GraphQL Permissions

Essential knowledge

Intended Audience:

Technical User

Authors:

Fluent Commerce, Kirill Gaiduk

Changed on:

31 Aug 2026

Overview

The GraphQL Permissions define the access rights that control every operation in the Fluent platform’s GraphQL API. Each permission represents a single, specific action a user can perform on an entity, ensuring secure access management across all services.By assigning permissions to roles, organizations can control user capabilities at a granular level. This ensures that users only access and modify data relevant to their role and business context.

Key points

Permission Structure: GraphQL queries and mutations are secured by permissions that follow the ENTITY_ACTION naming convention (for example, ORDER_VIEW, ORDER_UPDATE). This ensures precise and predictable access control across all API operations
Nested and Partial Mutations: Nested mutations require separate permissions. Partial mutations are not allowed — if one permission check fails, the entire operation is rolled back
Plugin Management Access: Plugin-related operations are governed by specific permissions such as PLUGIN_VIEW, PLUGIN_UPLOAD, and PLUGIN_INSTALL. Only users with these permissions can manage plugin
Error Handling and Troubleshooting: Operations attempted without proper permissions return the error code C0020E. Users must obtain the required permissions before retrying the operation
Analytics Permissions: Domain-level permissions (for example, ORDER_REPORT, INVENTORY_REPORT) control access to analytics capabilities across business domains via the GraphQL API.

Naming Convention

Permissions follow a NOUN_VERB naming convention (for example, `ORDER_UPDATE`) and align with common actions such as:

VIEW - allows querying data
CREATE - allows creating new records
UPDATE - allows modifying existing records

In addition, domain-level analytics permissions follow the `<<DOMAIN>>_REPORT` pattern to control access to analytics capabilities for specific business domains.

Note

Every GraphQL operation is protected by a corresponding permission. Ensure the required permissions are configured before executing any GraphQL queries or mutations.

Viewing All Permissions

The complete list of GraphQL permissions available in the Fluent platform can be retrieved using the `permissions` query.

Reminder

Ensure the `PERMISSION_VIEW` permission is assigned to your user’s role before proceeding.

1query permissions{
2    permissions(first:1000){
3        edges{
4            node{
5                name
6            }
7        }
8    }
9}

1{
2  "data": {
3    "permissions": {
4      "edges": [
5        { "node": { "name": "WORKFLOW_VIEW" } },
6        { "node": { "name": "WORKFLOW_UPDATE" } },
7        { "node": { "name": "WORKFLOW_CREATE" } },
8        { "node": { "name": "WAVE_VIEW" } },
9        { "node": { "name": "WAVE_UPDATE" } },
10        { "node": { "name": "WAVE_TRANSITION" } },
11        { "node": { "name": "WAVE_CREATE" } },
12        { "node": { "name": "VIRTUALVIEW_VIEW" } },
13        { "node": { "name": "VIRTUALVIEWINVENTORYLEVELS" } },
14        { "node": { "name": "VIRTUALVIEW_CREATE" } },
15        { "node": { "name": "VIRTUALPOSITION_VIEW" } },
16        { "node": { "name": "VIRTUALPOSITION_UPDATE" } },
17        { "node": { "name": "VIRTUALPOSITION_CREATE" } },
18        { "node": { "name": "VIRTUALINVENTORY_VIEW" } },
19        { "node": { "name": "VIRTUALCATALOGUE_VIEW" } },
20        { "node": { "name": "VIRTUALCATALOGUE_UPDATE" } },
21        { "node": { "name": "VIRTUALCATALOGUE_CREATE" } },
22        { "node": { "name": "VARIANTPRODUCT_VIEW" } },
23        { "node": { "name": "VARIANTPRODUCT_UPDATE" } },
24        { "node": { "name": "VARIANTPRODUCT_CREATE" } },
25        { "node": { "name": "USER_VIEW" } },
26        { "node": { "name": "USER_UPDATE" } },
27        { "node": { "name": "USERROLE_UPDATE" } },
28        { "node": { "name": "USER_EDIT" } },
29        { "node": { "name": "USER_CREATE" } },
30        { "node": { "name": "UNCOLLECTEDORDERS_VIEW" } },
31        { "node": { "name": "TRANSACTION_VIEW" } },
32        { "node": { "name": "TRANSACTION_CREATE" } },
33        { "node": { "name": "TAXTYPE_VIEW" } },
34        { "node": { "name": "STOREADDRESS_VIEW" } },
35        { "node": { "name": "STOREADDRESS_UPDATE" } },
36        { "node": { "name": "STOREADDRESS_CREATE" } },
37        { "node": { "name": "STORAGEAREA_VIEW" } },
38        { "node": { "name": "STORAGEAREA_UPDATE" } },
39        { "node": { "name": "STORAGEAREARESERVATION_VIEW" } },
40        { "node": { "name": "STORAGEAREA_CREATE" } },
41        { "node": { "name": "STANDARDPRODUCT_VIEW" } },
42        { "node": { "name": "STANDARDPRODUCT_UPDATE" } },
43        { "node": { "name": "STANDARDPRODUCT_CREATE" } },
44        { "node": { "name": "SOURCINGPROFILE_VIEW" } },
45        { "node": { "name": "SOURCINGPROFILE_UPDATE" } },
46        { "node": { "name": "SOURCINGPROFILE_CREATE" } },
47        { "node": { "name": "SOURCINGAUDIT_VIEW" } },
48        { "node": { "name": "SOURCINGAUDIT_CREATE" } },
49        { "node": { "name": "SKU_VIEW" } },
50        { "node": { "name": "SETTING_VIEW" } },
51        { "node": { "name": "SETTING_UPDATE" } },
52        { "node": { "name": "SETTINGS_EDIT" } },
53        { "node": { "name": "SETTING_CREATE" } },
54        { "node": { "name": "SERVICEPOINT_VIEW" } },
55        { "node": { "name": "SEARCHVIRTUALINVENTORY" } },
56        { "node": { "name": "ROLE_VIEW" } },
57        { "node": { "name": "ROLEUSER_REMOVE" } },
58        { "node": { "name": "ROLE_UPDATE" } },
59        { "node": { "name": "ROLE_REVOKE" } },
60        { "node": { "name": "ROLEPERMISSION_UPDATE" } },
61        { "node": { "name": "ROLE_GRANT" } },
62        { "node": { "name": "ROLE_CREATE" } },
63        { "node": { "name": "RETURN_VIEW" } },
64        { "node": { "name": "RETURNORDER_VIEW" } },
65        { "node": { "name": "RETURNORDER_UPDATE" } },
66        { "node": { "name": "RETURNORDER_REPORT" } },
67        { "node": { "name": "RETURNORDER_CREATE" } },
68        { "node": { "name": "RETURN_CREATE" } },
69        { "node": { "name": "RETAILER_VIEW" } },
70        { "node": { "name": "RETAILER_UPDATE" } },
71        { "node": { "name": "RETAILER_CREATE" } },
72        { "node": { "name": "REPORT_VIEW" } },
73        { "node": { "name": "PRODUCT_VIEW" } },
74        { "node": { "name": "PRODUCTCATALOGUE_VIEW" } },
75        { "node": { "name": "PRODUCTCATALOGUE_UPDATE" } },
76        { "node": { "name": "PRODUCTCATALOGUE_CREATE" } },
77        { "node": { "name": "PRICE_VIEW" } },
78        { "node": { "name": "PLUGIN_VIEW" } },
79        { "node": { "name": "PLUGIN_UPLOAD" } },
80        { "node": { "name": "PLUGIN_INSTALL" } },
81        { "node": { "name": "PICKPACK_VIEW" } },
82        { "node": { "name": "PERMISSION_VIEW" } },
83        { "node": { "name": "PERMISSIONROLE_REMOVE" } },
84        { "node": { "name": "PAYMENT_VIEW" } },
85        { "node": { "name": "PAYMENT_UPDATE" } },
86        { "node": { "name": "PAYMENTSERVICEPROVIDER_VIEW" } },
87        { "node": { "name": "PAYMENTSERVICEPROVIDER_UPDATE" } },
88        { "node": { "name": "PAYMENTSERVICEPROVIDER_CREATE" } },
89        { "node": { "name": "PAYMENT_CREATE" } },
90        { "node": { "name": "ORDER_VIEW" } },
91        { "node": { "name": "ORDER_UPDATE" } },
92        { "node": { "name": "ORDER_REPORT" } },
93        { "node": { "name": "ORDERITEM_VIEW" } },
94        { "node": { "name": "ORDERITEM_UPDATE" } },
95        { "node": { "name": "ORDERITEM_CREATE" } },
96        { "node": { "name": "ORDER_EDIT" } },
97        { "node": { "name": "ORDER_CREATE" } },
98        { "node": { "name": "ORDER_CANCEL" } },
99        { "node": { "name": "OPENINGSCHEDULE_VIEW" } },
100        { "node": { "name": "OPENINGSCHEDULE_UPDATE" } },
101        { "node": { "name": "OPENINGSCHEDULE_CREATE" } },
102        { "node": { "name": "NETWORK_VIEW" } },
103        { "node": { "name": "NETWORK_UPDATE" } },
104        { "node": { "name": "NETWORKLOCATION_REMOVE" } },
105        { "node": { "name": "NETWORK_CREATE" } },
106        { "node": { "name": "METRICS_VIEW" } },
107        { "node": { "name": "MANIFEST_VIEW" } },
108        { "node": { "name": "MANIFEST_UPDATE" } },
109        { "node": { "name": "MANIFEST_CREATE" } },
110        { "node": { "name": "LOCATION_VIEW" } },
111        { "node": { "name": "LOCATION_UPDATE" } },
112        { "node": { "name": "LOCATIONNETWORK_REMOVE" } },
113        { "node": { "name": "LOCATION_EDIT" } },
114        { "node": { "name": "LOCATION_CREATE" } },
115        { "node": { "name": "JOB_VIEW" } },
116        { "node": { "name": "INVOICE_VIEW" } },
117        { "node": { "name": "INVOICE_UPDATE" } },
118        { "node": { "name": "INVOICE_CREATE" } },
119        { "node": { "name": "INVENTORY_VIEW" } },
120        { "node": { "name": "INVENTORY_REPORT" } },
121        { "node": { "name": "INVENTORYQUANTITY_VIEW" } },
122        { "node": { "name": "INVENTORYQUANTITY_UPDATE" } },
123        { "node": { "name": "INVENTORYQUANTITY_CREATE" } },
124        { "node": { "name": "INVENTORYPOSITION_VIEW" } },
125        { "node": { "name": "INVENTORYPOSITION_UPDATE" } },
126        { "node": { "name": "INVENTORYPOSITION_CREATE" } },
127        { "node": { "name": "INVENTORYFEED_VIEW" } },
128        { "node": { "name": "INVENTORYFEED_UPDATE" } },
129        { "node": { "name": "INVENTORYFEEDRUN_VIEW" } },
130        { "node": { "name": "INVENTORYFEEDRUN_UPDATE" } },
131        { "node": { "name": "INVENTORYFEEDRUN_CREATE" } },
132        { "node": { "name": "INVENTORYFEED_CREATE" } },
133        { "node": { "name": "INVENTORY_EDIT" } },
134        { "node": { "name": "INVENTORYCATALOGUE_VIEW" } },
135        { "node": { "name": "INVENTORYCATALOGUE_UPDATE" } },
136        { "node": { "name": "INVENTORYCATALOGUE_CREATE" } },
137        { "node": { "name": "GROUPPRODUCT_VIEW" } },
138        { "node": { "name": "GROUPPRODUCT_UPDATE" } },
139        { "node": { "name": "GROUPPRODUCT_CREATE" } },
140        { "node": { "name": "GRAPHQL_VIEW" } },
141        { "node": { "name": "GRAPHQL_SAVE" } },
142        { "node": { "name": "FULFILMENT_VIEW" } },
143        { "node": { "name": "FULFILMENT_UPDATE" } },
144        { "node": { "name": "FULFILMENT_TRANSITION" } },
145        { "node": { "name": "FULFILMENT_REPORT" } },
146        { "node": { "name": "FULFILMENTPLAN_VIEW" } },
147        { "node": { "name": "FULFILMENTPLAN_UPDATE" } },
148        { "node": { "name": "FULFILMENTPLAN_CREATE" } },
149        { "node": { "name": "FULFILMENTOPTION_VIEW" } },
150        { "node": { "name": "FULFILMENTOPTION_UPDATE" } },
151        { "node": { "name": "FULFILMENT_OPTIONS_VIEW" } },
152        { "node": { "name": "FULFILMENTOPTION_CREATE" } },
153        { "node": { "name": "FULFILMENTITEM_VIEW" } },
154        { "node": { "name": "FULFILMENTITEM_UPDATE" } },
155        { "node": { "name": "FULFILMENTITEM_CREATE" } },
156        { "node": { "name": "FULFILMENT_EDIT" } },
157        { "node": { "name": "FULFILMENT_CREATE" } },
158        { "node": { "name": "FULFILMENTCHOICE_VIEW" } },
159        { "node": { "name": "FULFILMENTCHOICE_UPDATE" } },
160        { "node": { "name": "FULFILMENTCHOICE_CREATE" } },
161        { "node": { "name": "FINANCIALTRANSACTION_VIEW" } },
162        { "node": { "name": "FINANCIALTRANSACTION_UPDATE" } },
163        { "node": { "name": "FINANCIALTRANSACTION_CREATE" } },
164        { "node": { "name": "EVENT_VIEW" } },
165        { "node": { "name": "DSR_VIEW" } },
166        { "node": { "name": "DSR_CREATE" } },
167        { "node": { "name": "DASHBOARD_VIEW" } },
168        { "node": { "name": "CUSTOMER_VIEW" } },
169        { "node": { "name": "CUSTOMER_UPDATE" } },
170        { "node": { "name": "CUSTOMER_CREATE" } },
171        { "node": { "name": "CUSTOMERCOLLECTIONS_VIEW" } },
172        { "node": { "name": "CUSTOMERADDRESS_VIEW" } },
173        { "node": { "name": "CUSTOMERADDRESS_UPDATE" } },
174        { "node": { "name": "CUSTOMERADDRESS_CREATE" } },
175        { "node": { "name": "CREDITMEMO_VIEW" } },
176        { "node": { "name": "CREDITMEMO_UPDATE" } },
177        { "node": { "name": "CREDITMEMO_CREATE" } },
178        { "node": { "name": "COURIERCOLLECTIONS_VIEW" } },
179        { "node": { "name": "CONTROL_VIEW" } },
180        { "node": { "name": "CONTROL_UPDATE" } },
181        { "node": { "name": "CONTROLGROUP_VIEW" } },
182        { "node": { "name": "CONTROLGROUP_UPDATE" } },
183        { "node": { "name": "CONTROLGROUP_CREATE" } },
184        { "node": { "name": "CONTROL_CREATE" } },
185        { "node": { "name": "CONSOLE_VIEW" } },
186        { "node": { "name": "CONSIGNMENT_VIEW" } },
187        { "node": { "name": "CONSIGNMENT_UPDATE" } },
188        { "node": { "name": "CONSIGNMENT_TRANSITION" } },
189        { "node": { "name": "CONSIGNMENT_CREATE" } },
190        { "node": { "name": "COMMENT_VIEW" } },
191        { "node": { "name": "COMMENT_UPDATE" } },
192        { "node": { "name": "COMMENT_CREATE" } },
193        { "node": { "name": "CATEGORY_VIEW" } },
194        { "node": { "name": "CATEGORYVARIANTPRODUCT_REMOVE" } },
195        { "node": { "name": "CATEGORY_UPDATE" } },
196        { "node": { "name": "CATEGORYSTANDARDPRODUCT_REMOVE" } },
197        { "node": { "name": "CATEGORYGROUPPRODUCT_REMOVE" } },
198        { "node": { "name": "CATEGORY_CREATE" } },
199        { "node": { "name": "CARRIER_VIEW" } },
200        { "node": { "name": "CARRIER_UPDATE" } },
201        { "node": { "name": "CARRIER_CREATE" } },
202        { "node": { "name": "BOOKRETURN_VIEW" } },
203        { "node": { "name": "BILLINGACCOUNT_VIEW" } },
204        { "node": { "name": "BILLINGACCOUNT_UPDATE" } },
205        { "node": { "name": "BILLINGACCOUNT_CREATE" } },
206        { "node": { "name": "BATCH_VIEW" } },
207        { "node": { "name": "ARTICLE_VIEW" } },
208        { "node": { "name": "ARTICLE_UPDATE" } },
209        { "node": { "name": "ARTICLE_TRANSITION" } },
210        { "node": { "name": "ARTICLEITEM_VIEW" } },
211        { "node": { "name": "ARTICLEITEM_CREATE" } },
212        { "node": { "name": "ARTICLE_EXCEPTION_VIEW" } },
213        { "node": { "name": "ARTICLE_EDIT" } },
214        { "node": { "name": "ARTICLE_CREATE" } },
215        { "node": { "name": "ARTICLE_CANCEL" } },
216        { "node": { "name": "ARTICLE_AWAITING_CUSTOMER_COLLECTION_VIEW" } },
217        { "node": { "name": "ARTICLE_AWAITING_CARRIER_COLLECTION_VIEW" } },
218        { "node": { "name": "ARTICLE_AWAITING_ARRIVAL_VIEW" } },
219        { "node": { "name": "ARRIVALS_VIEW" } },
220        { "node": { "name": "ANALYTICS_VIEW" } },
221        { "node": { "name": "ACCOUNTUSAGE_VIEW" } }
222      ]
223    }
224  }
225}

Query Permissions

Query permissions on entities follow the `<<ENTITY>>_VIEW` naming convention. For example:

The Order entity is protected by the `ORDER_VIEW` permission
The Location entity is protected by the `LOCATION_VIEW` permission

Use the `permissions` query with the `name` filter to retrieve all query-related permissions.

1query permissions{
2    permissions(first:1000, name: ["%_VIEW"]) {
3        edges{
4            node{
5                name
6            }
7        }
8    }
9}

Analytics Report Permissions

Analytics report permissions control access to analytics capabilities by business domain.The following permissions are available:

`ORDER_REPORT` -> access to Order-related analytics, including Orders, Fulfilments, and Returns analytics
`INVENTORY_REPORT` -> access to Inventory analytics

Mutation Permissions

Create, update and remove operations are protected by the `<<ENTITY>>_CREATE`, `<<ENTITY>>_UPDATE`, and `<<ENTITY>>_REMOVE` permissions, respectively. For example:

The `createSetting` mutation requires the `SETTING_CREATE` permission
The `updateLocation` mutation requires the `LOCATION_UPDATE` permission
The `removeUserRolesFromUser` mutation requires the `ROLEUSER_REMOVE` permission

Use the `permissions` query to retrieve the mutation permissions lists using the following `name` filters:

`name: ["%_CREATE"]`
`name: ["%_UPDATE"]`
`name: ["%_REMOVE"]`

Nested Mutations

All nested mutation operations require their own permissions, based on the entity being modified. For example:

1input UpdateLocationInput {
2    # ID of the object
3    id: ID!
4    type: String
5    status: String
6    attributes: [AttributeInput]
7    name: String
8    supportPhoneNumber: String
9    defaultCarrier: String
10    primaryAddress: UpdateStoreAddressInput
11    retailer: RetailerId
12    openingSchedule: UpdateOpeningScheduleInput
13    networks: [NetworkId]
14    storageAreas: [UpdateStorageAreaWithLocationInput]
15}

The `updateLocation` mutation supports nested updates such as:

Each nested input type within a mutation requires its corresponding permission to execute successfully.

Partial Mutations

Partial mutations are not allowed.If a mutation fails due to a missing or invalid permission, the entire operation will fail and return an error.For example, when updating a location’s opening schedule using the `updateLocation` mutation, both permissions are required:

`LOCATION_UPDATE`
`OPENINGSCHEDULE_UPDATE`

If the second permission is missing, the entire mutation fails, even if the first permission is valid.

Sample Permission-Related Error

`Error code: C0020E`
Error message: Your request failed due to insufficient permissions. You will need OPENINGSCHEDULE_UPDATE for executing this request.
Please contact your support to get the required permissions and try again.

Plugin Permissions

Plugin management operations are controlled by the following permissions:

`PLUGIN_VIEW`
`PLUGIN_UPLOAD`
`PLUGIN_INSTALL`

Error Handling

Error Code: C0020EDescription: The user does not have the required permission for the attempted operation.Possible Cause: The permission is missing or incorrect.Solution: Contact your administrator or support team to obtain the necessary permissions.

Parameter Limitation

The values for the `first` and `last` parameters of a query must be within 1 - 5,000.If the specified value exceeds 5,000, it will automatically be replaced by 5,000.

GraphQL Permissions

Overview

Key points

Naming Convention

Viewing All Permissions

Query Permissions

Analytics Report Permissions

Mutation Permissions

Nested Mutations

Partial Mutations

Plugin Permissions

Error Handling

Related content

Users, Roles, and Permissions

Admin Interface

Fluent Commerce

Contributors:

Building Blocks

By Type

Helpful Resources

Quick Links