Reference
API endpoint permissions
Choose Read and Write grants and look up the permission ID for every supported API operation.
For Administrators and integration developers
On this page
App links open your signed-in workspace. Check the selected workspace before making changes.
Choose exact grants
In Settings, search for a resource or operation, select Read or Write for a group, or expand it to pick individual endpoints. A minus means a partial selection.
teams.current and permissions.list work with any authorized key. Every other operation needs an exact grant plus current tenant, membership, role, employee-access and resource checks.
The catalog may list operations your role or deployment doesn’t offer. To see what you can grant and hold, use permissions.list in the SDK, GET /api/v1/permissions or shuffl permissions list --json.
Grants don’t imply each other
- users.list doesn’t grant users.get.
- groups.save doesn’t grant groups.list or groups.remove.
- Write never includes Read.
Revocation, replacement and delegation
Grants are fixed when a key is issued. To change them, create a replacement and revoke the old key. Revocation and expiry also invalidate keys issued from it. New endpoints never join an existing key.
MCP access is the mcp.knowledge permission, checked by the MCP server rather than an HTTP endpoint. API permissions don’t grant browser sign-in, provider OAuth consent or access to another workspace.
Delegating keys
- Creating a credential through the SDK, API or CLI takes permissions: ["users.list"].
- The issuer must hold credentials.api.create and every permission it grants. The grants must fit within the parent and all its ancestors.
- Delegation goes at most three generations deep and can’t outlive its parent.
- A key with credentials.api.create can delegate mcp.knowledge only if it holds mcp.knowledge itself.
Company keys
The company API is in OpenAPI, the SDK (shuffl.company) and the CLI (shuffl login --company or SHUFFL_COMPANY_KEY). The Company settings API reference has examples for each.
Deleting or restoring the company, transferring ownership, company roles, email domains, single sign-on, SCIM, Slack mapping, billing and product analytics stay in Settings for every credential.
Two kinds of key
- A workspace key (shuffl_api_) works in one workspace with the permissions above.
- A company key (shuffl_company_) manages one company’s settings. It can’t read or change anything inside a workspace: no People, Knowledge, requests or programs.
- Neither works where the other does. The wrong kind gets 401.
Company keys
- Company owners and administrators create them in Settings → API keys and webhooks → Company keys.
- A key acts as its creator, with their current company role. It pauses while they aren’t a company owner or administrator.
- Keys last 7, 30 or 90 days with 120 requests a minute. A company can have 10 active.
- Creating or revoking a key, and every change made with one, is recorded for Shuffl support.
Over HTTP
- GET /api/v1/company shows the key’s company and grants.
- GET /api/v1/company/<permission> runs a read. POST with a JSON body runs a change.
- The company always comes from the key.
Company keys can be granted
- company.details: read the company name, logo and default workspace
- company.workspaces.list: list the company's workspaces
- company.members.list: list company members and their company roles
- company.emailDomains.list: list the company's email domains and their verification
- company.slack.list: list the slack workspaces connected to the company
- company.rename: rename the company
- company.workspaces.setDefault: choose the workspace new email domain and single sign-on members join
- company.members.remove: remove someone from the company (administrators only with an owner’s key)
import { Shuffl } from '@shuffl/sdk';
const shuffl = new Shuffl({ apiKey: process.env.SHUFFL_COMPANY_KEY! });
const { items } = await shuffl.company.members.list({ limit: 100 });
await shuffl.company.members.remove({ userId: '<user id from members.list>' });access
access.get
Read · Read one person's workspace role and app access
Exact grant · role scope access:read
access.slackWaiting
Read · List Slack members waiting for access to Shuffl
Exact grant · role scope access:read
access.enableSlack
Write · Give these Slack people employee access
Exact grant · role scope access:write
access.save
Write · Change employee product access
Exact grant · role scope access:write
access.saveRole
Write · Change a member’s team role
Exact grant · role scope access:write
accessRequests
accessRequests.get
Read · Read one access request you asked for, approve or own
Exact grant · role scope self:read
accessRequests.inbox
Read · List the access requests waiting on you to decide or set up
Exact grant · role scope self:read
accessRequests.list
Read · List access requests across the workspace, by app or status
Exact grant · role scope access:read
accessRequests.mine
Read · List your own access requests and where each stands
Exact grant · role scope self:read
accessRequests.decide
Write · Approve or decline an access request you were asked to decide
Exact grant · role scope self:write
accessRequests.grant
Write · Grant an approved request again by writing its group membership in the identity provider
Exact grant · role scope self:write
accessRequests.markGranted
Write · Mark an approved request as set up, so the person is told
Exact grant · role scope self:write
accessRequests.request
Write · Ask for access to an app
Exact grant · role scope self:write
accessRequests.revoke
Write · Remove access that was granted through a request, and its group membership
Exact grant · role scope self:write
actions
actions.mine
Read · List the requests Mello filed for you and where each stands
Exact grant · role scope self:read
apps
apps.get
Read · Read one app in the catalog: owners, approvers, levels and who has access
Exact grant · role scope self:read
apps.grantGroups
Read · List the groups one identity provider connection has, to map an access level to
Exact grant · role scope access:read
apps.grantSources
Read · List the connected identity providers whose groups can grant an access level
Exact grant · role scope access:read
apps.importSources
Read · List the connected identity providers apps can be imported from
Exact grant · role scope access:read
apps.list
Read · List the apps people can ask for, with owners, levels and your own request
Exact grant · role scope self:read
apps.members
Read · List who has access to an app through Shuffl
Exact grant · role scope access:read
apps.archive
Write · Archive an app so nobody can ask for it; open requests expire
Exact grant · role scope access:write
apps.import
Write · Import the apps a connected identity provider lists into the catalog
Exact grant · role scope access:write
apps.save
Write · Add or change an app in the catalog: owners, approvers, levels and request policy
Exact grant · role scope access:write
assistant
assistant.conversations
Read · List your conversations with Mello
Exact grant · role scope assistant:read
assistant.history
Read · Read the messages in one of your conversations with Mello
Exact grant · role scope assistant:read
assistant.delete
Write · Delete one of your conversations with Mello
Exact grant · role scope assistant:write
assistant.send
Write · Ask Mello a question in a conversation
Exact grant · role scope assistant:write
assistant.stop
Write · Stop an answer Mello is still writing
Exact grant · role scope assistant:write
availability
availability.freeTime
Read · Read when a coworker is free in their working hours, from their shared calendar
Exact grant · role scope users:read
availability.settings
Read · Read whether Who’s out is on for the workspace
Exact grant · role scope team:read
availability.timeOffAway
Read · Read whether your Slack status and calendar are set when your time off is approved
Exact grant · role scope self:read
availability.whosOut
Read · Read who is out in the coming days, from shared calendars and the HR system
Exact grant · role scope users:read
availability.saveSettings
Write · Turn Who’s out on or off for the workspace
Exact grant · role scope team:write
availability.saveTimeOffAway
Write · Choose whether your Slack status and calendar are set when your time off is approved
Exact grant · role scope self:write
badges
badges.holders
Read · List the people who hold a badge, as far as each lets you see
Exact grant · role scope users:read
badges.list
Read · List the team’s badges, who holds them and any open requests you decide
Exact grant · role scope users:read
badges.ofPerson
Read · List a person's badges
Exact grant · role scope users:read
badges.settings
Read · Read the badge suggestion settings
Exact grant · role scope praise:read
badges.award
Write · Give a badge you own to a person
Exact grant · role scope profile:write
badges.claim
Write · Claim a badge with its code
Exact grant · role scope profile:write
badges.decideRequest
Write · Approve or decline a request for a badge
Exact grant · role scope profile:write
badges.generatePicture
Write · Draw an AI picture for a badge you own. Keeps a picture already set unless replace is true; idea says what to draw
Exact grant · role scope profile:write
badges.hideOwn
Write · Hide or show one of your badges on your profile
Exact grant · role scope profile:write
badges.request
Write · Ask for a badge
Exact grant · role scope profile:write
badges.revoke
Write · Take a badge back from a person
Exact grant · role scope profile:write
badges.save
Write · Create or edit a badge you own
Exact grant · role scope profile:write
badges.saveSettings
Write · Turn badge offers from praise on or off, and choose the launch channel
Exact grant · role scope praise:write
badges.setHidden
Write · Hide or show a badge for the whole workspace
Exact grant · role scope users:write
badges.uploadPicture
Write · Set a badge picture from a PNG, JPEG or WebP picture sent as base64, for a badge you own
Exact grant · role scope profile:write
benefits
benefits.mine
Read · Read your own benefit plans and open enrollment dates from the connected HR system
Exact grant · role scope self:read
betaFeatures
betaFeatures.list
Read · List the workspace’s beta features and whether each is on
Exact grant · role scope team:read
betaFeatures.set
Write · Turn a beta feature on or off for the workspace
Exact grant · role scope team:write
capabilities
capabilities.requests
Read · How many people asked HR to connect a system, per capability
Exact grant · role scope integrations:read
capabilities.sheet
Read · What Mello can answer and do for you here, and what connecting a system would add
Exact grant · role scope self:read
capabilities.unlocks
Read · What people can ask and do once an HR system or document tool is connected
Exact grant · role scope self:read
capabilities.dismissRequests
Write · Clear the asks to connect a system for one capability
Exact grant · role scope integrations:write
capabilities.requestConnection
Write · Ask HR to connect the system this needs
Exact grant · role scope self:write
celebrations
celebrations.card
Read · Open a celebration card you can sign or were given
Exact grant · role scope self:read
celebrations.cards
Read · List celebration cards to sign and cards you were given
Exact grant · role scope self:read
celebrations.deliveries
Read · List the celebration messages Shuffl sent
Exact grant · role scope celebrations:read
celebrations.mine
Read · List the celebrations you received
Exact grant · role scope self:read
celebrations.preferences
Read · Read your birthday and work anniversary sharing preferences
Exact grant · role scope self:read
celebrations.preview
Read · Preview a celebration message
Exact grant · role scope celebrations:read
celebrations.program
Read · Read the Celebrations settings
Exact grant · role scope celebrations:read
celebrations.review
Read · Review upcoming birthdays and work anniversaries
Exact grant · role scope celebrations:read
celebrations.startDates
Read · Read which start date anniversaries count from and the start dates that look wrong
Exact grant · role scope celebrations:read
celebrations.thisWeek
Read · List who was celebrated in a channel in the last seven days
Exact grant · role scope self:read
celebrations.refresh
Write · Look for new birthdays and work anniversaries to celebrate now
Exact grant · role scope celebrations:write
celebrations.removeCardNote
Write · Remove your note from this celebration card
Exact grant · role scope self:write
celebrations.save
Write · Save celebration settings; enabling them schedules messages
Exact grant · role scope celebrations:write
celebrations.saveAnniversaryDate
Write · Choose which start date work anniversaries count from; reschedules them
Exact grant · role scope celebrations:write
celebrations.savePreferences
Write · Save your birthday and work anniversary sharing preferences
Exact grant · role scope self:write
celebrations.signCard
Write · Sign this celebration card with your note
Exact grant · role scope self:write
channels
channels.list
Read · List available Slack channels
Exact grant · role scope programs:read
commands
commands.get
Read · Read your own command receipt
Exact grant · role scope null
communities
communities.channelSuggestions
Read · List Slack channels, with the ones that look like communities suggested
Exact grant · role scope programs:read
communities.createCapabilities
Read · Read the current permission to create public or private community channels
Exact grant · role scope programs:read
communities.list
Read · List communities with the members you may see
Exact grant · role scope users:read
communities.members
Read · List a community's members
Exact grant · role scope users:read
communities.ofPerson
Read · List the communities a person belongs to
Exact grant · role scope users:read
communities.archive
Write · Archive a community
Exact grant · role scope profile:write
communities.createSlackChannel
Write · Create an explicitly public or private Slack channel as an authorized community owner or administrator, retaining its request id across retries
Exact grant · role scope programs:write
communities.fromChannels
Write · Create one community per chosen Slack channel, as an administrator
Exact grant · role scope programs:write
communities.generateCover
Write · Draw an AI cover for a community, as its owner, moderator or an administrator. Keeps a cover already set unless replace is true; idea says what to draw
Exact grant · role scope profile:write
communities.invite
Write · Invite selected people to a community as its owner or administrator; each person must accept
Exact grant · role scope profile:write
communities.join
Write · Join a community
Exact grant · role scope profile:write
communities.leave
Write · Leave a community
Exact grant · role scope profile:write
communities.removeMember
Write · Remove someone from a community, as its owner or moderator
Exact grant · role scope profile:write
communities.revokeInvitation
Write · Revoke a pending community invitation as its owner or administrator
Exact grant · role scope profile:write
communities.save
Write · Create or edit a community, optionally tied to a Slack channel
Exact grant · role scope profile:write
communities.setVisibility
Write · Show or hide a community on your profile
Exact grant · role scope profile:write
communities.sync
Write · Sync a community's members with its Slack channel now
Exact grant · role scope profile:write
communities.uploadCover
Write · Set a community cover from a PNG, JPEG or WebP picture sent as base64, as its owner, moderator or an administrator
Exact grant · role scope profile:write
compliance
compliance.current
Read · List the connected compliance platforms, what each receives and its recent pushes
Exact grant · role scope integrations:read
compliance.disconnect
Write · Disconnect a compliance platform; pushes stop at once
Exact grant · role scope integrations:write
compliance.pushNow
Write · Send the evidence a compliance platform is set to receive now
Exact grant · role scope integrations:write
compliance.setEvidence
Write · Choose which evidence a compliance platform receives, or pause sending
Exact grant · role scope integrations:write
credentials.api
credentials.api.list
Read · List the workspace's API keys and what each can do
Exact grant · role scope credentials:read
credentials.api.create
Write · Delegate a subset of this credential with bounded expiry and inherited revocation
Exact grant · role scope credentials:write
credentials.api.revoke
Write · Revoke an API key
Exact grant · role scope credentials:write
devices
devices.catalog
Read · List the laptops the connected shipping partner can send
Exact grant · role scope devices:read
devices.connections
Read · List the connected device management and shipping partner
Exact grant · role scope devices:read
devices.forPerson
Read · Read one person’s devices, laptop orders and return kits
Exact grant · role scope devices:read
devices.list
Read · List the devices device management reports, what each needs and who has it
Exact grant · role scope devices:read
devices.mine
Read · List your own laptops and devices, what each needs, and where your laptop or return kit is
Exact grant · role scope self:read
devices.disconnect
Write · Disconnect device management or the shipping partner; shipments keep their status
Exact grant · role scope devices:write
devices.lock
Write · Lock a device through device management
Exact grant · role scope devices:write
devices.match
Write · Match a device to a person in People, or clear the match
Exact grant · role scope devices:write
devices.order
Write · Order a person’s laptop through the shipping partner
Exact grant · role scope devices:write
devices.return
Write · Send a person a return kit for the laptops device management lists for them
Exact grant · role scope devices:write
devices.sync
Write · Read the fleet from device management now
Exact grant · role scope devices:write
devices.wipe
Write · Wipe a device through device management, confirmed with the last four characters of its serial
Exact grant · role scope devices:write
digest
digest.culture
Read · List the Culture page’s recommendations in order and what happened after each one acted on
Exact grant · role scope reports:read
digest.nudge
Read · Read one of Mello’s culture nudges
Exact grant · role scope reports:read
digest.nudges
Read · List Mello’s culture nudges for the workspace
Exact grant · role scope reports:read
digest.preview
Read · Preview the HR digest for the last period
Exact grant · role scope reports:read
digest.settings
Read · Read the HR digest schedule
Exact grant · role scope team:read
digest.actOnNudge
Write · Record that a culture nudge was acted on and get where its action goes
Exact grant · role scope team:write
digest.dismissNudge
Write · Dismiss a culture nudge for 90 days
Exact grant · role scope team:write
digest.saveSettings
Write · Save the HR digest schedule and admin channel
Exact grant · role scope team:write
expenses
expenses.mine
Read · Read your own reimbursements Mello filed and where each one stands
Exact grant · role scope self:read
expenses.stageReceipt
Write · Hand over a receipt photo or PDF for a reimbursement; it is kept for a day until filed
Exact grant · role scope self:write
expenses.submitMileage
Write · File a mileage reimbursement for a work trip; the spend platform applies the rate
Exact grant · role scope self:write
expenses.submitReceipt
Write · File a reimbursement from a receipt you handed over; the spend platform drafts it from the receipt
Exact grant · role scope self:write
exports
exports.team
Read · Export the workspace's programs, people and introduction history
Exact grant · role scope exports:read
getStarted
getStarted.celebration
Read · Read the first-action celebration waiting for you, if any
Exact grant · role scope self:read
getStarted.get
Read · Read your own Get started steps and whether the welcome still shows
Exact grant · role scope self:read
getStarted.celebrate
Write · Record that a celebration was shown, shared or dismissed
Exact grant · role scope profile:write
getStarted.dismiss
Write · Hide the Get started card
Exact grant · role scope profile:write
getStarted.draftIntro
Write · Draft a short hello to your coworkers with Mello; nothing is posted
Exact grant · role scope profile:write
getStarted.intro
Write · Post your hello on Home, or skip it
Exact grant · role scope profile:write
getStarted.wizard
Write · Record that you opened, finished or skipped the welcome
Exact grant · role scope profile:write
gifts
gifts.current
Read · Read gift budgets, this month’s spend against the cap, gifts waiting for approval and recent gifts
Exact grant · role scope celebrations:read
gifts.options
Read · List the Tremendous funding sources and campaigns gifts can use
Exact grant · role scope celebrations:read
gifts.approve
Write · Approve and send this gift
Exact grant · role scope celebrations:write
gifts.approveMany
Write · Approve and send these gifts
Exact grant · role scope celebrations:write
gifts.disconnect
Write · Disconnect Tremendous; no more gifts are sent
Exact grant · role scope celebrations:write
gifts.draft
Write · Draft a gift for someone, such as a reward for their praise
Exact grant · role scope celebrations:write
gifts.draftUpcoming
Write · Draft the gifts for the next two weeks of occasions now
Exact grant · role scope celebrations:write
gifts.save
Write · Save gift budgets, the monthly cap and where gifts are paid from
Exact grant · role scope celebrations:write
gifts.skip
Write · Skip this gift; nothing is sent
Exact grant · role scope celebrations:write
groups
groups.allAutomations
Read · Every join and leave automation in the workspace: group automations with their group and last runs, playbooks that start on each start date or each last day (`dayZero`) and Connections programs whose people are a group; or only those that start one playbook, program or community
Exact grant · role scope users:read
groups.automationChoices
Read · The Pulse questions, badges and Shuffl lists a group automation can ask, give or add people to
Exact grant · role scope users:read
groups.automationInsights
Read · Group automation runs over the last `days` (30, 90 or 180) against the period before: done, skipped and failed, people reached, by week and kind, the top reasons a run did nothing, runs still scheduled and automations on; `groupId` narrows it
Exact grant · role scope users:read
groups.automationRuns
Read · Every group automation run in the workspace, newest first, 50 at a time (`next` is the cursor for the page after), with `counts` by outcome; `outcome` and `groupId` narrow it
Exact grant · role scope users:read
groups.automations
Read · A group’s automations (what happens when someone joins or leaves) and their last runs
Exact grant · role scope users:read
groups.directory
Read · List the groups shown on profiles, yours first, with a few faces each
Exact grant · role scope users:read
groups.directoryGroup
Read · Read one group shown on profiles and everyone in it
Exact grant · role scope users:read
groups.export
Read · A group’s members as a CSV file: name, email, title, department, manager and when they joined
Exact grant · role scope users:read
groups.get
Read · Read one group: its rules, members and recent entries and exits
Exact grant · role scope users:read
groups.glance
Read · One group at a glance: size, joins, departments, tenure and time zones
Exact grant · role scope users:read
groups.list
Read · List the workspace’s groups with who is in each
Exact grant · role scope users:read
groups.members
Read · One page of a group’s members
Exact grant · role scope users:read
groups.message
Read · One message to a group: its words, who it would reach now and how it reads to one member
Exact grant · role scope users:read
groups.messages
Read · The drafts and sends of messages to a group, newest first
Exact grant · role scope users:read
groups.options
Read · The departments, teams, communities, programs, titles, locations and time zones a rule may name
Exact grant · role scope users:read
groups.preview
Read · Count and sample who a set of rules would hold today
Exact grant · role scope users:read
groups.searchPeople
Read · Find people by name to pick for a group
Exact grant · role scope users:read
groups.suggestions
Read · Starter groups not made yet, with how many people each would hold
Exact grant · role scope users:read
groups.discardMessage
Write · Drop a drafted message to a group
Exact grant · role scope users:write
groups.prepareMessage
Write · Write a message to everyone in a group and see who it would reach; nothing is sent
Exact grant · role scope users:write
groups.refresh
Write · Re-evaluate a dynamic group’s rules now
Exact grant · role scope users:write
groups.remove
Write · Remove a group
Exact grant · role scope users:write
groups.removeAutomation
Write · Remove an automation from a group, with its runs
Exact grant · role scope users:write
groups.save
Write · Create or change a group or a department: a list of people or rules that keep it up to date
Exact grant · role scope users:write
groups.sendMessage
Write · Send a drafted message to a group once per request key, on each person’s chosen channel
Exact grant · role scope users:write
groups.setAutomation
Write · Add or change an automation on a group: send a message, ask a Pulse question, start a playbook, invite to a community, add to Connections, give a badge, add to or remove from another group, add to or post in a Slack channel (`config.channelId`, read back from Slack), or tell HR, their manager or someone named, right away or days later; a new one starts paused
Exact grant · role scope users:write
groups.setAutomationState
Write · Pause or resume an automation on a group
Exact grant · role scope users:write
groups.setPlaybookAutoStart
Write · Turn on, pause or remove a playbook’s automation that starts it on each new hire’s start date, or a leaving playbook’s on each last day, for everyone or one group
Exact grant · role scope users:write
hiring
hiring.hires
Read · List the hires a hiring system sent, when each starts and what Shuffl wrote back
Exact grant · role scope integrations:read
hiring.setNotes
Write · Turn recruiter notes and tags in a hiring system on or off
Exact grant · role scope integrations:write
hiring.updateStartDate
Write · Change a hire’s offer start date in the hiring system
Exact grant · role scope integrations:write
home
home.feed
Read · What happened to people you know, and who Mello thinks you should meet
Exact grant · role scope self:read
home.places
Read · The areas turned on for you, what is waiting for you, and your onboarding progress
Exact grant · role scope self:read
home.preferences
Write · Choose how Home looks: cards or compact, stories, autoplay, For you
Exact grant · role scope profile:write
home.react
Write · Add or remove your emoji reaction on a Home moment
Exact grant · role scope profile:write
home.story
Write · Record Home stories you opened, sent a note from, or skipped
Exact grant · role scope profile:write
hr
hr.categories
Read · Read the HR request categories and response target
Exact grant · role scope hr:read
hr.get
Read · Read one HR request and its messages
Exact grant · role scope hr:read
hr.list
Read · List the HR requests you asked or can answer
Exact grant · role scope hr:read
hr.mine
Read · List the HR requests you asked, with HR’s latest reply
Exact grant · role scope hr:read
hr.readiness
Read · Check whether HR requests have a destination and someone to answer them
Exact grant · role scope hr:read
hr.settings
Read · Read the HR team name and who answers HR requests
Exact grant · role scope hr:read
hr.command
Write · Claim, release, reply to, note, categorize, resolve, reopen or remind HR about an HR request
Exact grant · role scope hr:write
hr.configure
Write · Change the HR request destination
Exact grant · role scope hr:write
hr.deliver
Write · Deliver your HR reply to the employee
Exact grant · role scope hr:write
hr.rebuildCategories
Write · Have Mello rebuild the HR request categories from published Knowledge
Exact grant · role scope hr:write
hr.renameTeam
Write · Rename the HR team employees send requests to
Exact grant · role scope hr:write
hr.retryDelivery
Write · Retry HR request delivery
Exact grant · role scope hr:write
hr.route
Write · Send a request category to a helpdesk queue or back to the Shuffl inbox
Exact grant · role scope hr:write
hr.saveCategories
Write · Save the HR request categories, their owners and the response target
Exact grant · role scope hr:write
hr.helpdesks
hr.helpdesks.list
Read · List the connected helpdesks and where each request category goes
Exact grant · role scope hr:read
hr.helpdesks.queues
Read · List the queues a connected helpdesk can take HR requests into
Exact grant · role scope hr:read
hr.helpdesks.connect
Write · Connect a helpdesk for HR requests with its token
Exact grant · role scope hr:write
hr.helpdesks.disconnect
Write · Disconnect a helpdesk; its categories go back to the Shuffl inbox
Exact grant · role scope hr:write
identities
identities.list
Read · List the Slack and web accounts linked to a person
Exact grant · role scope identities:read
identities.slackAccounts
Read · List Slack accounts that can be linked to people
Exact grant · role scope identities:read
identities.webAccounts
Read · List web accounts that can be linked to people
Exact grant · role scope identities:read
identities.linkSlack
Write · Link a verified Slack account
Exact grant · role scope identities:write
identities.linkWeb
Write · Link a verified web account
Exact grant · role scope identities:write
identities.unlink
Write · Revoke an employee identity link
Exact grant · role scope identities:write
integrations
integrations.authorize
Read · Get the link that connects Slack, Google Drive or Notion to the workspace
Exact grant · role scope integrations:write
invitations
invitations.candidates
Read · List people in the directory who can be invited to the workspace
Exact grant · role scope access:read
invitations.list
Read · List pending workspace invitations
Exact grant · role scope access:read
invitations.cancel
Write · Cancel a pending workspace invitation
Exact grant · role scope access:write
invitations.create
Write · Invite this person with the selected team role
Exact grant · role scope access:write
invitations.createMany
Write · Invite these people with the selected team role
Exact grant · role scope access:write
invitations.inviteDirectory
Write · Invite everyone in the directory who is not invited yet
Exact grant · role scope access:write
knowledge
knowledge.context
Read · Read nearby approved passages
Exact grant · role scope knowledge:read
knowledge.search
Read · Search approved knowledge
Exact grant · role scope knowledge:read
knowledge.acknowledgements
knowledge.acknowledgements.mine
Read · List the Knowledge pages you are asked to read and confirm
Exact grant · role scope knowledge:read
knowledge.acknowledgements.status
Read · See who has confirmed a Knowledge page and who has not
Exact grant · role scope knowledge:manage
knowledge.acknowledgements.close
Write · Stop asking people to confirm this page
Exact grant · role scope knowledge:write
knowledge.acknowledgements.remind
Write · Message the people who have not confirmed this page yet
Exact grant · role scope knowledge:write
knowledge.acknowledgements.request
Write · Ask the people who can read this page to confirm they read it, and message them
Exact grant · role scope knowledge:write
knowledge.connections
knowledge.connections.browse
Read · List documents a connected Knowledge source can see
Exact grant · role scope integrations:read
knowledge.connections.list
Read · List connected Knowledge providers
Exact grant · role scope integrations:read
knowledge.connections.requests
Read · List requests to connect a Knowledge source
Exact grant · role scope integrations:read
knowledge.connections.connect
Write · Connect a Knowledge provider with a token
Exact grant · role scope integrations:write
knowledge.connections.disconnect
Write · Disconnect a knowledge provider
Exact grant · role scope integrations:write
knowledge.connections.request
Write · Ask an administrator to connect a Knowledge source
Exact grant · role scope integrations:write
knowledge.handbook
knowledge.handbook.export
Read · Download the pages published to everyone as one handbook, in Markdown
Exact grant · role scope knowledge:manage
knowledge.policies
knowledge.policies.coverage
Read · Check which common HR policies Knowledge covers
Exact grant · role scope knowledge:manage
knowledge.sources
knowledge.sources.get
Read · Read a Knowledge source
Exact grant · role scope knowledge:manage
knowledge.sources.history
Read · List a Knowledge source's versions
Exact grant · role scope knowledge:manage
knowledge.sources.list
Read · List Knowledge sources
Exact grant · role scope knowledge:manage
knowledge.sources.search
Read · Search Knowledge sources by title
Exact grant · role scope knowledge:read
knowledge.sources.archive
Write · Archive an unpublished knowledge source
Exact grant · role scope knowledge:write
knowledge.sources.changeAudience
Write · Change who can read this knowledge source
Exact grant · role scope knowledge:write
knowledge.sources.importConnected
Write · Import a document from a connected Knowledge source
Exact grant · role scope knowledge:write
knowledge.sources.importWebsite
Write · Import a website page into Knowledge for review
Exact grant · role scope knowledge:write
knowledge.sources.publish
Write · Publish this knowledge version to its audience
Exact grant · role scope knowledge:write
knowledge.sources.refresh
Write · Refresh a Knowledge source from its connected provider
Exact grant · role scope knowledge:write
knowledge.sources.restore
Write · Restore an archived knowledge source
Exact grant · role scope knowledge:write
knowledge.sources.save
Write · Save a Knowledge source draft
Exact grant · role scope knowledge:write
knowledge.sources.withdraw
Write · Withdraw a published Knowledge source
Exact grant · role scope knowledge:write
knowledge.sources.write
Write · Write a Knowledge page with Mello from its title and a request; nothing is saved
Exact grant · role scope knowledge:write
knowledge.templates
knowledge.templates.facts
Read · Read what Shuffl knows that policy templates ask for
Exact grant · role scope knowledge:manage
knowledge.templates.draft
Write · Draft a policy template with Mello, researching each value; nothing is saved
Exact grant · role scope knowledge:write
knowledge.uploads
knowledge.uploads.get
Read · Read the progress of a Knowledge file upload
Exact grant · role scope knowledge:write
knowledge.uploads.appendPart
Write · Upload the next part of a Knowledge file
Exact grant · role scope knowledge:write
knowledge.uploads.complete
Write · Finish a Knowledge file upload and start reading it
Exact grant · role scope knowledge:write
knowledge.uploads.create
Write · Start uploading a file to Knowledge
Exact grant · role scope knowledge:write
knowledge.uploads.retry
Write · Retry reading a Knowledge file that failed
Exact grant · role scope knowledge:write
manager
manager.current
Read · Read your own manager context
Exact grant · role scope manager:read
mcp
mcp.knowledge
Read · Connect an agent over MCP
Exact grant · role scope knowledge:read
mentorship
mentorship.mine
Read · Your mentorship programs and pairings, with goals and check-ins
Exact grant · role scope self:read
mentorship.join
Write · Join a mentorship program as a mentor or mentee, saying what you can help with or want to learn, and as a mentor how many mentees and hours you can give
Exact grant · role scope self:write
mentorship.leave
Write · Leave a mentorship program as a mentor or mentee
Exact grant · role scope self:write
mentorship.checkIns
mentorship.checkIns.answer
Write · Answer whether you met your mentor or mentee, and whether it helped
Exact grant · role scope self:write
mentorship.circles
mentorship.circles.cancel
Write · Call off a mentorship program’s next mentor circle
Exact grant · role scope mentorship:write
mentorship.circles.reply
Write · Say whether you’ll come to your program’s mentor circle
Exact grant · role scope self:write
mentorship.circles.save
Write · Set or move a mentorship program’s next mentor circle, a short meeting where its mentors swap what works
Exact grant · role scope mentorship:write
mentorship.cohorts
mentorship.cohorts.sponsor
Write · Sponsor an upcoming mentorship cohort with a short note shown on its invite and kickoff, or take it back
Exact grant · role scope self:write
mentorship.feedback
mentorship.feedback.save
Write · Tell your mentor what helped most and one thing to change, when your pairing ends. Only your mentor reads it, once three mentees have answered
Exact grant · role scope self:write
mentorship.goals
mentorship.goals.remove
Write · Remove a goal from your mentorship, as the mentee
Exact grant · role scope self:write
mentorship.goals.save
Write · Add, rename or check off a goal in your mentorship, as the mentee
Exact grant · role scope self:write
mentorship.invitations
mentorship.invitations.answer
Write · Answer an invite to mentor: yes, not now, or ask me later
Exact grant · role scope self:write
mentorship.invitations.send
Write · Invite up to 20 people to mentor in a program, optionally telling their managers. Nobody becomes a mentor until they say yes
Exact grant · role scope mentorship:write
mentorship.leaders
mentorship.leaders.get
Read · Mentorship across the people you lead: how many take part against the company, topics short of mentors and cohorts you can sponsor. Totals only
Exact grant · role scope self:read
mentorship.members
mentorship.members.setStatus
Write · Take someone off a mentorship program, or put them back
Exact grant · role scope mentorship:write
mentorship.mentors
mentorship.mentors.candidates
Read · People who could mentor a topic, from their titles, tenure, who they manage and praise that mentions it, with a drafted invite
Exact grant · role scope mentorship:read
mentorship.mentors.choose
Write · Choose your mentor from the mentors Shuffl suggests, in a program where mentees choose
Exact grant · role scope self:write
mentorship.pairs
mentorship.pairs.approveAll
Write · Approve every suggested pair in a mentorship program at once. In a cohort before its start day they wait for it; otherwise each starts now
Exact grant · role scope mentorship:write
mentorship.pairs.decide
Write · Approve a suggested mentorship pair, which introduces them, or skip it
Exact grant · role scope mentorship:write
mentorship.pairs.end
Write · End a mentorship pairing early
Exact grant · role scope mentorship:write
mentorship.pairs.nudge
Write · Nudge every pair in a mentorship program that hasn’t met in three weeks to pick a time. Each pair hears it once a week at most
Exact grant · role scope mentorship:write
mentorship.pairs.setMine
Write · Pause, resume or end your own mentorship pairing
Exact grant · role scope self:write
mentorship.pairs.suggest
Write · Suggest a mentor outside their reporting line for every mentee still waiting
Exact grant · role scope mentorship:write
mentorship.profiles
mentorship.profiles.get
Read · A person’s Mentoring section: how many people they mentored, what they offer and the thank-yous shared there
Exact grant · role scope users:read
mentorship.profiles.setHidden
Write · Hide or show the Mentoring section of your own profile
Exact grant · role scope profile:write
mentorship.programs
mentorship.programs.get
Read · One mentorship program: who joined, the suggested pairs, whether pairs are meeting and the next mentor circle
Exact grant · role scope mentorship:read
mentorship.programs.list
Read · List mentorship programs, with how many mentors, mentees and pairs each has
Exact grant · role scope mentorship:read
mentorship.programs.save
Write · Create or change a mentorship program: who can join, its format (one to one, ask once, circles or reverse mentoring), whether it runs as a cohort, how long pairings last and how often pairs check in
Exact grant · role scope mentorship:write
mentorship.programs.setStatus
Write · Turn mentorship programs on, pause one, or archive one and end its pairs
Exact grant · role scope mentorship:write
mentorship.requests
mentorship.requests.answer
Write · Accept or pass on a mentee who chose you as their mentor
Exact grant · role scope self:write
mentorship.sessions
mentorship.sessions.remove
Write · Remove your notes from a mentorship meeting
Exact grant · role scope self:write
mentorship.sessions.save
Write · Add or change your notes from a mentorship meeting: what you talked about and one thing to try
Exact grant · role scope self:write
mentorship.settings
mentorship.settings.get
Read · What a new mentorship program starts with: pairing length, check-in cadence and mentees per mentor
Exact grant · role scope mentorship:read
mentorship.settings.save
Write · Change what a new mentorship program starts with; existing programs keep their own terms
Exact grant · role scope mentorship:write
mentorship.thanks
mentorship.thanks.save
Write · Thank your mentor when your pairing ends: optionally on their profile, to their manager, and as praise in a channel
Exact grant · role scope self:write
network
network.introductions
Read · Your Connections programs, when your next introduction goes out, and who you met
Exact grant · role scope users:read
network.mine
Read · Who you know and who you should meet
Exact grant · role scope users:read
network.ofPerson
Read · People you and this person both know
Exact grant · role scope users:read
network.orgChart
Read · Everyone in the team with their manager, for the org chart
Exact grant · role scope users:read
network.claim
Write · Say you know someone or would like to meet them
Exact grant · role scope profile:write
network.requestIntro
Write · Ask someone you both know to introduce you
Exact grant · role scope profile:write
notifications
notifications.preferences
Read · Read your notification preferences
Exact grant · role scope self:read
notifications.save
Write · Save a notification preference
Exact grant · role scope self:write
operations
operations.activity
Read · Read the workspace's recent audit activity
Exact grant · role scope operations:read
operations.status
Read · Read the workspace delivery and provider health summary
Exact grant · role scope operations:read
operations.dispatchInbox
Write · Resume already-admitted team provider events and support delivery
Exact grant · role scope operations:write
operations.reconcile
Write · Reconcile an externally verified delivery outcome
Exact grant · role scope operator:write
pay
pay.schedule
Read · Read the next pay dates from the connected HR system, your own schedule first
Exact grant · role scope self:read
permissions
permissions.list
Read · Discover available and granted permissions
Metadata, always allowed; current authorization still applies.
playbooks
playbooks.buddyCandidates
Read · Suggested buddies for a new hire: outside their reporting line, volunteers first, with how many hires each is buddying
Exact grant · role scope playbooks:read
playbooks.buddyFollowUps
Read · Your "did you meet?" questions about a new hire or buddy you were paired with
Exact grant · role scope self:read
playbooks.buddyProgram
Read · Buddy volunteers and recent buddies, with how many of their hires said they met and how many never did
Exact grant · role scope playbooks:read
playbooks.buddySuggestions
Read · Suggest coworkers who could be your onboarding buddy
Exact grant · role scope self:read
playbooks.candidates
Read · List people who could be enrolled in onboarding
Exact grant · role scope playbooks:read
playbooks.enrollmentPreview
Read · Preview enrolling a new hire in onboarding
Exact grant · role scope playbooks:read
playbooks.firstDaysCheckIns
Read · Your open 30, 60 or 90-day or one-year new hire check-in
Exact grant · role scope self:read
playbooks.firstDaysResults
Read · What new hires said in their first 90 days check-ins, combined
Exact grant · role scope playbooks:read
playbooks.mine
Read · Read your own onboarding plan and buddy asks
Exact grant · role scope self:read
playbooks.person
Read · Read a new hire's onboarding plan
Exact grant · role scope playbooks:read
playbooks.plans
Read · The 30/60/90 plans for new hires you manage, and your own once your manager shares it
Exact grant · role scope self:read
playbooks.previewAs
Read · Which steps of a playbook one person would get, on which day, and why each skipped step is left out
Exact grant · role scope playbooks:read
playbooks.program
Read · Read the Onboarding program settings
Exact grant · role scope playbooks:read
playbooks.run
Read · One of your playbooks (onboarding or another): day 0, buddy, manager, upcoming check-ins, your to-dos and resources, and the other playbooks you are on
Exact grant · role scope self:read
playbooks.answerBuddyAsk
Write · Say yes or not now to being a new hire’s onboarding buddy
Exact grant · role scope self:write
playbooks.answerBuddyFollowUp
Write · Answer whether you met your buddy or new hire, and whether it helped
Exact grant · role scope self:write
playbooks.answerCheckIn
Write · Answer your onboarding program’s help check-in: all good, or ask HR for help
Exact grant · role scope self:write
playbooks.answerFirstDaysCheckIn
Write · Answer your new-hire check-in
Exact grant · role scope self:write
playbooks.answerForm
Write · Answer a playbook’s Tell us about you form; the answers fill in your profile
Exact grant · role scope self:write
playbooks.approve
Write · Approve these exact playbook messages for sending
Exact grant · role scope playbooks:write
playbooks.askBuddy
Write · Ask this coworker to be your onboarding buddy
Exact grant · role scope self:write
playbooks.askManagerForBuddy
Write · Ask your manager to help find you a buddy
Exact grant · role scope self:write
playbooks.assignBuddy
Write · Assign an onboarding buddy to a new hire
Exact grant · role scope playbooks:write
playbooks.completeTodo
Write · Check off (or reopen) one of your own playbook to-dos
Exact grant · role scope self:write
playbooks.draftPlan
Write · Have Mello draft the 30/60/90 plan for a new hire you manage (not yet shared)
Exact grant · role scope self:write
playbooks.enroll
Write · Put this person on a playbook
Exact grant · role scope playbooks:write
playbooks.nudge
Write · Send someone one Slack nudge about a hire’s overdue playbook to-dos, at most once a day
Exact grant · role scope playbooks:write
playbooks.previewEnrollment
Write · Preview the onboarding steps for a new hire
Exact grant · role scope playbooks:write
playbooks.remove
Write · Remove a new hire from onboarding
Exact grant · role scope playbooks:write
playbooks.respondBuddy
Write · Accept or decline being an onboarding buddy
Exact grant · role scope self:write
playbooks.retry
Write · Retry a failed onboarding step
Exact grant · role scope playbooks:write
playbooks.savePlan
Write · Write the goals of the 30/60/90 plan for a new hire you manage
Exact grant · role scope self:write
playbooks.saveProgram
Write · Save a playbook: its day 0, steps and messages
Exact grant · role scope playbooks:write
playbooks.setBuddyVolunteer
Write · Put someone on the buddy volunteer list, take them off it, or clear it
Exact grant · role scope playbooks:write
playbooks.setPlanGoal
Write · Tick a goal on a shared 30/60/90 plan done, or not done
Exact grant · role scope self:write
playbooks.update
Write · Change a new hire's onboarding start date or time zone
Exact grant · role scope playbooks:write
playbooks.volunteerAsBuddy
Write · Say you are happy to be an onboarding buddy, or stop
Exact grant · role scope self:write
praise
praise.composer
Read · Read who you can praise, the praise channels and company values
Exact grant · role scope self:read
praise.feed
Read · Read the Praise feed
Exact grant · role scope self:read
praise.insights
Read · Read Praise totals by value (groups of seven or more)
Exact grant · role scope praise:read
praise.mine
Read · Read praise you gave and received
Exact grant · role scope self:read
praise.ofPerson
Read · Read the public praise one person received
Exact grant · role scope self:read
praise.settings
Read · Read the Praise settings
Exact grant · role scope praise:read
praise.addChannel
Write · Read praise from this Slack channel from now on
Exact grant · role scope praise:write
praise.removeChannel
Write · Stop reading praise from a Slack channel
Exact grant · role scope praise:write
praise.saveSettings
Write · Save the Praise settings and company values
Exact grant · role scope praise:write
praise.send
Write · Praise coworkers in a praise channel
Exact grant · role scope self:write
praise.setDigest
Write · Choose whether you get the daily Praise digest
Exact grant · role scope self:write
praise.setHidden
Write · Hide or show a praise you received
Exact grant · role scope self:write
praise.setRecognition
Write · Choose whether praise for you is posted publicly or sent to you privately
Exact grant · role scope self:write
profiles
profiles.get
Read · Read a person’s profile as this team sees it
Exact grant · role scope users:read
profiles.whoKnows
Read · Find coworkers who know about a topic, place or skill from what they share on their profiles, with the words that matched
Exact grant · role scope users:read
profiles.draft
Write · Draft the empty parts of your own profile with Mello; nothing is saved
Exact grant · role scope profile:write
profiles.employeeNumber
Write · Set a person’s employee number to an unused number
Exact grant · role scope users:write
profiles.save
Write · Save your own profile: pronouns, location, phone, bio, interests, links and what you are working on
Exact grant · role scope profile:write
profiles.settings
Write · Choose who sees the optional parts of your own profile
Exact grant · role scope profile:write
profiles.cover
profiles.cover.delete
Write · Remove your profile cover picture
Exact grant · role scope profile:write
profiles.photo
profiles.photo.delete
Write · Remove your profile photo
Exact grant · role scope profile:write
profiles.positions
profiles.positions.delete
Write · Remove a past position from your profile
Exact grant · role scope profile:write
profiles.positions.save
Write · Add or change a past position on your profile
Exact grant · role scope profile:write
programs
programs.communities
Read · List communities a Connections program can take its people from, with how many members show each one on their profile
Exact grant · role scope programs:read
programs.get
Read · Read a program
Exact grant · role scope programs:read
programs.list
Read · List programs
Exact grant · role scope programs:read
programs.options
Read · List program setting choices
Exact grant · role scope programs:read
programs.people
Read · List the people in a program and whether they take part
Exact grant · role scope programs:read
programs.preview
Read · Preview matches without sending
Exact grant · role scope programs:read
programs.schedulePreview
Read · Preview a program's upcoming rounds
Exact grant · role scope programs:read
programs.archive
Write · Archive a program
Exact grant · role scope programs:write
programs.create
Write · Create a program
Exact grant · role scope programs:write
programs.joinChannel
Write · Add Shuffl to this public Slack channel
Exact grant · role scope programs:write
programs.pause
Write · Pause a Connections program and its introductions
Exact grant · role scope programs:write
programs.resume
Write · Activate a program and schedule
Exact grant · role scope programs:write
programs.syncRoster
Write · Refresh channel membership
Exact grant · role scope programs:write
programs.update
Write · Update a program
Exact grant · role scope programs:write
pulse
pulse.actions
Read · List Pulse actions: what is being done about each result, its owner, due date and before and after
Exact grant · role scope pulse:read
pulse.asked
Read · List the Pulse questions asked so far
Exact grant · role scope self:read
pulse.groupTrends
Read · Read each group's Pulse results over time, period by period, with the change since the start (published group totals only)
Exact grant · role scope pulse:read
pulse.insights
Read · Read Pulse totals and trends (groups of seven or more)
Exact grant · role scope pulse:read
pulse.latestRead
Read · Read what stands out in a closed Pulse question’s result
Exact grant · role scope pulse:read
pulse.mine
Read · Read your own Pulse streak, how many took part, and what changed because of it
Exact grant · role scope self:read
pulse.program
Read · Read the Pulse settings
Exact grant · role scope pulse:read
pulse.proposals
Read · List the Pulse questions Mello suggested that wait for approval
Exact grant · role scope pulse:read
pulse.questionDetail
Read · Read one closed Pulse question: its answer spread, every time it was asked, and results by group (groups of seven or more)
Exact grant · role scope pulse:read
pulse.questions
Read · List the Pulse question library
Exact grant · role scope pulse:read
pulse.today
Read · Read today’s Pulse question
Exact grant · role scope self:read
pulse.addQuestion
Write · Add a Pulse question to the library
Exact grant · role scope pulse:write
pulse.addTemplate
Write · Add a Pulse question set from a template
Exact grant · role scope pulse:write
pulse.answer
Write · Answer today’s Pulse question as yourself
Exact grant · role scope self:write
pulse.createAction
Write · Plan an action about a closed Pulse question, with an owner and a due date
Exact grant · role scope pulse:write
pulse.decideProposal
Write · Approve a suggested Pulse question so it is asked next, or dismiss it
Exact grant · role scope pulse:write
pulse.editProposal
Write · Reword a suggested Pulse question before approving it
Exact grant · role scope pulse:write
pulse.proposeQuestions
Write · Save drafted Pulse questions as suggestions for HR to approve (never asked until approved)
Exact grant · role scope pulse:write
pulse.requestProposals
Write · Ask Mello to suggest Pulse questions from recent results, optionally about a topic
Exact grant · role scope pulse:write
pulse.saveProgram
Write · Save Pulse settings; enabling Pulse schedules questions to everyone
Exact grant · role scope pulse:write
pulse.setQuestionGroup
Write · Aim a Pulse question at one of the workspace’s groups, or at everyone
Exact grant · role scope pulse:write
pulse.setQuestionStatus
Write · Retire or restore a Pulse question
Exact grant · role scope pulse:write
pulse.skip
Write · Skip today’s Pulse question
Exact grant · role scope self:write
pulse.updateAction
Write · Change a Pulse action’s wording, owner, due date or status
Exact grant · role scope pulse:write
reminders
reminders.mine
Read · Read your own Praise and Pulse reminder choices
Exact grant · role scope self:read
reminders.settings
Read · Read whether Praise and Pulse reminders are on, and their timing
Exact grant · role scope team:read
reminders.saveMine
Write · Change or turn off your own Praise or Pulse reminders
Exact grant · role scope self:write
reminders.saveSetting
Write · Turn a Praise or Pulse reminder on or off, or change its timing
Exact grant · role scope team:write
reports
reports.answerFeedback
Read · Read feedback on Mello's answers
Exact grant · role scope reports:read
reports.celebrations
Read · Celebrations sent, people celebrated, birthdays and anniversaries, shared with the team, team cards and notes, share answers and missed messages over 30, 90 or 180 days against the period before, with a weekly series
Exact grant · role scope reports:read
reports.connections
Read · Read Connections insights
Exact grant · role scope reports:read
reports.knowledge
Read · Read Knowledge activity
Exact grant · role scope reports:read
reports.knowledgeSource
Read · Read activity for one Knowledge source
Exact grant · role scope reports:read
reports.melloTrial
Read · What Mello handled during the trial, from day 25 of a trial until it ends
Exact grant · role scope reports:read
reports.melloValue
Read · What Mello handled this week, this month and all time, with time saved once the team has set its minutes per question
Exact grant · role scope reports:read
reports.mentorship
Read · Mentorship over 30, 90 or 180 days against the period before: pairs started, ended early and completed, check-ins answered and met, pairs meeting and mentees waiting now; `programId` narrows it. `outcomes` compares people who were in a pairing with peers at similar tenure, hidden under five people. Never anyone’s goals
Exact grant · role scope reports:read
reports.needsYou
Read · Read HR request and Knowledge draft insights
Exact grant · role scope reports:read
reports.overview
Read · Read the workspace overview figures
Exact grant · role scope reports:read
reports.people
Read · Read People insights: headcount, teams and growth
Exact grant · role scope reports:read
reports.playbooks
Read · Read Onboarding insights
Exact grant · role scope reports:read
requests
requests.get
Read · Read one request you asked for, approve or carry out, with its history
Exact grant · role scope self:read
requests.letterTemplate
Read · Read the letter template: company, address, signatory and whether salary may be asked for
Exact grant · role scope hr:read
requests.mine
Read · List your own requests of every kind and where each stands
Exact grant · role scope self:read
requests.types
Read · List the kinds of request people can make here and what each asks for
Exact grant · role scope self:read
requests.waiting
Read · List the requests waiting on you to decide or carry out
Exact grant · role scope self:read
requests.answer
Write · Answer an approver’s question on your request
Exact grant · role scope self:write
requests.archiveType
Write · Take a request type out of the catalog, or put it back
Exact grant · role scope hr:write
requests.cancel
Write · Cancel a request you made while it waits or before it is carried out
Exact grant · role scope self:write
requests.complete
Write · Mark an approved request you carry out as done, so the person is told
Exact grant · role scope self:write
requests.file
Write · Ask for something that needs approval: what you need, why, and who should approve it
Exact grant · role scope self:write
requests.saveLetterTemplate
Write · Change the letter template: company, address, who signs, an extra paragraph and salary letters
Exact grant · role scope hr:write
requests.saveType
Write · Add or change a request type: its fields, approvers, owners and response target
Exact grant · role scope hr:write
runs
runs.details
Read · Read one introduction round and its pairs
Exact grant · role scope runs:read
runs.get
Read · Read a run status
Exact grant · role scope runs:read
runs.list
Read · List a program's introduction rounds
Exact grant · role scope runs:read
runs.dispatch
Write · Dispatch this queued introduction run
Exact grant · role scope runs:write
runs.request
Write · Request introductions from a preview
Exact grant · role scope runs:write
runs.resolveMonthlyReview
Write · Settle a monthly round held for review with a recorded decision
Exact grant · role scope runs:write
runs.retry
Write · Retry introduction delivery
Exact grant · role scope runs:write
runs.stopKnownFailures
Write · Stop retrying known failed deliveries and advance the preserved monthly schedule
Exact grant · role scope runs:write
runs.history
runs.history.get
Read · Read one introduction round imported from the previous Shuffl
Exact grant · role scope exports:read
runs.history.list
Read · List introduction rounds imported from the previous Shuffl
Exact grant · role scope exports:read
runs.history.people
Read · People recorded in preserved rounds, each with their link or suggested match in People
Exact grant · role scope exports:read
runs.history.linkPeople
Write · Link people from preserved rounds to the matching person in People
Exact grant · role scope runs:write
spend
spend.current
Read · List the connected spend platform and what it may read
Exact grant · role scope integrations:read
spend.mine
Read · Read the company’s spend programs and your own cards and limits
Exact grant · role scope self:read
spend.programs
Read · Read the spend programs as the spend platform holds them now
Exact grant · role scope integrations:read
spend.disconnect
Write · Disconnect the spend platform; Mello stops reading it at once
Exact grant · role scope integrations:write
spend.draftPolicy
Write · Draft the spending policy page in Knowledge from the spend programs
Exact grant · role scope integrations:write
spend.setCardLimits
Write · Set the limit new company cards get for each group, and the default
Exact grant · role scope integrations:write
spend.setWrites
Write · Let Shuffl file reimbursements and change company cards in the spend platform, or stop it
Exact grant · role scope integrations:write
spend.cards
spend.cards.changes
Read · List card changes waiting for HR after someone moved in People
Exact grant · role scope integrations:read
spend.cards.forPerson
Read · Read one person’s company cards, the limit their groups map to and what Shuffl changed
Exact grant · role scope integrations:read
spend.cards.dismissChange
Write · Dismiss a card change waiting after a move; nothing changes in the spend platform
Exact grant · role scope integrations:write
spend.cards.issue
Write · Issue someone a virtual company card with the limit their groups map to
Exact grant · role scope integrations:write
spend.cards.lock
Write · Lock every company card a person holds and read each one back
Exact grant · role scope integrations:write
spend.cards.updateLimit
Write · Change a company card’s limit and make the person’s manager its approver
Exact grant · role scope integrations:write
support
support.get
Read · Read one Shuffl support conversation
Exact grant · role scope support:read
support.list
Read · List the workspace's support conversations with Shuffl
Exact grant · role scope support:read
support.assign
Write · Assign a Shuffl support conversation
Exact grant · role scope support:write
support.close
Write · Close a Shuffl support conversation
Exact grant · role scope support:write
support.create
Write · Start a support conversation with Shuffl
Exact grant · role scope support:write
support.reply
Write · Reply in a Shuffl support conversation
Exact grant · role scope support:write
sync
sync.current
Read · Read the People sync provider, its last sync and what it found
Exact grant · role scope integrations:read
sync.groups
Read · List this source’s groups and which ones come into Shuffl
Exact grant · role scope integrations:read
sync.connect
Write · Connect a directory sync provider with the credential given
Exact grant · role scope integrations:write
sync.disconnect
Write · Disconnect this directory sync provider
Exact grant · role scope integrations:write
sync.request
Write · Ask for a People sync provider Shuffl does not support yet
Exact grant · role scope integrations:write
sync.run
Write · Sync People from the connected provider now
Exact grant · role scope integrations:write
sync.setAccess
Write · Turn automatic access on or off for this people sync connection
Exact grant · role scope integrations:write
sync.setGroup
Write · Change which of this source’s groups come into Shuffl
Exact grant · role scope integrations:write
sync.setWrites
Write · Let Mello file requests in this source, or stop it
Exact grant · role scope integrations:write
team
team.launchPost
Read · Read the launch announcement for the workspace
Exact grant · role scope team:read
team.answerMinutes
Write · Set the team estimate of minutes per HR question, used for time saved
Exact grant · role scope team:write
team.dismissLaunchPost
Write · Dismiss the Tell your team what they can ask post on Today for everyone
Exact grant · role scope team:write
teams
teams.connectionPermissions
Read · List connections whose permissions are behind what Shuffl asks for
Exact grant · role scope team:read
teams.current
Read · Read this token’s team
Metadata, always allowed; current authorization still applies.
teams.heldDelivery
Read · Read one held message as the person would have seen it
Exact grant · role scope team:read
teams.rehearsal
Read · See whether the workspace rehearses, what was held and what is coming
Exact grant · role scope team:read
teams.setup
Read · Read the workspace's setup checklist
Exact grant · role scope team:read
teams.slackChannels
Read · List community channels in the connected Slack and what each would become
Exact grant · role scope integrations:read
teams.slackConnection
Read · Read whether the workspace's Slack is connected, and why not
Exact grant · role scope integrations:read
teams.slackJoinAccess
Read · Read whether Slack members can join Shuffl on their own
Exact grant · role scope team:read
teams.slackProfileLink
Read · Read the Shuffl profile link setting for Slack profiles
Exact grant · role scope team:read
teams.discardPairHistory
Write · Remove this staged past-intros report
Exact grant · role scope integrations:write
teams.initialize
Write · Finish setting up a new workspace
Exact grant · role scope team:write
teams.moveSlackChannels
Write · Set up each channel in Shuffl: paused intros, praise and celebrations
Exact grant · role scope integrations:write
teams.rename
Write · Rename the workspace
Exact grant · role scope team:write
teams.resendSlackWelcome
Write · Send the Slack install welcome to your own Slack DM again
Exact grant · role scope integrations:write
teams.saveAgentSetup
Write · Choose the built-in assistant or an external agent for the workspace
Exact grant · role scope team:write
teams.saveSlackJoinAccess
Write · Choose whether Slack members can join Shuffl on their own
Exact grant · role scope team:write
teams.saveSlackProfileLink
Write · Turn the Shuffl profile link on Slack profiles on or off
Exact grant · role scope team:write
teams.setDeliveryMode
Write · Go live or back to rehearsal
Exact grant · role scope team:write
teams.setPilotGroup
Write · Pilot with one group while rehearsing
Exact grant · role scope team:write
teams.status
Write · Pause or resume the whole workspace
Exact grant · role scope team:write
teams.syncSlackProfileLinks
Write · Write the Shuffl profile link to every Slack profile again
Exact grant · role scope team:write
teams.uploadPairHistory
Write · Stage this past-intros report for the switch; nothing changes until it is applied
Exact grant · role scope integrations:write
timeOff
timeOff.balances
Read · Read your own time-off balances from the connected HR system
Exact grant · role scope self:read
timeOff.cancel
Write · Cancel a pending time-off request Mello filed
Exact grant · role scope self:write
timeOff.request
Write · Request time off in your HR system; it waits for approval there
Exact grant · role scope self:write
units
units.list
Read · List the departments in the People directory
Exact grant · role scope users:read
users
users.activity
Read · Read a person's recent activity in Shuffl
Exact grant · role scope users:read
users.blockedPairs
Read · List pairs of people who are never introduced
Exact grant · role scope users:read
users.details
Read · Read one person's People directory record
Exact grant · role scope users:read
users.filterOptions
Read · List the teams, departments, managers and locations People can filter by
Exact grant · role scope users:read
users.get
Read · Read a person
Exact grant · role scope users:read
users.glance
Read · Headcount, growth, departments, tenure and time zones, and where you fit
Exact grant · role scope users:read
users.list
Read · List people
Exact grant · role scope users:read
users.managerHistory
Read · Read a person's recorded manager history
Exact grant · role scope users:read
users.managers
Read · List the managers in the People directory
Exact grant · role scope users:read
users.page
Read · List people in the People directory: search, or filter by team, department, manager, location, access or workspace role such as owner, admin or HR responder
Exact grant · role scope users:read
users.participants
Read · List the people who take part in programs
Exact grant · role scope users:read
users.reportingLineProposal
Read · Read the reporting lines Mello proposed that wait for review
Exact grant · role scope users:read
users.assignManagers
Write · Set the manager of several people at once
Exact grant · role scope users:write
users.blockPair
Write · Stop two people from being introduced to each other
Exact grant · role scope users:write
users.participation
Write · Opt a person in to or out of a program
Exact grant · role scope participation:write
users.profile
Write · Edit a person's profile as an administrator
Exact grant · role scope profile:write
users.proposeReportingLines
Write · Ask Mello to propose managers for people without one; nothing changes until reviewed
Exact grant · role scope users:write
users.reviewReportingLines
Write · Approve chosen proposed reporting lines and close the proposal
Exact grant · role scope users:write
users.save
Write · Change someone's People directory record as an administrator: name, job title, manager, team, department or start date
Exact grant · role scope users:write
webhooks
webhooks.catalog
Read · List the webhook event types and which ones this key can subscribe to
Exact grant · role scope webhooks:read
webhooks.get
Read · Read one webhook endpoint
Exact grant · role scope webhooks:read
webhooks.list
Read · List webhook endpoints, their status and delivery success over 24 hours
Exact grant · role scope webhooks:read
webhooks.create
Write · Add a webhook endpoint that receives the chosen events, and get its signing secret
Exact grant · role scope webhooks:write
webhooks.delete
Write · Delete a webhook endpoint and its delivery log
Exact grant · role scope webhooks:write
webhooks.rotateSecret
Write · Roll a webhook endpoint’s signing secret, keeping the old one valid for a while
Exact grant · role scope webhooks:write
webhooks.sendTest
Write · Send a webhook.test event to an endpoint now
Exact grant · role scope webhooks:write
webhooks.update
Write · Change a webhook endpoint’s URL, description or events, or turn it on or off
Exact grant · role scope webhooks:write
webhooks.deliveries
webhooks.deliveries.get
Read · Read one webhook delivery: the request body and every attempt’s answer
Exact grant · role scope webhooks:read
webhooks.deliveries.list
Read · List an endpoint’s webhook deliveries, newest first
Exact grant · role scope webhooks:read
webhooks.deliveries.replay
Write · Resend one webhook delivery with the same event id
Exact grant · role scope webhooks:write
webhooks.deliveries.replayFailed
Write · Resend every failed webhook delivery of an endpoint since a time
Exact grant · role scope webhooks:write