Permissions

Permissions in Stalwart determine which actions and resources a principal is allowed to access. They can be assigned directly to individuals or groups, through roles, or on a tenant as a whole.

To simplify management, multiple permissions can be grouped into a Role object (found in the WebUI under Management › Directory › Roles) and assigned through a single reference on the principal.

Effective Permissions

Each principal carries two permission-related fields: enabledPermissions and disabledPermissions. On Account and Group objects these are wrapped by a Permissions mode that can be Inherit, Merge, or Replace, selecting how the listed permissions combine with those inherited from roles and the containing tenant. The effective permissions of a principal are computed as follows:

Start from the enabled permissions of any assigned roles.
Apply the principal’s own enabledPermissions according to the configured mode (inherit, merge with, or replace the role-derived set).
Intersect with the tenant’s enabled permissions, in multi-tenant deployments.
Subtract every permission listed in disabledPermissions at any level. Disabled permissions always take precedence.

The result is a layered model in which permissions can be added or removed at the role, principal, or tenant level.

Permissions vs. ACLs

Permissions in Stalwart are distinct from Access Control Lists (ACLs).

Permissions are defined by administrators and control which server-wide actions a principal may perform, such as managing settings, viewing logs, or sending email.
Access Control Lists are managed by users and grant other principals access to specific mailboxes, folders, or other per-resource data. ACLs are controlled through the IMAP ACL extension or JMAP and apply per resource.

Permissions are an administrative policy; ACLs are a user-level sharing mechanism.

Available Permissions

The following table lists the permissions recognised by the server and the built-in roles that include them:

Permission	Description	Admin role	Tenant admin role	User role
`ai-model-interact`	Interact with AI models	✅
`api-key-create`	Create new API keys	✅	✅
`api-key-delete`	Remove API keys	✅	✅
`api-key-get`	Retrieve specific API keys	✅	✅
`api-key-list`	View API keys	✅	✅
`api-key-update`	Modify API keys	✅	✅
`authenticate`	Authenticate	✅	✅	✅
`authenticate-oauth`	Authenticate via OAuth	✅	✅	✅
`blob-fetch`	Retrieve arbitrary blobs	✅
`calendar-alarms`	Receive calendar alarms via e-mail	✅	✅	✅
`calendar-scheduling-receive`	Receive calendar scheduling requests via e-mail	✅	✅	✅
`calendar-scheduling-send`	Send calendar scheduling requests via e-mail	✅	✅	✅
`dav-cal-acl`	Manage access control lists for calendar entries	✅	✅	✅
`dav-cal-copy`	Copy calendar entries to new locations	✅	✅	✅
`dav-cal-delete`	Remove calendar entries or collections	✅	✅	✅
`dav-cal-free-busy-query`	Query free/busy time information for scheduling	✅	✅	✅
`dav-cal-get`	Download calendar entries	✅	✅	✅
`dav-cal-lock`	Lock calendar entries to prevent concurrent modifications	✅	✅	✅
`dav-cal-mk-col`	Create new calendar collections	✅	✅	✅
`dav-cal-move`	Move calendar entries to new locations	✅	✅	✅
`dav-cal-multi-get`	Retrieve multiple calendar entries in a single request	✅	✅	✅
`dav-cal-prop-find`	Retrieve properties of calendar entries	✅	✅	✅
`dav-cal-prop-patch`	Modify properties of calendar entries	✅	✅	✅
`dav-cal-put`	Upload or modify calendar entries	✅	✅	✅
`dav-cal-query`	Search for calendar entries matching criteria	✅	✅	✅
`dav-card-acl`	Manage access control lists for address book entries	✅	✅	✅
`dav-card-copy`	Copy address book entries to new locations	✅	✅	✅
`dav-card-delete`	Remove address book entries or collections	✅	✅	✅
`dav-card-get`	Download address book entries	✅	✅	✅
`dav-card-lock`	Lock address book entries to prevent concurrent modifications	✅	✅	✅
`dav-card-mk-col`	Create new address book collections	✅	✅	✅
`dav-card-move`	Move address book entries to new locations	✅	✅	✅
`dav-card-multi-get`	Retrieve multiple address book entries in a single request	✅	✅	✅
`dav-card-prop-find`	Retrieve properties of address book entries	✅	✅	✅
`dav-card-prop-patch`	Modify properties of address book entries	✅	✅	✅
`dav-card-put`	Upload or modify address book entries	✅	✅	✅
`dav-card-query`	Search for address book entries matching criteria	✅	✅	✅
`dav-expand-property`	Expand properties that reference other resources	✅	✅	✅
`dav-file-acl`	Manage access control lists for file resources	✅	✅	✅
`dav-file-copy`	Copy file resources to new locations	✅	✅	✅
`dav-file-delete`	Remove file resources	✅	✅	✅
`dav-file-get`	Download file resources	✅	✅	✅
`dav-file-lock`	Lock file resources to prevent concurrent modifications	✅	✅	✅
`dav-file-mk-col`	Create new file collections or directories	✅	✅	✅
`dav-file-move`	Move file resources to new locations	✅	✅	✅
`dav-file-prop-find`	Retrieve properties of file resources	✅	✅	✅
`dav-file-prop-patch`	Modify properties of file resources	✅	✅	✅
`dav-file-put`	Upload or modify file resources	✅	✅	✅
`dav-principal-acl`	Set principal properties for access control	✅	✅	✅
`dav-principal-list`	List available principals in the system	✅	✅	✅
`dav-principal-match`	Match principals based on specified criteria	✅	✅	✅
`dav-principal-search`	Search for principals by property values	✅	✅	✅
`dav-principal-search-prop-set`	Define property sets for principal searches	✅	✅	✅
`dav-sync-collection`	Synchronize collection changes with client	✅	✅	✅
`dkim-signature-create`	Create DKIM signatures for email authentication	✅	✅
`dkim-signature-get`	Retrieve DKIM signature information	✅	✅
`domain-create`	Add new email domains	✅	✅
`domain-delete`	Remove email domains	✅	✅
`domain-get`	Retrieve specific domain information	✅	✅
`domain-list`	View list of email domains	✅	✅
`domain-update`	Modify domain information	✅	✅
`email-receive`	Receive emails	✅	✅	✅
`email-send`	Send emails	✅	✅	✅
`fts-reindex`	Rebuild the full-text search index	✅
`group-create`	Add new user groups	✅	✅
`group-delete`	Remove user groups	✅	✅
`group-get`	Retrieve specific group information	✅	✅
`group-list`	View list of user groups	✅	✅
`group-update`	Modify group information	✅	✅
`imap-acl-get`	Retrieve ACLs via IMAP	✅	✅	✅
`imap-acl-set`	Set ACLs via IMAP	✅	✅	✅
`imap-append`	Append messages via IMAP	✅	✅	✅
`imap-authenticate`	Authenticate via IMAP	✅	✅	✅
`imap-capability`	Retrieve server capabilities via IMAP	✅	✅	✅
`imap-copy`	Copy messages via IMAP	✅	✅	✅
`imap-create`	Create mailboxes via IMAP	✅	✅	✅
`imap-delete`	Delete mailboxes or messages via IMAP	✅	✅	✅
`imap-enable`	Enable IMAP extensions	✅	✅	✅
`imap-examine`	Examine mailboxes via IMAP	✅	✅	✅
`imap-expunge`	Expunge deleted messages via IMAP	✅	✅	✅
`imap-fetch`	Fetch messages or metadata via IMAP	✅	✅	✅
`imap-id`	Retrieve server ID via IMAP	✅	✅	✅
`imap-idle`	Use IMAP IDLE command	✅	✅	✅
`imap-list`	List mailboxes via IMAP	✅	✅	✅
`imap-list-rights`	List rights via IMAP	✅	✅	✅
`imap-lsub`	List subscribed mailboxes via IMAP	✅	✅	✅
`imap-move`	Move messages via IMAP	✅	✅	✅
`imap-my-rights`	Retrieve own rights via IMAP	✅	✅	✅
`imap-namespace`	Retrieve namespaces via IMAP	✅	✅	✅
`imap-rename`	Rename mailboxes via IMAP	✅	✅	✅
`imap-search`	Search messages via IMAP	✅	✅	✅
`imap-select`	Select mailboxes via IMAP	✅	✅	✅
`imap-sort`	Sort messages via IMAP	✅	✅	✅
`imap-status`	Retrieve mailbox status via IMAP	✅	✅	✅
`imap-store`	Modify message flags via IMAP	✅	✅	✅
`imap-subscribe`	Subscribe to mailboxes via IMAP	✅	✅	✅
`imap-thread`	Thread messages via IMAP	✅	✅	✅
`impersonate`	Act on behalf of another user	✅
`incoming-report-delete`	Remove incoming DMARC, TLS and ARF reports	✅	✅
`incoming-report-get`	Retrieve specific incoming DMARC, TLS and ARF reports	✅	✅
`incoming-report-list`	View incoming DMARC, TLS and ARF reports	✅	✅
`individual-create`	Add new user accounts	✅	✅
`individual-delete`	Remove user accounts	✅	✅
`individual-get`	Retrieve specific account information	✅	✅
`individual-list`	View list of user accounts	✅	✅
`individual-update`	Modify user account information	✅	✅
`jmap-address-book-changes`	Track address book changes via JMAP	✅	✅	✅
`jmap-address-book-get`	Retrieve address books via JMAP	✅	✅	✅
`jmap-address-book-set`	Create or update address books via JMAP	✅	✅	✅
`jmap-blob-copy`	Copy blobs via JMAP	✅	✅	✅
`jmap-blob-get`	Retrieve blobs via JMAP	✅	✅	✅
`jmap-blob-lookup`	Look up blobs via JMAP	✅	✅	✅
`jmap-blob-upload`	Upload blobs via JMAP	✅	✅	✅
`jmap-calendar-changes`	Track calendar changes via JMAP	✅	✅	✅
`jmap-calendar-event-changes`	Track calendar event changes via JMAP	✅	✅	✅
`jmap-calendar-event-copy`	Copy calendar events to new locations via JMAP	✅	✅	✅
`jmap-calendar-event-get`	Retrieve calendar events via JMAP	✅	✅	✅
`jmap-calendar-event-notification-changes`	Track calendar event notification changes via JMAP	✅	✅	✅
`jmap-calendar-event-notification-get`	Retrieve calendar event notifications via JMAP	✅	✅	✅
`jmap-calendar-event-notification-query`	Search for calendar event notifications matching criteria via JMAP	✅	✅	✅
`jmap-calendar-event-notification-query-changes`	Track calendar event notification query changes via JMAP	✅	✅	✅
`jmap-calendar-event-notification-set`	Create or update calendar event notifications via JMAP	✅	✅	✅
`jmap-calendar-event-parse`	Parse calendar events via JMAP	✅	✅	✅
`jmap-calendar-event-query`	Search for calendar events matching criteria via JMAP	✅	✅	✅
`jmap-calendar-event-query-changes`	Track calendar event query changes via JMAP	✅	✅	✅
`jmap-calendar-event-set`	Create or update calendar events via JMAP	✅	✅	✅
`jmap-calendar-get`	Retrieve calendars via JMAP	✅	✅	✅
`jmap-calendar-set`	Create or update calendars via JMAP	✅	✅	✅
`jmap-contact-card-changes`	Track contact card changes via JMAP	✅	✅	✅
`jmap-contact-card-copy`	Copy contact cards to new locations via JMAP	✅	✅	✅
`jmap-contact-card-get`	Retrieve contact cards via JMAP	✅	✅	✅
`jmap-contact-card-parse`	Parse contact cards via JMAP	✅	✅	✅
`jmap-contact-card-query`	Search for contact cards matching criteria via JMAP	✅	✅	✅
`jmap-contact-card-query-changes`	Track contact card query changes via JMAP	✅	✅	✅
`jmap-contact-card-set`	Create or update contact cards via JMAP	✅	✅	✅
`jmap-echo`	Perform JMAP echo requests	✅	✅	✅
`jmap-email-changes`	Track email changes via JMAP	✅	✅	✅
`jmap-email-copy`	Copy emails via JMAP	✅	✅	✅
`jmap-email-get`	Retrieve emails via JMAP	✅	✅	✅
`jmap-email-import`	Import emails via JMAP	✅	✅	✅
`jmap-email-parse`	Parse emails via JMAP	✅	✅	✅
`jmap-email-query`	Perform email queries via JMAP	✅	✅	✅
`jmap-email-query-changes`	Track email query changes via JMAP	✅	✅	✅
`jmap-email-set`	Modify emails via JMAP	✅	✅	✅
`jmap-email-submission-changes`	Track email submission changes via JMAP	✅	✅	✅
`jmap-email-submission-get`	Retrieve email submission info via JMAP	✅	✅	✅
`jmap-email-submission-query`	Perform email submission queries via JMAP	✅	✅	✅
`jmap-email-submission-query-changes`	Track email submission query changes via JMAP	✅	✅	✅
`jmap-email-submission-set`	Modify email submission settings via JMAP	✅	✅	✅
`jmap-file-node-changes`	Track file node changes via JMAP	✅	✅	✅
`jmap-file-node-get`	Retrieve file nodes via JMAP	✅	✅	✅
`jmap-file-node-query`	Search for file nodes matching criteria via JMAP	✅	✅	✅
`jmap-file-node-query-changes`	Track file node query changes via JMAP	✅	✅	✅
`jmap-file-node-set`	Create or update file nodes via JMAP	✅	✅	✅
`jmap-identity-changes`	Track identity changes via JMAP	✅	✅	✅
`jmap-identity-get`	Retrieve user identities via JMAP	✅	✅	✅
`jmap-identity-set`	Modify user identities via JMAP	✅	✅	✅
`jmap-mailbox-changes`	Track mailbox changes via JMAP	✅	✅	✅
`jmap-mailbox-get`	Retrieve mailboxes via JMAP	✅	✅	✅
`jmap-mailbox-query`	Perform mailbox queries via JMAP	✅	✅	✅
`jmap-mailbox-query-changes`	Track mailbox query changes via JMAP	✅	✅	✅
`jmap-mailbox-set`	Modify mailboxes via JMAP	✅	✅	✅
`jmap-participant-identity-changes`	Track participant identity changes via JMAP	✅	✅	✅
`jmap-participant-identity-get`	Retrieve participant identity information via JMAP	✅	✅	✅
`jmap-participant-identity-set`	Create or update participant identities via JMAP	✅	✅	✅
`jmap-principal-changes`	Track principal changes via JMAP	✅	✅	✅
`jmap-principal-get`	Retrieve principal information via JMAP	✅	✅	✅
`jmap-principal-get-availability`	Retrieve availability information via JMAP	✅	✅	✅
`jmap-principal-query`	Perform principal queries via JMAP	✅	✅	✅
`jmap-principal-query-changes`	Track principal query changes via JMAP	✅	✅	✅
`jmap-push-subscription-get`	Retrieve push subscriptions via JMAP	✅	✅	✅
`jmap-push-subscription-set`	Modify push subscriptions via JMAP	✅	✅	✅
`jmap-quota-changes`	Track quota changes via JMAP	✅	✅	✅
`jmap-quota-get`	Retrieve quota information via JMAP	✅	✅	✅
`jmap-quota-query`	Perform quota queries via JMAP	✅	✅	✅
`jmap-quota-query-changes`	Track quota query changes via JMAP	✅	✅	✅
`jmap-search-snippet`	Retrieve search snippets via JMAP	✅	✅	✅
`jmap-share-notification-changes`	Track share notification changes via JMAP	✅	✅	✅
`jmap-share-notification-get`	Retrieve share notifications via JMAP	✅	✅	✅
`jmap-share-notification-query`	Search for share notifications matching criteria via JMAP	✅	✅	✅
`jmap-share-notification-query-changes`	Track share notification query changes via JMAP	✅	✅	✅
`jmap-share-notification-set`	Create or update share notifications via JMAP	✅	✅	✅
`jmap-sieve-script-get`	Retrieve Sieve scripts via JMAP	✅	✅	✅
`jmap-sieve-script-query`	Perform Sieve script queries via JMAP	✅	✅	✅
`jmap-sieve-script-query-changes`	Track Sieve script query changes via JMAP	✅	✅	✅
`jmap-sieve-script-set`	Modify Sieve scripts via JMAP	✅	✅	✅
`jmap-sieve-script-validate`	Validate Sieve scripts via JMAP	✅	✅	✅
`jmap-thread-changes`	Track thread changes via JMAP	✅	✅	✅
`jmap-thread-get`	Retrieve email threads via JMAP	✅	✅	✅
`jmap-vacation-response-get`	Retrieve vacation responses via JMAP	✅	✅	✅
`jmap-vacation-response-set`	Modify vacation responses via JMAP	✅	✅	✅
`logs-view`	Access system logs	✅
`mailing-list-create`	Create new mailing lists	✅	✅
`mailing-list-delete`	Remove mailing lists	✅	✅
`mailing-list-get`	Retrieve specific mailing list information	✅	✅
`mailing-list-list`	View list of mailing lists	✅	✅
`mailing-list-update`	Modify mailing list information	✅	✅
`manage-encryption`	Manage encryption-at-rest settings	✅	✅	✅
`manage-passwords`	Manage account passwords	✅	✅	✅
`message-queue-delete`	Remove messages from the queue	✅	✅
`message-queue-get`	Retrieve specific messages from the queue	✅	✅
`message-queue-list`	View message queue	✅	✅
`message-queue-update`	Modify queued messages	✅	✅
`metrics-list`	View stored metrics	✅
`metrics-live`	View real-time metrics	✅
`oauth-client-create`	Create new OAuth clients	✅
`oauth-client-delete`	Remove OAuth clients	✅
`oauth-client-get`	Retrieve specific OAuth clients	✅
`oauth-client-list`	View OAuth clients	✅
`oauth-client-override`	Override OAuth client settings	✅
`oauth-client-registration`	Register OAuth clients	✅
`oauth-client-update`	Modify OAuth clients	✅
`outgoing-report-delete`	Remove outgoing DMARC and TLS reports	✅	✅
`outgoing-report-get`	Retrieve specific outgoing DMARC and TLS reports	✅	✅
`outgoing-report-list`	View outgoing DMARC and TLS reports	✅	✅
`pop3-authenticate`	Authenticate via POP3	✅	✅	✅
`pop3-dele`	Mark messages for deletion via POP3	✅	✅	✅
`pop3-list`	List messages via POP3	✅	✅	✅
`pop3-retr`	Retrieve messages via POP3	✅	✅	✅
`pop3-stat`	Retrieve mailbox statistics via POP3	✅	✅	✅
`pop3-uidl`	Retrieve unique IDs via POP3	✅	✅	✅
`principal-create`	Create new principals	✅	✅
`principal-delete`	Remove principals	✅	✅
`principal-get`	Retrieve specific principal information	✅	✅
`principal-list`	View list of principals	✅	✅
`principal-update`	Modify principal information	✅	✅
`purge-account`	Purge user accounts	✅
`purge-blob-store`	Purge the blob storage	✅
`purge-data-store`	Purge the data storage	✅
`purge-in-memory-store`	Purge the in-memory storage	✅
`restart`	Restart the email server	✅
`role-create`	Create new roles	✅	✅
`role-delete`	Remove roles	✅	✅
`role-get`	Retrieve specific role information	✅	✅
`role-list`	View list of roles	✅	✅
`role-update`	Modify role information	✅	✅
`settings-delete`	Remove system settings	✅
`settings-list`	View system settings	✅
`settings-reload`	Refresh system settings	✅
`settings-update`	Modify system settings	✅
`sieve-authenticate`	Authenticate for Sieve script management	✅	✅	✅
`sieve-check-script`	Validate Sieve scripts	✅	✅	✅
`sieve-delete-script`	Delete Sieve scripts	✅	✅	✅
`sieve-get-script`	Retrieve Sieve scripts	✅	✅	✅
`sieve-have-space`	Check available space for Sieve scripts	✅	✅	✅
`sieve-list-scripts`	List Sieve scripts	✅	✅	✅
`sieve-put-script`	Upload Sieve scripts	✅	✅	✅
`sieve-rename-script`	Rename Sieve scripts	✅	✅	✅
`sieve-set-active`	Set active Sieve script	✅	✅	✅
`spam-filter-test`	Test the spam filter	✅	✅
`spam-filter-train`	Train the spam filter	✅	✅
`spam-filter-update`	Modify spam filter settings	✅
`tenant-create`	Add new tenants	✅
`tenant-delete`	Remove tenants	✅
`tenant-get`	Retrieve specific tenant information	✅
`tenant-list`	View list of tenants	✅
`tenant-update`	Modify tenant information	✅
`tracing-get`	Retrieve specific trace information	✅
`tracing-list`	View stored traces	✅
`tracing-live`	Perform real-time tracing	✅
`troubleshoot`	Perform troubleshooting	✅
`undelete`	Restore deleted items	✅	✅
`unlimited-requests`	Perform unlimited requests	✅
`unlimited-uploads`	Upload unlimited data	✅
`webadmin-update`	Modify web admin interface settings	✅