Integration

Permit.io integration

Permit.io is authorization as a service: it decides who may do what in your application. Manage the policy model (resources with their actions, attributes, roles and relations, tenant roles and their permissions, condition sets and their rules) and the data checked against it (users, tenants, role assignments, resource instances, relationship tuples and groups), in bulk or one by one, and read the decision audit log. Every write changes who can access what in the application connected to Permit. Permission checks themselves are in the separate Permit.io Cloud PDP API. Left out: API keys, organization, member, invite, project and environment administration, PDP, proxy, email and policy repository configuration (their answers carry secrets), user invites, API history, activity log, data export and early-access features. Authentication is a Permit API key sent as a Bearer token; an environment key works only in its own project and environment (get_api_key_scope tells which).

Connect Permit.io How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Permit.io.Built from the 107 Permit.io tools below, on the connection you add once.

What you can do with Permit.io

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Role, 14 operations

assign_role_to_groupAssign role to groupPOSTAssigns a role on a resource instance to a group: every member inherits it.
assign_role_to_userAssign role to userPOSTGrants a role to a user in a tenant (or on a resource instance). The user gains that role's permissions there.
create_resource_roleCreate resource rolePOSTCreates a role on a resource type, granted per resource instance, with its permissions. Changes the policy.
create_roleCreate rolePOSTCreates a tenant role with its permissions (resource:action). Changes the policy.
delete_resource_roleDelete resource roleDELETEDeletes a resource role and every permission granted through it: its holders lose that access.
delete_roleDelete roleDELETEDeletes a tenant role and every permission granted through it: its holders lose that access.
get_resource_roleGet resource roleGETReturns one role of a resource type with its permissions and the roles it extends.
get_roleGet roleGETReturns one tenant role with its permissions and the roles it extends.
list_resource_rolesList resource rolesGETLists the roles defined on a resource type (instance-level roles, such as owner of a document), with their permissions.
list_rolesList rolesGETLists the tenant roles (top-level roles such as admin or viewer) with their permissions.
remove_role_from_groupRemove role from groupDELETERemoves a role from a group: members stop inheriting it.
unassign_role_from_userUnassign role from userDELETERemoves a role from a user in a tenant (or on a resource instance). The user loses those permissions; answers 404 when not assigned.
update_resource_roleUpdate resource rolePATCHUpdates a resource role: each field you send (name, permissions, extends...) replaces its value. Changes what holders of the role may do.
update_roleUpdate rolePATCHUpdates a tenant role: each field you send (name, permissions, extends...) replaces its value. Changes what holders of the role may do.

User, 14 operations

assign_user_to_groupAssign user to groupPUTAdds a user to a group in a tenant: the user inherits the group's roles.
bulk_create_usersBulk create usersPOSTCreates many users in one call, optionally with role assignments that grant access. Personal data.
bulk_delete_usersBulk delete usersDELETEDeletes many users by key or id in one call, with all their role assignments: they lose every access.
bulk_replace_usersBulk replace usersPUTCreates or replaces many users in one call (a bulk sync by key), optionally with role assignments that grant access. Personal data.
create_userCreate userPOSTCreates a user in an environment, optionally with role assignments that grant access, so permission checks can run on them. Personal data.
create_user_in_tenantCreate user in tenantPOSTCreates a user and adds them to this tenant, optionally with role assignments that grant access (each in the tenant it names). Personal data.
delete_userDelete userDELETEDeletes a user and all their role assignments: they lose every access.
get_userGet userGETReturns one user: key, email, names, attributes, tenants and roles. Personal data.
list_tenant_usersList tenant usersGETLists the users of one tenant with their roles. Filter by email search or role. Personal data.
list_usersList usersGETLists the users synced to an environment (key, email, names, attributes, tenants and roles). Filter by search or role. Personal data.
remove_user_from_groupRemove user from groupDELETERemoves a user from a group: the user stops inheriting the group's roles.
remove_user_from_tenantRemove user from tenantDELETERemoves a user from a tenant, with every role they had in it: they lose access there.
replace_userReplace userPUTCreates or replaces (syncs) a user by key: email, names, attributes and optional role assignments, which grant access. Personal data.
update_userUpdate userPATCHUpdates a user's email, names or attributes; each field you send replaces its value. Attribute changes can change ABAC decisions.

Attribute, 10 operations

create_resource_attributeCreate resource attributePOSTCreates an attribute on a resource type (key and type such as string, number, bool, array, json or time), usable in ABAC conditions.
create_user_attributeCreate user attributePOSTCreates a user attribute (key and type), usable in ABAC conditions.
delete_resource_attributeDelete resource attributeDELETEDeletes a resource attribute; policies that use it then evaluate it as undefined, which can change decisions.
delete_user_attributeDelete user attributeDELETEDeletes a user attribute; policies that use it then evaluate it as undefined, which can change decisions.
get_resource_attributeGet resource attributeGETReturns one attribute of a resource type.
get_user_attributeGet user attributeGETReturns one user attribute.
list_resource_attributesList resource attributesGETLists the attributes defined on a resource type, used by attribute-based (ABAC) conditions.
list_user_attributesList user attributesGETLists the attributes defined on users, used by attribute-based (ABAC) conditions.
update_resource_attributeUpdate resource attributePATCHUpdates the type or description of a resource attribute.
update_user_attributeUpdate user attributePATCHUpdates the type or description of a user attribute.

Tenant, 7 operations

bulk_create_tenantsBulk create tenantsPOSTCreates many tenants in one call.
bulk_delete_tenantsBulk delete tenantsDELETEDeletes many tenants by key or id in one call, with everything in them.
create_tenantCreate tenantPOSTCreates a tenant (key, name, attributes); if it already exists, returns the existing tenant.
delete_tenantDelete tenantDELETEDeletes a tenant and everything in it (role assignments, resource instances): users lose access there.
get_tenantGet tenantGETReturns one tenant with its name, description and attributes.
list_tenantsList tenantsGETLists the tenants of an environment (isolated customer accounts or workspaces) with their attributes.
update_tenantUpdate tenantPATCHUpdates a tenant's name, description or attributes; each field you send replaces its value. Attribute changes can change ABAC decisions.

Action, 5 operations

create_resource_actionCreate resource actionPOSTCreates an action on a resource type, which roles can then be granted. Changes the policy.
delete_resource_actionDelete resource actionDELETEDeletes an action from a resource type and every permission granted to perform it: users lose that access.
get_resource_actionGet resource actionGETReturns one action of a resource type.
list_resource_actionsList resource actionsGETLists the actions defined on a resource type (such as read, write, delete).
update_resource_actionUpdate resource actionPATCHUpdates an action of a resource type: each field you send replaces its value.

Action group, 5 operations

create_resource_action_groupCreate resource action groupPOSTCreates an action group on a resource type: a named set of its actions. Changes the policy.
delete_resource_action_groupDelete resource action groupDELETEDeletes an action group from a resource type, with the permissions granted through it.
get_resource_action_groupGet resource action groupGETReturns one action group of a resource type with its actions.
list_resource_action_groupsList resource action groupsGETLists the action groups of a resource type (named sets of actions that can be granted together).
update_resource_action_groupUpdate resource action groupPATCHUpdates an action group: each field you send (name, description, actions) replaces its value.

Condition set, 5 operations

create_condition_setCreate condition setPOSTCreates a condition set: a user set or resource set defined by conditions on attributes, for ABAC rules.
delete_condition_setDelete condition setDELETEDeletes a condition set and every permission granted through it: matching users lose that access.
get_condition_setGet condition setGETReturns one condition set with its conditions.
list_condition_setsList condition setsGETLists the condition sets (ABAC user sets and resource sets defined by conditions on attributes).
update_condition_setUpdate condition setPATCHUpdates a condition set: each field you send (name, conditions...) replaces its value. Changes who matches it, and so who has access.

Resource, 5 operations

create_resourceCreate resourcePOSTCreates a resource type with its actions (and optionally roles, relations and attributes). Policy change: permissions can then be granted on it.
delete_resourceDelete resourceDELETEDeletes a resource type and everything defined on it (actions, roles, permissions, instances). Removes access granted on it.
get_resourceGet resourceGETReturns one resource type with its actions, attributes, roles and relations.
list_resourcesList resourcesGETLists the resource types of the policy (the kinds of objects you protect, such as document or repo) with their actions, roles, relations and attributes.
update_resourceUpdate resourcePATCHUpdates a resource type: each field you send replaces its current value (actions, roles and relations included). Changes the policy.

Resource instance, 5 operations

create_resource_instanceCreate resource instancePOSTCreates a resource instance (resource type, key, tenant, attributes), on which roles and relationships can be set; returns the existing one if present.
delete_resource_instanceDelete resource instanceDELETEDeletes a resource instance with its roles and relationships: access granted on it is lost.
get_resource_instanceGet resource instanceGETReturns one resource instance with its resource type, tenant and attributes.
list_resource_instancesList resource instancesGETLists resource instances (individual protected objects, such as one document) with their tenant and attributes. Filter by tenant, resource or search.
update_resource_instanceUpdate resource instancePATCHUpdates the attributes of a resource instance (they can change ABAC decisions).

Bulk, 4 operations

bulk_assign_rolesBulk assign rolesPOSTAssigns many roles in one call: each item names a user, role and tenant (or resource instance), and that user gains the permissions. missing_user_policy decides what a missing user does.
bulk_create_relationship_tuplesBulk create relationship tuplesPOSTCreates up to 1000 relationship tuples in one call. Can derive roles (ReBAC) and so grant access.
bulk_delete_relationship_tuplesBulk delete relationship tuplesDELETEDeletes up to 1000 relationship tuples in one call; roles derived through them are lost.
bulk_unassign_rolesBulk unassign rolesDELETEUnassigns many roles in one call: each item names a user, role and tenant (or resource instance). Those users lose those permissions.

Permission, 4 operations

assign_permissions_to_resource_roleAssign permissions to resource rolePOSTGrants permissions (actions of the resource) to a resource role; already granted ones are skipped. Every holder of the role gains them.
assign_permissions_to_roleAssign permissions to rolePOSTGrants permissions (resource:action) to a tenant role; already granted ones are skipped. Every holder of the role gains them.
remove_permissions_from_resource_roleRemove permissions from resource roleDELETERemoves permissions from a resource role; ones not granted are skipped. Every holder of the role loses them.
remove_permissions_from_roleRemove permissions from roleDELETERemoves permissions (resource:action) from a tenant role; ones not granted are skipped. Every holder of the role loses them.

Relation, 4 operations

create_resource_relationCreate resource relationPOSTCreates a relation from this resource type to a subject resource type (such as parent), used for ReBAC role derivation.
delete_resource_relationDelete resource relationDELETEDeletes a relation of a resource type, with the role derivations that use it.
get_resource_relationGet resource relationGETReturns one relation of a resource type.
list_resource_relationsList resource relationsGETLists the relations defined from a resource type to others (such as a folder parent of a document), used by relationship-based (ReBAC) policies.

Relationship tuple, 3 operations

create_relationship_tupleCreate relationship tuplePOSTCreates a relationship tuple between two resource instances (subject, relation, object), which can derive roles (ReBAC) and so grant access.
delete_relationship_tupleDelete relationship tupleDELETEDeletes a relationship tuple between two resource instances; roles derived through it are lost.
list_relationship_tuplesList relationship tuplesGETLists relationship tuples (subject, relation, object, such as folder:a parent of document:b). Filter by tenant, subject, relation, object or types.

Role assignment, 3 operations

assign_roleAssign rolePOSTAssigns a role to a user in a tenant, or on a resource instance. The user gains that role's permissions there.
list_role_assignmentsList role assignmentsGETLists role assignments (user, role, tenant, resource instance). Filter by user, role, tenant, resource or resource instance.
unassign_roleUnassign roleDELETEUnassigns a role from a user in a tenant (or on a resource instance). The user loses those permissions; answers 404 when not assigned.

Set rule, 3 operations

assign_condition_set_ruleAssign condition set rulePOSTGrants a permission to a user set on a resource set (an ABAC rule); skipped if already granted. Users matching the set gain that access.
list_condition_set_rulesList condition set rulesGETLists condition set rules: which user set holds which permission on which resource set. Filter by user_set, permission or resource_set.
remove_condition_set_ruleRemove condition set ruleDELETERevokes a permission from a user set on a resource set; skipped if not granted. Users matching the set lose that access.

Assign group, 2 operations

assign_group_to_groupAssign group to groupPUTMakes a group a member of another group: its members inherit that group's roles.
remove_group_from_groupRemove group from groupDELETERemoves a group from another group: its members stop inheriting that group's roles.

Audit log, 2 operations

get_audit_logGet audit logGETReturns one permission-check decision from the audit log: user, action, resource, tenant, decision and reason. Personal data.
list_audit_logsList audit logsGETLists permission-check decisions from the audit log: user, action, resource, tenant, allowed or denied and why. Filter by user, decision, resource, tenant, action or time. Personal data.

Direct, 2 operations

get_groupGet groupGETReturns one group by its instance key.
list_groupsList groupsGETLists groups with their tenant and resource type. Filter by tenant, resource type or search.

Env, 2 operations

get_environmentGet environmentGETReturns one environment of a project: key, id, name, description and settings.
list_environmentsList environmentsGETLists the environments of a project (such as development and production), each with its own policy and data; their id or key is the env_id of every other tool.

Group, 2 operations

create_groupCreate groupPOSTCreates a group (a resource instance of a group type in a tenant) whose members inherit the roles assigned to it.
delete_groupDelete groupDELETEDeletes a group: its members lose the roles they inherited through it.

Implicit grant, 2 operations

create_implicit_grantCreate implicit grantPOSTCreates an implicit grant (role derivation): holders of a role on a related resource also get this role, through a relation. Changes who gets access.
delete_implicit_grantDelete implicit grantDELETEDeletes an implicit grant (role derivation) from a resource role: derived access stops.

Project, 2 operations

get_projectGet projectGETReturns one project: key, id, name, description and settings.
list_projectsList projectsGETLists the projects of the organization the API key belongs to, with their id and key (either works as proj_id).

Condition, 1 operation

update_implicit_grants_conditionsUpdate implicit grants conditionsPUTSets the conditions under which the implicit grants of a resource role apply (for example only when no direct role exists on the object). Changes who gets derived access.

Scope, 1 operation

get_api_key_scopeGet api key scopeGETReturns the organization, project and environment the API key belongs to. Use project_id and environment_id as proj_id and env_id when the key is an environment key.

Use Permit.io from Claude Code, Cursor or Codex

Connect Permit.io in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Permit.io operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Permit.io

Create your workspace
Sign up free. Nothing to install.
Connect Permit.io once
Add your Permit.io connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.