In ArcGIS Location Platform, privileges are a set of strings used to manage access to secure resources
- ArcGIS accounts
An ArcGIS account is an identity with a user type and set of privileges that can access specific ArcGIS products, tools, APIs, services, and resources. The main account types that can be used for development are an ArcGIS Location Platform account, ArcGIS Online account, and ArcGIS Enterprise account. ArcGIS Location Platform and ArcGIS Online accounts are also associated with a subscription. used by ArcGIS users. - Access tokens
An access token is an authorization string that provides access to secure ArcGIS content, data, and services. Its capabilities are determined by the privileges it supports. It is obtained by implementing API key authentication, User authentication, or App authentication. used by applications.
Privileges for accounts
All ArcGIS accounts
Privileges for access tokens
All access tokens
Privileges for access tokens are based on the privileges of the token's associated ArcGIS account. They are assigned using two workflows:
-
The developer selects specific privileges to grant to an access token.
-
The access token inherits all account privileges of the ArcGIS account it is associated with.
Access tokens with selected privileges
Access tokens with selected privileges can be created using API key authentication
Selecting the privileges of an access token allows the developer to assign a minimal set of privileges to each token, reducing the potential harm in the event a token is compromised. Privileges are managed on a per-credential basis, meaning that all access tokens generated using the same developer credential will have the same privileges.
When using the developer credentials tool, select either of the following options to generate access tokens with selected privileges:
Access tokens that impersonate accounts
Access tokens can impersonate you and provide the full privileges of your ArcGIS account. An access token that impersonates an ArcGIS account has every privilege of the account it is associated with, as well as its access to content, groups, members, and organization settings.
Access tokens that impersonate accounts can be generated in the following ways:
-
User authentication
User authentication is a type of authentication that allows users with an ArcGIS account to sign into an application and allow it to access ArcGIS content, services, and resources on their behalf. The typical authorization protocol used is OAuth2.0. generates access tokens that impersonate the full capabilities of the signed-in ArcGIS account. -
API key authentication
API key authentication is a type of authentication that uses an API key to authenticate requests to ArcGIS services and secure portal items. or app authenticationApp authentication is a type of authentication that grants a short-lived access token based on an OAuth 2.0 client ID and client secret, authorizing an application to access ArcGIS services and items. can generate access tokens that impersonate the developer's account by choosing the Private application with all owner privileges setting in the developer credentials tool.
When using the developer credentials tool, select the following option to generate access tokens with all of your privileges:
List of privileges for access tokens
The privilege selection menu in the developer credentials tool.
The following table lists all privileges that can be assigned to access tokens
All selectable privileges for an ArcGIS Location Platform access token are shown. The actual privileges available in the developer credentials tool vary based on if your account has pay-as-you-go enabled.
Location services
These privileges grant access to ArcGIS Location Services
| Category | Label | Privilege string | Description |
|---|---|---|---|
| Basemaps | Basemap styles service | premium | Allow application to access the basemap styles service. Learn more |
| Basemaps | Static basemap tiles | premium | Allow application to access the static basemap tiles service. Learn more |
| Static maps | Static maps service (beta) | premium | Allow application to access the static maps service. Learn more |
| Places | Place finding | premium | Allow application to access the places service. Learn more |
| Geocoding | Geocode (stored) | premium | Allow application to access the geocoding service and perform stored geocodes. Learn more |
| Geocoding | Geocode (not stored) | premium | Allow application to access the geocoding service and perform geocodes that are not stored. Learn more |
| Routing | Routing | premium | Allow application to access the routing service and perform standard routing operations. Learn more |
| Routing | Closest facility | premium | Allow application to access the routing service and perform closest facility routing operations. Learn more |
| Routing | Location allocation | premium | Allow application to access the routing service and perform location allocation operations. Learn more |
| Routing | Optimized routing | premium | Allow application to access the routing service and perform optimized routing operations. Learn more |
| Routing | Origin/destination cost matrix | premium | Allow application to access the routing service and generate travel cost matrices. Learn more |
| Routing | Service area | premium | Allow application to access the routing service and generate service areas. Learn more |
| Routing | Multi-vehicle routing | premium | Allow application to access the routing service and perform fleet routing operations. Learn more |
| Routing | Last mile | premium | Allow application to access the routing service and perform routing operations for last mile delivery. Learn more |
| Routing | Snap to roads | premium | Allow member to perform network analysis tasks such as snap GPS track points to roads. Learn more |
| Data enrichment | GeoEnrichment service | premium | Allow application to access the GeoEnrichment service. Learn more |
| Elevation | Elevation service | premium | Allow application to access the elevation service. Learn more |
Spatial analysis services
| Category | Label | Privilege string | Description |
|---|---|---|---|
| Feature analysis | Spatial analysis service | premium | N/A - Privilege should not be used. |
Portal service
These privileges grant access to operations in the portal
General privileges
| Category | Label | Privilege string | Description |
|---|---|---|---|
| AI assistants | Use AI assistants | portal | Allow member to use generative AI and ArcGIS assistants. |
| Members | View | portal | Allow application to view members of the organization. |
| Members | Take ArcGIS Pro license offline | portal | Allow member to take their ArcGIS Pro license offline. Requires "ArcGIS Pro offline settings" to allow taking ArcGIS Pro license offline. |
| Groups | Join organizational groups | portal | Allow application to join groups within your organization. |
| Groups | Join external groups | portal | Allow application to join groups external to your organization. |
| Groups | View groups shared with organization | portal | Allow application to view groups shared with the organization. |
| Content | Create, update, and delete | portal | Allow application to create, edit, and delete their own content. |
| Content | Publish hosted feature layers | portal | Allow application to publish hosted feature layers from shapefiles, CSVs, etc. |
| Content | Publish hosted tile layers | portal | Allow application to publish hosted tile layers from tile packages, features, etc. |
| Content | Publish hosted scene layers | portal | Allow application to publish hosted scene layers. |
| Content | Published hosted tiled imagery layers | portal | Allow application to publish hosted tiled imagery layers from a single image or collection of images. Requires an ArcGIS Image for ArcGIS Online user type extension. |
| Content | View content shared with organization | portal | Allow application to view content shared to the organization. |
| Content | View location tracks | portal | Allow application to view members' location tracks via shared track views when location sharing is enabled. |
| Content | Reassign content | portal | Allow application to reassign ownership of content owned by the account to another member. |
| Content | Receive content | portal | Allow application to receive content assigned to them by another member. |
| Content | Create and run data pipelines | portal | Allow application to create, edit, and run data pipelines. |
| Content | View hosted feature services | portal | Allow application to view hosted feature services. |
| Content | View hosted tile services | portal | Allow application to view hosted tile services. |
| Content | Categorize items | portal | Allow application to set the category of items you own. |
| Sharing | Share with groups | portal | Allow application to share content to groups. |
| Sharing | Share with organization | portal | Allow application to share content to your organization. |
| Sharing | Share with public | portal | Allow application to share their content publicly if permitted by the organization's public sharing policy. |
| Sharing | Make groups visible to organization | portal | Allow application to make groups discoverable by your organization. |
| Sharing | Make groups visible to public | portal | Allow application to make groups discoverable by the public. |
| Sharing | Make groups available to Open Data | opendata | Allow application to designate groups as being available for use in Open Data sites. |
| Features | Edit | features | Allow application to edit features in editable layers that are not public, based on the edit options enabled on the layer. |
| Features | Edit with full control | features | Allow application to add, delete, and update features in an editable, hosted feature layer, regardless of the editing options enabled on the layer. |
| Apps and capabilities | Allow beta access | portal | Allow members to access Esri beta apps and capabilities. |
Administrative privileges
| Category | Label | Privilege string | Description |
|---|---|---|---|
| Groups | View all | portal | Allow application to view all groups within your organization. |
| Groups | Update | portal | Allow application to update groups within your organization. |
| Groups | Delete | portal | Allow application to delete groups within your organization. |
| Groups | Reassign ownership | portal | Allow application to reassign groups to other members within your organization. |
| Groups | Assign members | portal | Allow application to assign your members to, update your member's group role, and remove your members from groups within your organization. |
| Groups | Create with update capabilities | portal | Allow application to create groups with update capabilities. |
| Groups | Create with leaving disallowed | portal | Allow application to create and own groups that do not allow members to leave (administrative groups). |
| Content | View all | portal | Allow application to view all content within your organization. |
| Content | Update items | portal | Allow application to update and categorize content and edit hosted feature layers in your organization. |
| Content | Delete items | portal | Allow application to delete content within your organization. |
| Content | Reassign item ownership | portal | Allow application to reassign content to other members within your organization. |
| Content | Categorize items | portal | Allow application to set the categories of organization content. |
| Content | Manage categories | portal | Allow application to configure organization content categories. |
| Content | Publish web tools | portal | Allow application to publish web tools. |
| Content | Share member content with organization | portal | Allow application to share content owned by other members in your organization with the organization. |
| Content | Create and manage administrative reports | portal | Allow application to create and manage administrative reports for your organization |
| Organization settings | Security and infrastructure | portal | Allow application to manage the organization's security and infrastructure settings. |
| Organization settings | Organization website | portal | Allow application to manage the organization's website settings. |
| Organization settings | Collaborations | portal | Allow application to manage the organization's collaborations. |
| Organization settings | Credits | portal | Allow application to manage the organization's credit budgeting settings. |
| Organization settings | Utility services | portal | Allow application to manage the organization's utility service settings |
More resources
Learn more about privileges and the services they grant access to in the developer guides:
Tutorials
Learn how to create access tokens with privileges in these tutorials:
Create an API key
Create and configure API key credentials to get a long-lived API key access token.