Privileges | Documentation

In ArcGIS Online, privileges are a set of strings used to manage access to secure resources in ArcGIS. They are assigned to two types of entities:

ArcGIS accounts used by ArcGIS users.
Access tokens used by applications.

Privileges for accounts

All ArcGIS accounts have a list of privileges associated with them that determine the services, content, and operations the user is authorized to access.

Privileges for ArcGIS Online accounts are managed through roles assigned to members by an organization administrator. To learn more, go to User types, roles, and privileges in the ArcGIS Online documentation.

Privileges for access tokens

Access tokens have privileges associated with them that determine the services, content, and operations they are authorized to access. These access tokens are used by applications to access ArcGIS resources and perform operations using ArcGIS services.

The type of authentication used to obtain an access token determines how its privileges are managed. Generally, token privileges are managed through developer credentials, which allow for the setting of specific privileges as well as item access. In user authentication, access token privileges are not assigned manually, and are rather inherited from the privileges of the signed-in ArcGIS account.

Access tokens with specific privileges are supported in ArcGIS Location Platform, ArcGIS Online, and ArcGIS Enterprise. They are created using Developer credentials configured for API key authentication or App authentication.

Type of authentication	Type of developer credential	Privilege management
API key authentication	API key credentials	Privileges are assigned using developer credentials.
App authentication	OAuth 2.0 credentials (For app authentication)	Privileges are assigned using developer credentials.
User authentication	OAuth 2.0 credentials (For user authentication)	Privileges are inherited from the signed-in ArcGIS account.

The exact list of privileges associated with a token can be obtained using a /self request.

List of privileges

The following table lists all privileges available for ArcGIS Online by category. The actual privileges available to an ArcGIS Online account vary based on the account's user type and roles.

Category	Label	Privilege string	Description
Basemaps	Basemap styles service	`premium:user:basemaps`	Allow application to access the basemap styles service. Learn more
Geocoding	Geocode service	`premium:user:geocode`	Allow application to access the geocoding service. Learn more
Routing	Routing (Network analysis)	`premium:user:networkanalysis`	Allow application to access the routing service. Learn more
Data enrichment	GeoEnrichment service	`premium:user:geoenrichment`	Allow application to access the GeoEnrichment service. Learn more

Category	Label	Privilege string	Description
Feature analysis	Spatial analysis service	`premium:user:spatialanalysis`	Allow application to access the spatial analysis service. Learn more
Image analysis	Image analysis service	`premium:publisher:rasteranalysis`	Allow application to access image services to perform analysis. Learn more

Category	Label	Privilege string	Description
AI assistants	Use AI assistants	`portal:user:useAIAssistants`	Allow member to use generative AI and ArcGIS assistants.
Members	View	`portal:user:viewOrgUsers`	Allow application to view members of the organization.
Members	Take ArcGIS Pro license offline	`portal:user:arcgispro:takeLicenseOffline`	Allow member to take their ArcGIS Pro license offline.
Groups	Create, update, and delete	`portal:user:createGroup`	Allow application to create, edit, and delete their own groups.
Groups	Join organizational groups	`portal:user:joinGroup`	Allow application to join groups within your organization.
Groups	Join external groups	`portal:user:joinNonOrgGroup`	Allow application to join groups external to your organization.
Groups	View groups shared with organization	`portal:user:viewOrgGroups`	Allow application to view groups shared with the organization.
Groups	Invite partnered organization members	`portal:user:invitePartneredCollaborationMembers`	Allow application to invite members from partnered collaboration organizations to groups.
Groups	Add members from other organizations	`portal:user:addExternalMembersToGroup`	Allow application to create groups that allow members from other organizations, as well as invite external members to groups.
Content	Create, update, and delete	`portal:user:createItem`	Allow application to create, edit, and delete their own content.
Content	Publish hosted feature layers	`portal:publisher:publishFeatures`	Allow application to publish hosted feature layers from shapefiles, CSVs, etc.
Content	Publish hosted tile layers	`portal:publisher:publishTiles`	Allow application to publish hosted tile layers from tile packages, features, etc.
Content	Publish hosted scene layers	`portal:publisher:publishScenes`	Allow application to publish hosted scene layers.
Content	Published hosted tiled imagery layers	`portal:publisher:publishTiledImagery`	Allow application to publish hosted tiled imagery layers from a single image or collection of images. Requires an ArcGIS Image for ArcGIS Online user type extension.
Content	Publish hosted dynamic imagery layers	`portal:publisher:publishDynamicImagery`	Allow application to publish hosted dynamic imagery layers from a single image or collection of images.
Content	View content shared with organization	`portal:user:viewOrgItems`	Allow application to view content shared to the organization.
Content	View location tracks	`portal:user:viewTracks`	Allow application to view members' location tracks via shared track views when location sharing is enabled.
Content	Reassign content	`portal:user:reassignItems`	Allow application to reassign ownership of content owned by the account to another member.
Content	Receive content	`portal:user:receiveItems`	Allow application to receive content assigned to them by another member.
Content	Create and run data pipelines	`portal:publisher:createDataPipelines`	Allow application to create, edit, and run data pipelines.
Content	Publish real-time analytics	`portal:publisher:publishRealTimeAnalytics`	Allow application to publish real-time analytics to analyze and process real-time data using ArcGIS Velocity.
Content	Categorize items	`portal:user:categorizeItems`	Allow application to set the category of items you own.
Content	Publish big data analytics	`portal:publisher:publishBigDataAnalytics`	Allow application to publish big data analytics and process historical observation data using ArcGIS Velocity.
Content	Publish feeds	`portal:publisher:publishFeeds`	Allow application to publish feeds.
Content	Generate API keys	`portal:user:generateApiTokens`	Allow application to generate API keys.
Content	Assign privileges to OAuth 2.0 applications	`portal:user:assignPrivilegesToApps`	Allow application to assign privileges to OAuth 2.0 applications.
Sharing	Share with groups	`portal:user:shareToGroup`	Allow application to share content to groups.
Sharing	Share with organization	`portal:user:shareToOrg`	Allow application to share content to your organization.
Sharing	Share with public	`portal:user:shareToPublic`	Allow application to share their content publicly if permitted by the organization's public sharing policy.
Sharing	Make groups visible to organization	`portal:user:shareGroupToOrg`	Allow application to make groups discoverable by your organization.
Sharing	Make groups visible to public	`portal:user:shareGroupToPublic`	Allow application to make groups discoverable by the public.
Sharing	Make groups available to Open Data	`opendata:user:designateGroup`	Allow application to designate groups as being available for use in Open Data sites.
Features	Edit	`features:user:edit`	Allow application to edit features in editable layers that are not public, based on the edit options enabled on the layer.
Features	Edit with full control	`features:user:fullEdit`	Allow application to add, delete, and update features in an editable, hosted feature layer, regardless of the editing options enabled on the layer.
Premium content	Create notebooks	`premium:publisher:createNotebooks`	Allow application to create and edit interactive notebooks.
Premium content	Schedule notebooks	`premium:publisher:scheduleNotebooks`	Allow application to schedule future automated runs of a notebook.
Premium content	Create advanced notebooks	`premium:publisher:createAdvancedNotebooks`	Allow application to import and use ArcPy modules in ArcGIS Notebooks.
Premium content	Demographic maps	`premium:user:demographics`	Allow application to access demographic maps in ArcGIS Living Atlas.
Premium content	Feature report	`premium:user:featurereport`	Allow application to create feature reports in ArcGIS Survey123.
Premium content	Run web tools	`portal:user:runWebTool`	Allow application to run web tools.

Category	Label	Privilege string	Description
Members	View all	`portal:admin:viewUsers`	Allow application to view full member account information within your organization.
Members	Update	`portal:admin:updateUsers`	Allow application to reset passwords, update member account information, and update member categories within your organization.
Members	Delete	`portal:admin:deleteUsers`	Allow application to delete member accounts within your organization.
Members	Add	`portal:admin:inviteUsers`	Allow application to invite members to your organization.
Members	Disable	`portal:admin:disableUsers`	Allow application to enable and disable member accounts within your organization.
Members	Change roles	`portal:admin:changeUserRoles`	Allow application to change the role a member account is assigned. Note, only members with the Administrator role can assign or unassign the Administrator role to other accounts.
Members	Manage licenses	`portal:admin:manageLicenses`	Allow application to assign licenses to members of your organization.
Members	Manage categories	`portal:admin:updateMemberCategorySchema`	Allow application to configure organization member categories.
Groups	View all	`portal:admin:viewGroups`	Allow application to view all groups within your organization.
Groups	Update	`portal:admin:updateGroups`	Allow application to update groups within your organization.
Groups	Delete	`portal:admin:deleteGroups`	Allow application to delete groups within your organization.
Groups	Reassign ownership	`portal:admin:reassignGroups`	Allow application to reassign groups to other members within your organization.
Groups	Assign members	`portal:admin:assignToGroups`	Allow application to assign your members to, update your member's group role, and remove your members from groups within your organization.
Groups	Link to organization-specific group	`portal:admin:manageEnterpriseGroups`	Allow application to link group membership to an organization-specific group.
Groups	Create with update capabilities	`portal:admin:createUpdateCapableGroup`	Allow application to create groups with update capabilities.
Groups	Create with leaving disallowed	`portal:admin:createLeavingDisallowedGroup`	Allow application to create and own groups that do not allow members to leave (administrative groups).
Content	View all	`portal:admin:viewItems`	Allow application to view all content within your organization.
Content	Update items	`portal:admin:updateItems`	Allow application to update and categorize content and edit hosted feature layers in your organization.
Content	Delete items	`portal:admin:deleteItems`	Allow application to delete content within your organization.
Content	Reassign item ownership	`portal:admin:reassignItems`	Allow application to reassign content to other members within your organization.
Content	Categorize items	`portal:admin:categorizeItems`	Allow application to set the categories of organization content.
Content	Manage categories	`portal:admin:updateItemCategorySchema`	Allow application to configure organization content categories.
Content	Publish web tools	`portal:publisher:publishServerGPServices`	Allow application to publish web tools.
Content	Share member content with organization	`portal:admin:shareToOrg`	Allow application to share content owned by other members in your organization with the organization.
Content	Share member content with public	`portal:admin:shareToPublic`	Allow application to share content owned by other members in your organization with the public.
Content	Create and manage administrative reports	`portal:admin:createReports`	Allow application to create and manage administrative reports for your organization
Organization settings	Security and infrastructure	`portal:admin:manageSecurity`	Allow application to manage the organization's security and infrastructure settings.
Organization settings	Organization website	`portal:admin:manageWebsite`	Allow application to manage the organization's website settings.
Organization settings	Collaborations	`portal:admin:manageCollaborations`	Allow application to manage the organization's collaborations.
Organization settings	Credits	`portal:admin:manageCredits`	Allow application to manage the organization's credit budgeting settings.
Organization settings	Member roles	`portal:admin:manageRoles`	Allow application to manage the organization's member roles.
Organization settings	Utility services	`portal:admin:manageUtilityServices`	Allow application to manage the organization's utility service settings

Tutorials

Create an API key

Create and configure API key credentials to get a long-lived API key access token.

ArcGIS portal REST JS

Create OAuth credentials for user authentication

Create and configure OAuth credentials to set up user authentication.

ArcGIS portal

Create OAuth credentials for app authentication

Create and configure OAuth credentials to set up app authentication.

ArcGIS portal