address linking | Write | `platform:owner_address:linking:write/cre` | - | Organization | Read | `platform:organization:read` | + | Name | Permission | Description | + | ---------------------------------- | ------------------------------------------ | -------------------------------------------------------------------------------------------------------- | + | Workflow: Write (Private registry) | `cre:workflow:write/private_registry` | Deploy, pause, activate, and delete workflows in the private registry. | + | Workflow artifact: Write | `cre:workflow:artifact:write` | Upload workflow artifacts, which is required to deploy a workflow. | + | Owner address linking: Write (CRE) | `platform:owner_address:linking:write/cre` | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. | + | Organization: Read | `platform:organization:read` | View organization information. | See [API Keys](/chainlink-platform/api-keys?parent=cre#cre) for the full list of permissions available for CRE. @@ -10674,7 +10671,7 @@ The [Common Queries](/cre/reference/graphql-api/common-queries) guide organizes # Authentication Source: https://docs.chain.link/cre/reference/graphql-api/authentication -Last Updated: 2026-10-02 +Last Updated: 2026-10-26 Every request to the CRE GraphQL API must include an `Authorization` header carrying a CRE API key. @@ -10687,15 +10684,9 @@ Every request to the CRE GraphQL API must include an `Authorization` header carr API keys for CRE are created from [app.chain.link](https://app.chain.link), not from the GraphQL API itself. -> **NOTE: To create an API key for CRE** +> **NOTE: Roles needed to create a CRE API key** > -> - You must be the organization **Owner** -> -> **OR** -> -> - Have the CRE **Admin** role. -> -> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=cre#cre). To invite team members and assign roles, see [Invite members](/chainlink-platform/inviting-team-members?parent=cre). +> Creating an API key requires a Platform role that includes API key permissions: Platform User, Platform Admin, or Owner. You can only give a key permissions that your own roles include, so to grant the CRE permissions below you also need the CRE Admin role. CRE Developers can grant every permission below except owner address linking. See [RBAC](/chainlink-platform/rbac?parent=cre#cre) for what each role includes, and [Inviting Team Members](/chainlink-platform/inviting-team-members?parent=cre) to invite members and assign roles. 1. [Create an account](/chainlink-platform/creating-an-account?parent=cre) or sign in to [app.chain.link](https://app.chain.link). @@ -10703,15 +10694,16 @@ API keys for CRE are created from [app.chain.link](https://app.chain.link), not 3. Click **Create API Key** and enter a name for the key. -4. In the **API Scope** section, expand the **CRE** accordion and grant the key the permissions that the CLI uses. For the Organization permission, expand the **Chainlink Platform** accordion. +4. In the **API Scope** section, expand the **CRE** section and grant the key the permissions that the CLI uses. For `platform:organization:read`, expand the **Chainlink Platform** section. - | Name | Action | Permission ID | - | --------------------- | ------ | ------------------------------------------ | - | Workflow | Read | `cre:workflow:read` | - | Workflow | Write | `cre:workflow:write/private_registry` | - | Workflow artifact | Read | `cre:workflow:artifact:read` | - | Workflow artifact | Write | `cre:workflow:artifact:write` | - | Owner address linking | Write | `platform:owner_address:linking:write/cre` | + | Name | Permission | Description | + | ---------------------------------- | ------------------------------------------ | -------------------------------------------------------------------------------------------------------- | + | Workflow: Read | `cre:workflow:read` | View workflows. | + | Workflow: Write (Private registry) | `cre:workflow:write/private_registry` | Deploy, pause, activate, and delete workflows in the private registry. | + | Workflow artifact: Read | `cre:workflow:artifact:read` | Download workflow artifacts. | + | Workflow artifact: Write | `cre:workflow:artifact:write` | Upload workflow artifacts, which is required to deploy a workflow. | + | Owner address linking: Write (CRE) | `platform:owner_address:linking:write/cre` | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. | + | Organization: Read | `platform:organization:read` | View organization information. | See [API Keys](/chainlink-platform/api-keys?parent=cre#cre) for the full list of permissions available for CRE. @@ -15306,7 +15298,7 @@ You've now mastered the complete CRE development workflow! # Deploying to the Onchain Registry Source: https://docs.chain.link/cre/guides/operations/deploying-to-onchain-registry-go -Last Updated: 2026-05-12 +Last Updated: 2026-10-26 > **NOTE: Go** > @@ -15326,6 +15318,7 @@ Before deploying to the onchain registry, ensure you have: - **Deploy access approval**: Run `cre account access` to check your status or submit a request. See [Requesting Deploy Access](/cre/guides/operations/deploy-access). - **[Authenticated](/cre/reference/cli/authentication)**: Logged in via `cre login` or using an [API key](/cre/reference/cli/authentication#api-key-authentication) (`CRE_API_KEY`). To verify, run `cre whoami`. +- **CRE Admin role, or a key linked by an Admin**: Only CRE Admins (and the Owner) can link workflow owner addresses. Once an Admin has linked your key, a CRE Developer can deploy with it. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **[Linked your key](/cre/guides/operations/linking-wallet-keys)**: Linked your EOA or multi-sig wallet to your CRE organization by running `cre account link-key`. See [Linking Wallet Keys](/cre/guides/operations/linking-wallet-keys) for instructions. - **A funded wallet**: The account you are deploying from must hold ETH on Ethereum Mainnet to pay gas for the registration transaction. - **`CRE_ETH_PRIVATE_KEY` in your `.env`**: Your wallet's private key, used by the CLI to sign registry transactions. @@ -15562,7 +15555,7 @@ For complete setup instructions, configuration requirements, and step-by-step gu # Deploying to the Private Registry Source: https://docs.chain.link/cre/guides/operations/deploying-to-private-registry-go -Last Updated: 2026-05-28 +Last Updated: 2026-10-26 > **NOTE: Go** > @@ -15584,6 +15577,7 @@ For a comparison of both registry options, see [Deploying Workflows](/cre/guides Before deploying to the private registry, ensure you have: +- **CRE Developer or CRE Admin role**: Deploying to the private registry requires the `cre:workflow:write/private_registry` and `cre:workflow:artifact:write` permissions. If you use an API key, it needs the same permissions. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **CRE CLI v1.15.0 or later**: Run `cre version` to check. See the [Installation Guide](/cre/getting-started/cli-installation/macos-linux) to install or update. - **[Logged in](/cre/guides/cli/cli-login)**: Run `cre login` and complete the browser authentication flow. API keys also work: set `CRE_API_KEY` in your environment. diff --git a/src/content/cre/llms-full-ts.txt b/src/content/cre/llms-full-ts.txt index 563ecb2a1fd..8e78eb5be13 100644 --- a/src/content/cre/llms-full-ts.txt +++ b/src/content/cre/llms-full-ts.txt @@ -4783,7 +4783,7 @@ For detailed CLI command documentation, see: # Using Secrets with Deployed Workflows Source: https://docs.chain.link/cre/guides/workflow/secrets/using-secrets-deployed -Last Updated: 2026-01-20 +Last Updated: 2026-10-26 When your workflow is deployed, it cannot access your local `.env` file or environment variables. Instead, secrets must be stored in the **Vault DON**—a decentralized, secure secret storage system that your deployed workflows can access at runtime. @@ -4799,7 +4799,8 @@ Before managing secrets for deployed workflows, ensure you have: 1. **CRE CLI installed**: See the [Installation Guide](/cre/getting-started/cli-installation/macos-linux) 2. **Authentication**: You must be logged in with `cre login` -3. **(Web3-keyed flow only) Owner address configured**: When managing secrets owned by a workflow owner address (the onchain registry flow), your `workflow-owner-address` must be set. Browser-auth flows on the private registry use your CRE login session and don't require this. +3. **A CRE role with secret access**: Listing secrets requires `cre:secret:read` (every CRE role). Creating, updating, or deleting secrets requires `cre:secret:write` (CRE Developer or CRE Admin). See [RBAC](/chainlink-platform/rbac?parent=cre#cre). +4. **(Web3-keyed flow only) Owner address configured**: When managing secrets owned by a workflow owner address (the onchain registry flow), your `workflow-owner-address` must be set. Browser-auth flows on the private registry use your CRE login session and don't require this. ## Auth modes: web3 key vs. browser auth @@ -6294,7 +6295,7 @@ See [Confidential Workflows in CRE](/cre/concepts/confidential-workflows) for a # Activating & Pausing Workflows Source: https://docs.chain.link/cre/guides/operations/activating-pausing-workflows -Last Updated: 2025-11-04 +Last Updated: 2026-10-26 After deploying a workflow, you can control its operational state using the `cre workflow activate` and `cre workflow pause` commands. These commands modify the workflow's status in the registry selected by `deployment-registry`, determining whether it can respond to triggers. @@ -6308,6 +6309,7 @@ After deploying a workflow, you can control its operational state using the `cre Before activating or pausing workflows, ensure you have: - **A [deployed workflow](/cre/guides/operations/deploying-workflows)**: You must have a workflow that has been successfully deployed to the registry selected by `deployment-registry`. +- **CRE Developer or CRE Admin role (private registry)**: Managing private registry workflows requires the `cre:workflow:write/private_registry` permission. CRE Viewers can view workflows but not change them. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **Workflow authorization**: You must be authorized to manage the workflow. Public onchain registry workflows use the linked workflow owner address. Private registry workflows use your CRE organization login session. - **Local workflow folder**: You must run these commands from your project directory. The CLI reads the workflow name and configuration from your `workflow.yaml` file to identify which workflow to activate or pause. - **[Logged in](/cre/reference/cli/authentication#cre-login)**: Authenticated with the platform by running `cre login`. To check your authentication status, run `cre whoami`. @@ -6530,7 +6532,7 @@ For complete setup instructions, configuration requirements, and step-by-step gu # Deleting Workflows Source: https://docs.chain.link/cre/guides/operations/deleting-workflows -Last Updated: 2025-11-04 +Last Updated: 2026-10-26 Deleting a workflow permanently removes it from the registry selected by `deployment-registry`. This action cannot be undone, and the workflow will no longer be able to respond to triggers. @@ -6539,6 +6541,7 @@ Deleting a workflow permanently removes it from the registry selected by `deploy Before deleting a workflow, ensure you have: - **A [deployed workflow](/cre/guides/operations/deploying-workflows)**: The workflow must exist in the registry selected by `deployment-registry`. +- **CRE Developer or CRE Admin role (private registry)**: Managing private registry workflows requires the `cre:workflow:write/private_registry` permission. CRE Viewers can view workflows but not change them. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **Workflow authorization**: You must be authorized to manage the workflow. Public onchain registry workflows use the linked workflow owner address. Private registry workflows use your CRE organization login session. - **Local workflow folder**: You must run this command from your project directory. The CLI reads the workflow name and configuration from your `workflow.yaml` file to identify which workflow to delete. - **[Logged in](/cre/reference/cli/authentication#cre-login)**: Authenticated with the platform by running `cre login`. To check if you are logged in, run `cre whoami`. @@ -8640,7 +8643,7 @@ The typical workflow development process uses these commands in sequence: # Authentication Commands Source: https://docs.chain.link/cre/reference/cli/authentication -Last Updated: 2026-10-20 +Last Updated: 2026-10-26 The CRE CLI supports two authentication methods: @@ -8705,15 +8708,9 @@ For CI/CD pipelines, automated scripts, or any environment where a browser is no ### Creating an API key -> **NOTE: To create an API key for CRE** -> -> - You must be the organization **Owner** -> -> **OR** +> **NOTE: Roles needed to create a CRE API key** > -> - Have the CRE **Admin** role. -> -> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=cre#cre). To invite team members and assign roles, see [Invite members](/chainlink-platform/inviting-team-members?parent=cre). +> Creating an API key requires a Platform role that includes API key permissions: Platform User, Platform Admin, or Owner. You can only give a key permissions that your own roles include, so to grant the CRE permissions below you also need the CRE Admin role. CRE Developers can grant every permission below except owner address linking. See [RBAC](/chainlink-platform/rbac?parent=cre#cre) for what each role includes, and [Inviting Team Members](/chainlink-platform/inviting-team-members?parent=cre) to invite members and assign roles. 1. [Create an account](/chainlink-platform/creating-an-account?parent=cre) or sign in to [app.chain.link](https://app.chain.link). @@ -8721,14 +8718,14 @@ For CI/CD pipelines, automated scripts, or any environment where a browser is no 3. Click **Create API Key** and enter a name for the key. -4. In the **API Scope** section, expand the **CRE** accordion and grant the key the permissions that the CLI uses. For the Organization permission, expand the **Chainlink Platform** accordion. +4. In the **API Scope** section, expand the **CRE** section and grant the key the permissions that the CLI uses. For `platform:organization:read`, expand the **Chainlink Platform** section. - | Name | Action | Permission ID | - | --------------------- | ------ | ------------------------------------------ | - | Workflow | Write | `cre:workflow:write/private_registry` | - | Workflow artifact | Write | `cre:workflow:artifact:write` | - | Owner address linking | Write | `platform:owner_address:linking:write/cre` | - | Organization | Read | `platform:organization:read` | + | Name | Permission | Description | + | ---------------------------------- | ------------------------------------------ | -------------------------------------------------------------------------------------------------------- | + | Workflow: Write (Private registry) | `cre:workflow:write/private_registry` | Deploy, pause, activate, and delete workflows in the private registry. | + | Workflow artifact: Write | `cre:workflow:artifact:write` | Upload workflow artifacts, which is required to deploy a workflow. | + | Owner address linking: Write (CRE) | `platform:owner_address:linking:write/cre` | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. | + | Organization: Read | `platform:organization:read` | View organization information. | See [API Keys](/chainlink-platform/api-keys?parent=cre#cre) for the full list of permissions available for CRE. @@ -10626,7 +10623,7 @@ The [Common Queries](/cre/reference/graphql-api/common-queries) guide organizes # Authentication Source: https://docs.chain.link/cre/reference/graphql-api/authentication -Last Updated: 2026-10-02 +Last Updated: 2026-10-26 Every request to the CRE GraphQL API must include an `Authorization` header carrying a CRE API key. @@ -10639,15 +10636,9 @@ Every request to the CRE GraphQL API must include an `Authorization` header carr API keys for CRE are created from [app.chain.link](https://app.chain.link), not from the GraphQL API itself. -> **NOTE: To create an API key for CRE** -> -> - You must be the organization **Owner** -> -> **OR** +> **NOTE: Roles needed to create a CRE API key** > -> - Have the CRE **Admin** role. -> -> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=cre#cre). To invite team members and assign roles, see [Invite members](/chainlink-platform/inviting-team-members?parent=cre). +> Creating an API key requires a Platform role that includes API key permissions: Platform User, Platform Admin, or Owner. You can only give a key permissions that your own roles include, so to grant the CRE permissions below you also need the CRE Admin role. CRE Developers can grant every permission below except owner address linking. See [RBAC](/chainlink-platform/rbac?parent=cre#cre) for what each role includes, and [Inviting Team Members](/chainlink-platform/inviting-team-members?parent=cre) to invite members and assign roles. 1. [Create an account](/chainlink-platform/creating-an-account?parent=cre) or sign in to [app.chain.link](https://app.chain.link). @@ -10655,15 +10646,16 @@ API keys for CRE are created from [app.chain.link](https://app.chain.link), not 3. Click **Create API Key** and enter a name for the key. -4. In the **API Scope** section, expand the **CRE** accordion and grant the key the permissions that the CLI uses. For the Organization permission, expand the **Chainlink Platform** accordion. +4. In the **API Scope** section, expand the **CRE** section and grant the key the permissions that the CLI uses. For `platform:organization:read`, expand the **Chainlink Platform** section. - | Name | Action | Permission ID | - | --------------------- | ------ | ------------------------------------------ | - | Workflow | Read | `cre:workflow:read` | - | Workflow | Write | `cre:workflow:write/private_registry` | - | Workflow artifact | Read | `cre:workflow:artifact:read` | - | Workflow artifact | Write | `cre:workflow:artifact:write` | - | Owner address linking | Write | `platform:owner_address:linking:write/cre` | + | Name | Permission | Description | + | ---------------------------------- | ------------------------------------------ | -------------------------------------------------------------------------------------------------------- | + | Workflow: Read | `cre:workflow:read` | View workflows. | + | Workflow: Write (Private registry) | `cre:workflow:write/private_registry` | Deploy, pause, activate, and delete workflows in the private registry. | + | Workflow artifact: Read | `cre:workflow:artifact:read` | Download workflow artifacts. | + | Workflow artifact: Write | `cre:workflow:artifact:write` | Upload workflow artifacts, which is required to deploy a workflow. | + | Owner address linking: Write (CRE) | `platform:owner_address:linking:write/cre` | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. | + | Organization: Read | `platform:organization:read` | View organization information. | See [API Keys](/chainlink-platform/api-keys?parent=cre#cre) for the full list of permissions available for CRE. @@ -15471,7 +15463,7 @@ You've now mastered the complete CRE development workflow! # Deploying to the Onchain Registry Source: https://docs.chain.link/cre/guides/operations/deploying-to-onchain-registry-ts -Last Updated: 2026-05-12 +Last Updated: 2026-10-26 > **NOTE: TypeScript** > @@ -15491,6 +15483,7 @@ Before deploying to the onchain registry, ensure you have: - **Deploy access approval**: Run `cre account access` to check your status or submit a request. See [Requesting Deploy Access](/cre/guides/operations/deploy-access). - **[Authenticated](/cre/reference/cli/authentication)**: Logged in via `cre login` or using an [API key](/cre/reference/cli/authentication#api-key-authentication) (`CRE_API_KEY`). To verify, run `cre whoami`. +- **CRE Admin role, or a key linked by an Admin**: Only CRE Admins (and the Owner) can link workflow owner addresses. Once an Admin has linked your key, a CRE Developer can deploy with it. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **[Linked your key](/cre/guides/operations/linking-wallet-keys)**: Linked your EOA or multi-sig wallet to your CRE organization by running `cre account link-key`. See [Linking Wallet Keys](/cre/guides/operations/linking-wallet-keys) for instructions. - **A funded wallet**: The account you are deploying from must hold ETH on Ethereum Mainnet to pay gas for the registration transaction. - **`CRE_ETH_PRIVATE_KEY` in your `.env`**: Your wallet's private key, used by the CLI to sign registry transactions. @@ -15727,7 +15720,7 @@ For complete setup instructions, configuration requirements, and step-by-step gu # Deploying to the Private Registry Source: https://docs.chain.link/cre/guides/operations/deploying-to-private-registry-ts -Last Updated: 2026-05-28 +Last Updated: 2026-10-26 > **NOTE: TypeScript** > @@ -15749,6 +15742,7 @@ For a comparison of both registry options, see [Deploying Workflows](/cre/guides Before deploying to the private registry, ensure you have: +- **CRE Developer or CRE Admin role**: Deploying to the private registry requires the `cre:workflow:write/private_registry` and `cre:workflow:artifact:write` permissions. If you use an API key, it needs the same permissions. See [RBAC](/chainlink-platform/rbac?parent=cre#cre). - **CRE CLI v1.15.0 or later**: Run `cre version` to check. See the [Installation Guide](/cre/getting-started/cli-installation/macos-linux) to install or update. - **[Logged in](/cre/guides/cli/cli-login)**: Run `cre login` and complete the browser authentication flow. API keys also work: set `CRE_API_KEY` in your environment. diff --git a/src/content/cre/reference/cli/authentication.mdx b/src/content/cre/reference/cli/authentication.mdx index d302549aa35..f5ff85700fe 100644 --- a/src/content/cre/reference/cli/authentication.mdx +++ b/src/content/cre/reference/cli/authentication.mdx @@ -5,7 +5,7 @@ title: "Authentication Commands" metadata: description: "Manage your CLI authentication: browser-based login, API key authentication for CI/CD, and session management commands." datePublished: "2025-11-04" - lastModified: "2026-10-20" + lastModified: "2026-10-26" --- import { Aside } from "@components" @@ -75,28 +75,22 @@ For CI/CD pipelines, automated scripts, or any environment where a browser is no ### Creating an API key -