The following tables show the permissions and API operations covered by each verb. The level of access is cumulative as you go from inspect > read > use > manage. For example, a group that can use a resource can also inspect and read that resource. A plus sign (+) in a table cell indicates incremental access compared to the cell directly above it, whereas "no extra" indicates no incremental access.
For example, the read verb for sddcs includes the same permissions and API operations as the inspect verb, plus the SDDC_READ permission and a number of API operations (e.g., GetSddc, ListWorkRequests, etc.). The use verb covers two more permissions and set of API operations compared to read. And manage covers five more permissions and operations compared to use.
sddcs
Verbs
Permissions
APIs Fully Covered
APIs Partially Covered
inspect
SDDC_INSPECT
ListSddcs
ListWorkRequests
none
read
INSPECT +
SDDC_READ
INSPECT +
GetSddc
GetWorkRequest
none
use
READ +
SDDC_UPDATE
SDDC_UPDATE_ESXI_HOST
READ +
UpdateSddc
UpdateEsxiHost
none
manage
USE +
SDDC_CREATE
SDDC_MOVE
SDDC_ADD_ESXI_HOST
SDDC_DELETE_ESXI_HOST
SDDC_DELETE
USE +
ChangeSddcCompartment
CreateSddc (also need manage instances, manage vcns, use subnets, use vnics, use vlans, use private-ips, inspect security-lists, use network-security-groups)
DeleteSddc, CreateEsxiHost, DeleteEsxiHost (also need manage instances, manage vcns, use subnets, use vnics, use vlans, use private-ips)
Permissions Required for Each API Operation 🔗
The following table lists the API operations in a logical order, grouped by resource type.
For information about permissions, see Permissions.