From f7527466b8a613bb3947dd5e01679221410c35e7 Mon Sep 17 00:00:00 2001 From: rohan Date: Tue, 15 Sep 2026 14:22:53 +0530 Subject: [PATCH 1/3] docs: document role grant limits and update managed role permissions --- src/pages/access-control/roles.mdx | 28 +++++++++++++++++-- src/pages/access-control/service-accounts.mdx | 4 +++ src/pages/access-control/teams.mdx | 2 ++ src/pages/console/organisation.mdx | 2 ++ src/pages/console/users.mdx | 2 ++ src/pages/public-api/errors.mdx | 2 ++ src/pages/public-api/invites.mdx | 1 + src/pages/public-api/members.mdx | 1 + src/pages/public-api/roles.mdx | 4 +++ src/pages/public-api/service-accounts.mdx | 4 +-- 10 files changed, 45 insertions(+), 5 deletions(-) diff --git a/src/pages/access-control/roles.mdx b/src/pages/access-control/roles.mdx index ffb44750..8897f8b3 100644 --- a/src/pages/access-control/roles.mdx +++ b/src/pages/access-control/roles.mdx @@ -21,6 +21,10 @@ To assign a role to a user or change a user's role: ![3-click-current-role](/assets/images/console/access-control/roles/switch-user-role/3-switch-user-role.png) 4. Once selected, you will see a toast notification confirming that the role has been updated. + + You can only assign a role whose permissions your own role also has. The dropdown disables roles with permissions that your role does not have. This limit does not apply to users with the `Owner` or `Admin` role. + + ## Managed Roles Phase provides managed roles out of the box to every organization. @@ -44,9 +48,11 @@ The organization owner. This role is automatically assigned when a user creates | **Roles** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integration Credentials** | Full access | ✅ | ✅ | ✅ | ✅ | | **Network Access Policies** | Full access | ✅ | ✅ | ✅ | ✅ | +| **Logs** | Read access | ✅ | ❌ | ❌ | ❌ | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | | **SCIM** | Full access | ✅ | ✅ | ✅ | ✅ | | **SSO** | Full access | ✅ | ✅ | ✅ | ✅ | +| **Log Streams** | Full access | ✅ | ✅ | ✅ | ✅ | #### App-level permissions: @@ -84,9 +90,11 @@ Admin users have access to most resources and permissions, and have global acces | **Roles** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integration Credentials** | Full access | ✅ | ✅ | ✅ | ✅ | | **Network Access Policies** | Full access | ✅ | ✅ | ✅ | ✅ | +| **Logs** | Read access | ✅ | ❌ | ❌ | ❌ | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | | **SCIM** | Full access | ✅ | ✅ | ✅ | ✅ | | **SSO** | Full access | ✅ | ✅ | ✅ | ✅ | +| **Log Streams** | Full access | ✅ | ✅ | ✅ | ✅ | #### App-level permissions: @@ -126,15 +134,17 @@ Management users with broad access to environments, secrets, and service account | **Roles** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integration Credentials** | Full access | ✅ | ✅ | ✅ | ✅ | | **Network Access Policies** | Full access | ✅ | ✅ | ✅ | ✅ | +| **Logs** | Read access | ✅ | ❌ | ❌ | ❌ | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | | **SCIM** | No access | ❌ | ❌ | ❌ | ❌ | | **SSO** | No access | ❌ | ❌ | ❌ | ❌ | +| **Log Streams** | No access | ❌ | ❌ | ❌ | ❌ | #### App-level permissions: | Resource | Access | Read | Create | Update | Delete | |----------|--------|------|--------|--------|--------| -| **Environments** | Custom access | ✅ | ✅ | ✅ | ❌ | +| **Environments** | Full access | ✅ | ✅ | ✅ | ✅ | | **Secrets** | Full access | ✅ | ✅ | ✅ | ✅ | | **DynamicSecretLeases** | Full access | ✅ | ✅ | ✅ | ✅ | | **RotatingSecrets** | Full access | ✅ | ✅ | ✅ | ✅ | @@ -166,9 +176,11 @@ Default role for Service Accounts, providing programmatic access to secrets with | **Roles** | Read access | ✅ | ❌ | ❌ | ❌ | | **Integration Credentials** | Read access | ✅ | ❌ | ❌ | ❌ | | **Network Access Policies** | Read access | ✅ | ❌ | ❌ | ❌ | +| **Logs** | No access | ❌ | ❌ | ❌ | ❌ | | **Teams** | No access | ❌ | ❌ | ❌ | ❌ | | **SCIM** | No access | ❌ | ❌ | ❌ | ❌ | | **SSO** | No access | ❌ | ❌ | ❌ | ❌ | +| **Log Streams** | No access | ❌ | ❌ | ❌ | ❌ | #### App-level permissions: @@ -176,7 +188,7 @@ Default role for Service Accounts, providing programmatic access to secrets with |----------|--------|------|--------|--------|--------| | **Environments** | Full access | ✅ | ✅ | ✅ | ✅ | | **Secrets** | Full access | ✅ | ✅ | ✅ | ✅ | -| **DynamicSecretLeases** | Full access | ✅ | ✅ | ❌ | ❌ | +| **DynamicSecretLeases** | Custom access | ✅ | ✅ | ❌ | ❌ | | **RotatingSecrets** | Read access | ✅ | ❌ | ❌ | ❌ | | **Lockbox** | No access | ❌ | ❌ | ❌ | ❌ | | **Logs** | No access | ❌ | ❌ | ❌ | ❌ | @@ -206,9 +218,11 @@ Developers have limited permissions at the organization level and must be given | **Roles** | Read access | ✅ | ❌ | ❌ | ❌ | | **Integration Credentials** | Custom access | ✅ | ✅ | ✅ | ❌ | | **Network Access Policies** | Read access | ✅ | ❌ | ❌ | ❌ | +| **Logs** | Read access | ✅ | ❌ | ❌ | ❌ | | **Teams** | Read access | ✅ | ❌ | ❌ | ❌ | | **SCIM** | No access | ❌ | ❌ | ❌ | ❌ | | **SSO** | No access | ❌ | ❌ | ❌ | ❌ | +| **Log Streams** | No access | ❌ | ❌ | ❌ | ❌ | #### App-level permissions: @@ -216,7 +230,7 @@ Developers have limited permissions at the organization level and must be given |----------|--------|------|--------|--------|--------| | **Environments** | Custom access | ✅ | ✅ | ✅ | ❌ | | **Secrets** | Full access | ✅ | ✅ | ✅ | ✅ | -| **DynamicSecretLeases** | Full access | ✅ | ✅ | ❌ | ❌ | +| **DynamicSecretLeases** | Custom access | ✅ | ✅ | ❌ | ❌ | | **RotatingSecrets** | Read access | ✅ | ❌ | ❌ | ❌ | | **Lockbox** | Full access | ✅ | ✅ | ✅ | ✅ | | **Logs** | Read access | ✅ | ❌ | ❌ | ❌ | @@ -241,6 +255,10 @@ In addition to the managed roles, Phase allows you to create custom roles tailor Please make sure to follow the [Principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) when setting the access policy for roles. Casting a wider scope may inadvertently lead to [Privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation). + + You can only grant permissions that your own role has. Phase disables the toggles for permissions that your role does not have. This limit does not apply to users with the `Owner` or `Admin` role. + + 1. Navigate to the Access Control page from the sidebar and click on the Roles tab. ![1-navigate-to-access-control](/assets/images/console/access-control/roles/create-custom-roles/1-navigate-to-access-control.png) ![2-navigate-to-access-control-roles](/assets/images/console/access-control/roles/create-custom-roles/2-navigate-to-access-control-roles.png) @@ -308,3 +326,7 @@ Some actions require a combination of permissions across multiple resources. Bel 3. Modify the role as needed. 4. Save your changes. ![4-save-modified-role](/assets/images/console/access-control/roles/edit-custom-roles/4-save-modified-role.png) + + + You can only add permissions that your own role has. If the role already has permissions that your role does not have, you can keep them or remove them, but you cannot add them back. This limit does not apply to users with the `Owner` or `Admin` role. + diff --git a/src/pages/access-control/service-accounts.mdx b/src/pages/access-control/service-accounts.mdx index 4f415b99..ee4dc994 100644 --- a/src/pages/access-control/service-accounts.mdx +++ b/src/pages/access-control/service-accounts.mdx @@ -46,6 +46,8 @@ By default, when you create a new Service Account it uses the [Service](/access- You may choose to select a different Managed role or a Custom role by clicking one from the dropdown. +You can only select a role whose permissions your own role also has. The dropdown disables the other roles. This limit does not apply to users with the Owner or Admin role. + ![Create new service account](/assets/images/console/access-control/service-accounts/create-new-service-accounts/4-create-new-service-account.png) Click "Create service account". This will create a new account with the chosen name and role. @@ -73,6 +75,8 @@ To update the name of an account, simply click the account name at the top of th To update an account's role, click the role label to open the dropdown and select a role from the list. The selected role will be applied on selection. +You can only select a role whose permissions your own role also has. This limit does not apply to users with the Owner or Admin role. + ![Update service account role](/assets/images/console/access-control/service-accounts/manage-account/service-account-update-role.png) ### Delete account diff --git a/src/pages/access-control/teams.mdx b/src/pages/access-control/teams.mdx index 1c004717..dce7c5b9 100644 --- a/src/pages/access-control/teams.mdx +++ b/src/pages/access-control/teams.mdx @@ -172,6 +172,8 @@ Service accounts can be **owned by a team**, meaning their lifecycle and visibil 4. Click **Create**. The service account is automatically added as a member of the team and can access all apps and environments that the team has access to. +The role of the account can only have permissions that your own role has. If the team has a **Member role** override, Phase adds the permissions of that override to your own permissions for this check. This limit does not apply to users with the Owner or Admin role. + Team-owned service accounts always use **Server-side KMS**, which is enabled automatically on creation. This allows any team member with the appropriate `ServiceAccountTokens` permissions to generate tokens for the account — without needing to be a designated Service Account Handler. This is essential for dynamic team membership, including [SCIM-managed teams](#scim-managed-teams), where members may join or leave at any time. Team-owned service accounts are visually distinguished with a team badge on both the team detail page and the organisation-level service accounts list. diff --git a/src/pages/console/organisation.mdx b/src/pages/console/organisation.mdx index fa3f77f9..81f14b07 100644 --- a/src/pages/console/organisation.mdx +++ b/src/pages/console/organisation.mdx @@ -36,6 +36,8 @@ You can also invite new members to your Organisation. To invite a new member, cl You are limited to selecting a non Global Access role when inviting a new member. This is because the user has not created an account and associated cryptographic keys. For more information on Global Access roles, see [Roles](/access-control#global-access). +When you invite a member or change a member's role, you can only select a role whose permissions your own role also has. This limit does not apply to users with the Owner or Admin role. + ## Settings This page shows your account and recovery info related to this Organisation. You can view your current role, preferences and download your account recovery kit from this screen. This page will also show you the current billing status of your Organisation. diff --git a/src/pages/console/users.mdx b/src/pages/console/users.mdx index 9416084c..679f227a 100644 --- a/src/pages/console/users.mdx +++ b/src/pages/console/users.mdx @@ -94,4 +94,6 @@ You can permanently remove a member from an Organisation from the [Organisation Users in Phase must be given a role. By default, users are given the managed "Developer" role when they join an Organisation. This role can be changed once they join. +When you invite a member or change a member's role, you can only select a role whose permissions your own role also has. This limit does not apply to users with the "Owner" or "Admin" role. + [Learn about how roles work](/access-control/roles). \ No newline at end of file diff --git a/src/pages/public-api/errors.mdx b/src/pages/public-api/errors.mdx index e02d3b92..0d8bfbe3 100644 --- a/src/pages/public-api/errors.mdx +++ b/src/pages/public-api/errors.mdx @@ -44,6 +44,8 @@ Here is a list of the different categories of status codes returned by the Proto This error may also occur due to a [Network Access Policy](/access-control/network#network-access-policies) that restricts access from your IP address. [Read more](https://docs.phase.dev/access-control/network#access-denied-exceptions) about Network Access Policy exceptions. + + A request that creates, updates or assigns a role with permissions that the caller's own role does not have also returns this error. A 404 status code indicates that the requested resource does not exist, has been deleted, or belongs to a different organisation. The API does not distinguish between these cases to avoid leaking cross-organisation information. diff --git a/src/pages/public-api/invites.mdx b/src/pages/public-api/invites.mdx index a0e41868..85319f1a 100644 --- a/src/pages/public-api/invites.mdx +++ b/src/pages/public-api/invites.mdx @@ -64,6 +64,7 @@ Invites live under the Members resource — all endpoints are namespaced as `/v1 - The role must not have global access (i.e. Owner and Admin roles cannot be invited to). - The role must not permit creating service account tokens. + - The role must not include permissions that the caller's own role does not have. Otherwise the request returns `403 Forbidden` and the error lists each extra permission. Callers with a global-access role are exempt. - The email is validated against RFC format; whitespace is trimmed and the local + domain parts are lowercased. Invalid emails return `400 Bad Request`. - The email must not already belong to an active member or a pending invite. Duplicate invites return `409 Conflict` with `{"error": "An active invite already exists for ''."}`. diff --git a/src/pages/public-api/members.mdx b/src/pages/public-api/members.mdx index 233b35af..1655189a 100644 --- a/src/pages/public-api/members.mdx +++ b/src/pages/public-api/members.mdx @@ -175,6 +175,7 @@ To add a new member, send an invite via the [Invites API](/public-api/invites) - **The Owner's role is immutable via the API.** Any attempt to PUT the Owner's membership returns `403 Forbidden` with `{"error": "The Owner's role cannot be changed via the API. Use the ownership transfer flow."}`. Ownership transfer is a console-only flow. - Users cannot update their own role (`403`). + - Callers cannot assign a role that includes permissions their own role does not have (`403`). The error lists each extra permission. Callers with a global-access role are exempt. - User callers cannot update a member who holds a global-access role (e.g. Admin) unless they themselves hold a global-access role (`403`). - Service Account callers cannot update any member who holds a global-access role (`403`), nor can they assign a global-access role to any member (`403`). diff --git a/src/pages/public-api/roles.mdx b/src/pages/public-api/roles.mdx index 1fcf5f42..99668626 100644 --- a/src/pages/public-api/roles.mdx +++ b/src/pages/public-api/roles.mdx @@ -213,6 +213,8 @@ Responses use camelCase keys (`appPermissions`, `globalAccess`). On POST and PUT Custom roles are not available on the Free plan. You must be on a Pro or Enterprise plan to create custom roles. + - The role can only include permissions that the caller's own role has. Otherwise the request returns `403 Forbidden` with `{"error": "You cannot grant permissions your own role does not include: "}`. The error lists each extra permission as `::`, for example `permissions:SSO:create`. Callers with a global-access role (Owner or Admin) are exempt. + ### JSON Body #### Required fields @@ -333,6 +335,8 @@ Responses use camelCase keys (`appPermissions`, `globalAccess`). On POST and PUT Update a custom role's name, description, color, and/or permissions. At least one field must be provided. Default roles cannot be modified (`403 Forbidden`). + - The request can only add permissions that the caller's own role has. Otherwise the request returns `403 Forbidden` with `{"error": "You cannot grant permissions your own role does not include: "}`. This limit applies only to the permissions that the request adds. The caller can change `name`, `description` or `color`, or remove permissions that the caller does not have. Callers with a global-access role (Owner or Admin) are exempt. + ### URL parameters diff --git a/src/pages/public-api/service-accounts.mdx b/src/pages/public-api/service-accounts.mdx index 1a6b84db..ece924ef 100644 --- a/src/pages/public-api/service-accounts.mdx +++ b/src/pages/public-api/service-accounts.mdx @@ -125,7 +125,7 @@ When fetching a single service account, additional detail fields are included: The service account name. Maximum 64 characters. - The ID of the role to assign. Must not be a role with global access (e.g. Owner or Admin). + The ID of the role to assign. Must not be a role with global access (e.g. Owner or Admin). The role can only include permissions that the caller's own role has. Otherwise the request returns `403 Forbidden` and the error lists each extra permission. For a team-owned service account, the caller's permissions also include the team's `memberRole` override (or `serviceAccountRole` for service account callers). Callers with a global-access role are exempt. @@ -314,7 +314,7 @@ When fetching a single service account, additional detail fields are included: The new name. Maximum 64 characters. HTML tags and ASCII control characters are stripped; whitespace is trimmed. - The ID of the new role. Must not be a global-access role — service accounts cannot hold roles with `global_access: true`. + The ID of the new role. Must not be a global-access role — service accounts cannot hold roles with `global_access: true`. If the role changes, the new role can only include permissions that the caller's own role has. Otherwise the request returns `403 Forbidden` and the error lists each extra permission. For a team-owned service account, the caller's permissions also include the team's `memberRole` override (or `serviceAccountRole` for service account callers). Callers with a global-access role are exempt. From f3025bd49ecc7e26b146c77fe60b96723b7ec66c Mon Sep 17 00:00:00 2001 From: rohan Date: Tue, 15 Sep 2026 14:48:23 +0530 Subject: [PATCH 2/3] docs: correct the role update rule, permission tables, and role override limits --- src/pages/access-control/index.mdx | 2 ++ src/pages/access-control/roles.mdx | 18 +++++++++--------- src/pages/access-control/service-accounts.mdx | 8 ++++++-- src/pages/access-control/teams.mdx | 8 ++++++-- src/pages/console/users.mdx | 4 +++- src/pages/public-api/errors.mdx | 2 +- src/pages/public-api/invites.mdx | 2 +- src/pages/public-api/members.mdx | 2 +- src/pages/public-api/roles.mdx | 2 +- src/pages/public-api/teams.mdx | 8 ++++---- 10 files changed, 34 insertions(+), 22 deletions(-) diff --git a/src/pages/access-control/index.mdx b/src/pages/access-control/index.mdx index f422fefe..80369420 100644 --- a/src/pages/access-control/index.mdx +++ b/src/pages/access-control/index.mdx @@ -90,6 +90,8 @@ The Phase End-to-End encryption implementation works in conjunction with the acc Global access is a special type of permission that grants users with a "global access" role implicit access to all Apps and Environments across the organization. Currently, Global access is reserved exclusively for the Phase managed `Owner` and `Admin` roles. +Users can only grant permissions that their own role holds. The `Owner` and `Admin` roles are exempt from this limit. [Read more](/access-control/roles) about how roles work. + ### External Auth Method Considerations - To use an external auth provider for programmatic authentication with Phase to access sensitive data (e.g., Secrets) via the Phase API, SDKs, or the Kubernetes Operator, you must enable Server-side Encryption (SSE) so that Phase can generate a Service Token on the server side with access to given application(s) or environment(s). diff --git a/src/pages/access-control/roles.mdx b/src/pages/access-control/roles.mdx index 8897f8b3..13e9cfb1 100644 --- a/src/pages/access-control/roles.mdx +++ b/src/pages/access-control/roles.mdx @@ -48,7 +48,7 @@ The organization owner. This role is automatically assigned when a user creates | **Roles** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integration Credentials** | Full access | ✅ | ✅ | ✅ | ✅ | | **Network Access Policies** | Full access | ✅ | ✅ | ✅ | ✅ | -| **Logs** | Read access | ✅ | ❌ | ❌ | ❌ | +| **Logs** | Full access | ✅ | | | | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | | **SCIM** | Full access | ✅ | ✅ | ✅ | ✅ | | **SSO** | Full access | ✅ | ✅ | ✅ | ✅ | @@ -90,7 +90,7 @@ Admin users have access to most resources and permissions, and have global acces | **Roles** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integration Credentials** | Full access | ✅ | ✅ | ✅ | ✅ | | **Network Access Policies** | Full access | ✅ | ✅ | ✅ | ✅ | -| **Logs** | Read access | ✅ | ❌ | ❌ | ❌ | +| **Logs** | Full access | ✅ | | | | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | | **SCIM** | Full access | ✅ | ✅ | ✅ | ✅ | | **SSO** | Full access | ✅ | ✅ | ✅ | ✅ | @@ -110,7 +110,7 @@ Admin users have access to most resources and permissions, and have global acces | **Members** | Full access | ✅ | ✅ | ✅ | ✅ | | **Service Accounts** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integrations** | Full access | ✅ | ✅ | ✅ | ✅ | -| **Encryption Mode** | Custom access | ✅ | | ✅ | | +| **Encryption Mode** | Full access | ✅ | | ✅ | | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | The `Owner` and `Admin` roles have global access. Learn more about global access [here](/access-control#global-access). @@ -134,7 +134,7 @@ Management users with broad access to environments, secrets, and service account | **Roles** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integration Credentials** | Full access | ✅ | ✅ | ✅ | ✅ | | **Network Access Policies** | Full access | ✅ | ✅ | ✅ | ✅ | -| **Logs** | Read access | ✅ | ❌ | ❌ | ❌ | +| **Logs** | Full access | ✅ | | | | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | | **SCIM** | No access | ❌ | ❌ | ❌ | ❌ | | **SSO** | No access | ❌ | ❌ | ❌ | ❌ | @@ -154,7 +154,7 @@ Management users with broad access to environments, secrets, and service account | **Members** | Full access | ✅ | ✅ | ✅ | ✅ | | **Service Accounts** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integrations** | Full access | ✅ | ✅ | ✅ | ✅ | -| **Encryption Mode** | Custom access | ✅ | ❌ | ✅ | ❌ | +| **Encryption Mode** | Full access | ✅ | | ✅ | | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | ### Service @@ -176,7 +176,7 @@ Default role for Service Accounts, providing programmatic access to secrets with | **Roles** | Read access | ✅ | ❌ | ❌ | ❌ | | **Integration Credentials** | Read access | ✅ | ❌ | ❌ | ❌ | | **Network Access Policies** | Read access | ✅ | ❌ | ❌ | ❌ | -| **Logs** | No access | ❌ | ❌ | ❌ | ❌ | +| **Logs** | No access | ❌ | | | | | **Teams** | No access | ❌ | ❌ | ❌ | ❌ | | **SCIM** | No access | ❌ | ❌ | ❌ | ❌ | | **SSO** | No access | ❌ | ❌ | ❌ | ❌ | @@ -196,7 +196,7 @@ Default role for Service Accounts, providing programmatic access to secrets with | **Members** | Read access | ✅ | ❌ | ❌ | ❌ | | **Service Accounts** | Read access | ✅ | ❌ | ❌ | ❌ | | **Integrations** | Read access | ✅ | ❌ | ❌ | ❌ | -| **Encryption Mode** | Read access | ✅ | ❌ | ❌ | ❌ | +| **Encryption Mode** | Read access | ✅ | | ❌ | | | **Teams** | Read access | ✅ | ❌ | ❌ | ❌ | ### Developer @@ -218,7 +218,7 @@ Developers have limited permissions at the organization level and must be given | **Roles** | Read access | ✅ | ❌ | ❌ | ❌ | | **Integration Credentials** | Custom access | ✅ | ✅ | ✅ | ❌ | | **Network Access Policies** | Read access | ✅ | ❌ | ❌ | ❌ | -| **Logs** | Read access | ✅ | ❌ | ❌ | ❌ | +| **Logs** | Full access | ✅ | | | | | **Teams** | Read access | ✅ | ❌ | ❌ | ❌ | | **SCIM** | No access | ❌ | ❌ | ❌ | ❌ | | **SSO** | No access | ❌ | ❌ | ❌ | ❌ | @@ -238,7 +238,7 @@ Developers have limited permissions at the organization level and must be given | **Members** | Read access | ✅ | ❌ | ❌ | ❌ | | **Service Accounts** | Custom access | ❌ | ✅ | ❌ | ❌ | | **Integrations** | Full access | ✅ | ✅ | ✅ | ✅ | -| **Encryption Mode** | Custom access | ✅ | | ✅ | | +| **Encryption Mode** | Full access | ✅ | | ✅ | | | **Teams** | Read access | ✅ | ❌ | ❌ | ❌ | ## Custom Roles diff --git a/src/pages/access-control/service-accounts.mdx b/src/pages/access-control/service-accounts.mdx index ee4dc994..eb13fd7d 100644 --- a/src/pages/access-control/service-accounts.mdx +++ b/src/pages/access-control/service-accounts.mdx @@ -46,7 +46,9 @@ By default, when you create a new Service Account it uses the [Service](/access- You may choose to select a different Managed role or a Custom role by clicking one from the dropdown. -You can only select a role whose permissions your own role also has. The dropdown disables the other roles. This limit does not apply to users with the Owner or Admin role. + + You can only select a role whose permissions your own role also has. The dropdown disables roles with permissions that your role does not have. This limit does not apply to users with the `Owner` or `Admin` role. + ![Create new service account](/assets/images/console/access-control/service-accounts/create-new-service-accounts/4-create-new-service-account.png) @@ -75,7 +77,9 @@ To update the name of an account, simply click the account name at the top of th To update an account's role, click the role label to open the dropdown and select a role from the list. The selected role will be applied on selection. -You can only select a role whose permissions your own role also has. This limit does not apply to users with the Owner or Admin role. + + You can only select a role whose permissions your own role also has. For a team-owned account, Phase also counts the permissions of the team [role override](/access-control/teams#role-overrides). This limit does not apply to users with the `Owner` or `Admin` role. + ![Update service account role](/assets/images/console/access-control/service-accounts/manage-account/service-account-update-role.png) diff --git a/src/pages/access-control/teams.mdx b/src/pages/access-control/teams.mdx index dce7c5b9..a5f0c9c6 100644 --- a/src/pages/access-control/teams.mdx +++ b/src/pages/access-control/teams.mdx @@ -140,6 +140,8 @@ Teams support two optional role overrides that change what permissions members h When a role override is set, it replaces the org role's `app_permissions` for resources accessed through that team. Org-level permissions are unaffected. +The [limit on the permissions you can grant](/access-control/roles) does not apply to role overrides. When a team member creates or updates a team-owned service account, Phase adds the **Member role** override permissions to that member's own permissions. + ### Union semantics When a user has multiple access grants to the same app — whether through individual (direct) access, one or more teams, or a combination — Phase takes the **union** of all applicable permissions. If *any* grant permits an action, the user is allowed to perform it. @@ -164,6 +166,10 @@ Service accounts can be **owned by a team**, meaning their lifecycle and visibil ### Creating a team-owned service account + + You can only select a role whose permissions your own role also has. If the team has a **Member role** override, Phase adds the permissions of that override to your own permissions for this check. This limit does not apply to users with the `Owner` or `Admin` role. + + 1. On the team detail page, click **Create Team Service Account** in the Service Accounts section. 2. Enter a name for the account. @@ -172,8 +178,6 @@ Service accounts can be **owned by a team**, meaning their lifecycle and visibil 4. Click **Create**. The service account is automatically added as a member of the team and can access all apps and environments that the team has access to. -The role of the account can only have permissions that your own role has. If the team has a **Member role** override, Phase adds the permissions of that override to your own permissions for this check. This limit does not apply to users with the Owner or Admin role. - Team-owned service accounts always use **Server-side KMS**, which is enabled automatically on creation. This allows any team member with the appropriate `ServiceAccountTokens` permissions to generate tokens for the account — without needing to be a designated Service Account Handler. This is essential for dynamic team membership, including [SCIM-managed teams](#scim-managed-teams), where members may join or leave at any time. Team-owned service accounts are visually distinguished with a team badge on both the team detail page and the organisation-level service accounts list. diff --git a/src/pages/console/users.mdx b/src/pages/console/users.mdx index 679f227a..5dbfe326 100644 --- a/src/pages/console/users.mdx +++ b/src/pages/console/users.mdx @@ -94,6 +94,8 @@ You can permanently remove a member from an Organisation from the [Organisation Users in Phase must be given a role. By default, users are given the managed "Developer" role when they join an Organisation. This role can be changed once they join. -When you invite a member or change a member's role, you can only select a role whose permissions your own role also has. This limit does not apply to users with the "Owner" or "Admin" role. + + When you invite a member or change a member's role, you can only select a role whose permissions your own role also has. This limit does not apply to users with the "Owner" or "Admin" role. + [Learn about how roles work](/access-control/roles). \ No newline at end of file diff --git a/src/pages/public-api/errors.mdx b/src/pages/public-api/errors.mdx index 0d8bfbe3..ef88ac00 100644 --- a/src/pages/public-api/errors.mdx +++ b/src/pages/public-api/errors.mdx @@ -45,7 +45,7 @@ Here is a list of the different categories of status codes returned by the Proto This error may also occur due to a [Network Access Policy](/access-control/network#network-access-policies) that restricts access from your IP address. [Read more](https://docs.phase.dev/access-control/network#access-denied-exceptions) about Network Access Policy exceptions. - A request that creates, updates or assigns a role with permissions that the caller's own role does not have also returns this error. + When a role holds permissions that the caller's own role does not have, a create or assign request returns this error. Assignment covers members, invites, and service accounts. A request that updates a role returns this error only when the update adds such a permission. A 404 status code indicates that the requested resource does not exist, has been deleted, or belongs to a different organisation. The API does not distinguish between these cases to avoid leaking cross-organisation information. diff --git a/src/pages/public-api/invites.mdx b/src/pages/public-api/invites.mdx index 85319f1a..18187716 100644 --- a/src/pages/public-api/invites.mdx +++ b/src/pages/public-api/invites.mdx @@ -64,7 +64,7 @@ Invites live under the Members resource — all endpoints are namespaced as `/v1 - The role must not have global access (i.e. Owner and Admin roles cannot be invited to). - The role must not permit creating service account tokens. - - The role must not include permissions that the caller's own role does not have. Otherwise the request returns `403 Forbidden` and the error lists each extra permission. Callers with a global-access role are exempt. + - The role must not include permissions that the caller's own role does not have. Otherwise the request returns `403 Forbidden` with `{"error": "You cannot assign the '' role: it includes permissions your own role does not: "}`. Callers with a global-access role are exempt. - The email is validated against RFC format; whitespace is trimmed and the local + domain parts are lowercased. Invalid emails return `400 Bad Request`. - The email must not already belong to an active member or a pending invite. Duplicate invites return `409 Conflict` with `{"error": "An active invite already exists for ''."}`. diff --git a/src/pages/public-api/members.mdx b/src/pages/public-api/members.mdx index 1655189a..e025e1d7 100644 --- a/src/pages/public-api/members.mdx +++ b/src/pages/public-api/members.mdx @@ -175,7 +175,7 @@ To add a new member, send an invite via the [Invites API](/public-api/invites) - **The Owner's role is immutable via the API.** Any attempt to PUT the Owner's membership returns `403 Forbidden` with `{"error": "The Owner's role cannot be changed via the API. Use the ownership transfer flow."}`. Ownership transfer is a console-only flow. - Users cannot update their own role (`403`). - - Callers cannot assign a role that includes permissions their own role does not have (`403`). The error lists each extra permission. Callers with a global-access role are exempt. + - Callers cannot assign a role that includes permissions their own role does not have. The request returns `403 Forbidden` with `{"error": "You cannot assign the '' role: it includes permissions your own role does not: "}`. Callers with a global-access role are exempt. - User callers cannot update a member who holds a global-access role (e.g. Admin) unless they themselves hold a global-access role (`403`). - Service Account callers cannot update any member who holds a global-access role (`403`), nor can they assign a global-access role to any member (`403`). diff --git a/src/pages/public-api/roles.mdx b/src/pages/public-api/roles.mdx index 99668626..aa0cbc34 100644 --- a/src/pages/public-api/roles.mdx +++ b/src/pages/public-api/roles.mdx @@ -335,7 +335,7 @@ Responses use camelCase keys (`appPermissions`, `globalAccess`). On POST and PUT Update a custom role's name, description, color, and/or permissions. At least one field must be provided. Default roles cannot be modified (`403 Forbidden`). - - The request can only add permissions that the caller's own role has. Otherwise the request returns `403 Forbidden` with `{"error": "You cannot grant permissions your own role does not include: "}`. This limit applies only to the permissions that the request adds. The caller can change `name`, `description` or `color`, or remove permissions that the caller does not have. Callers with a global-access role (Owner or Admin) are exempt. + - The request can only add permissions that the caller's own role has. Otherwise the request returns `403 Forbidden` with `{"error": "You cannot grant permissions your own role does not include: "}`. This limit applies only to the permissions that the request adds. The caller can change `name`, `description`, or `color`, or remove permissions that the caller does not have. Callers with a global-access role (Owner or Admin) are exempt. ### URL parameters diff --git a/src/pages/public-api/teams.mdx b/src/pages/public-api/teams.mdx index 2e95d46f..32b6e730 100644 --- a/src/pages/public-api/teams.mdx +++ b/src/pages/public-api/teams.mdx @@ -144,10 +144,10 @@ Server-side Encryption (SSE) is required for an app to be granted to a team — A description for the team. Maximum 10,000 characters. - Role ID to apply as the team's `memberRole` override. Must reference a role in the same organisation. + Role ID to apply as the team's `memberRole` override. Must reference a role in the same organisation. The limit on the permissions a caller can grant does not apply to overrides. Phase adds this override to the permissions of a user caller who creates or updates a team-owned service account. - Role ID to apply as the team's `serviceAccountRole` override. Must reference a role in the same organisation. + Role ID to apply as the team's `serviceAccountRole` override. Must reference a role in the same organisation. The limit on the permissions a caller can grant does not apply to overrides. Phase adds this override to the permissions of a service account caller who creates or updates a team-owned service account. @@ -336,10 +336,10 @@ Server-side Encryption (SSE) is required for an app to be granted to a team — The new description. Maximum 10,000 characters. - New role override for human members. Pass `""` to clear the existing override. + New role override for human members. Pass `""` to clear the existing override. The limit on the permissions a caller can grant does not apply to overrides. Phase adds this override to the permissions of a user caller who creates or updates a team-owned service account. - New role override for service-account members. Pass `""` to clear the existing override. + New role override for service-account members. Pass `""` to clear the existing override. The limit on the permissions a caller can grant does not apply to overrides. Phase adds this override to the permissions of a service account caller who creates or updates a team-owned service account. From 32b4d6a89354bf3b9d5c675099975ad57b26cd61 Mon Sep 17 00:00:00 2001 From: rohan Date: Tue, 15 Sep 2026 15:20:58 +0530 Subject: [PATCH 3/3] chore: regen sitemap and mds Signed-off-by: rohan --- public/access-control.md | 2 + public/access-control/roles.md | 36 +++- public/access-control/service-accounts.md | 8 + public/access-control/teams.md | 6 + public/console/organisation.md | 2 + public/console/users.md | 4 + public/public-api/errors.md | 2 + public/public-api/invites.md | 1 + public/public-api/members.md | 1 + public/public-api/roles.md | 4 + public/public-api/service-accounts.md | 4 +- public/public-api/teams.md | 8 +- public/sitemap.xml | 204 +++++++++++----------- 13 files changed, 167 insertions(+), 115 deletions(-) diff --git a/public/access-control.md b/public/access-control.md index f422fefe..80369420 100644 --- a/public/access-control.md +++ b/public/access-control.md @@ -90,6 +90,8 @@ The Phase End-to-End encryption implementation works in conjunction with the acc Global access is a special type of permission that grants users with a "global access" role implicit access to all Apps and Environments across the organization. Currently, Global access is reserved exclusively for the Phase managed `Owner` and `Admin` roles. +Users can only grant permissions that their own role holds. The `Owner` and `Admin` roles are exempt from this limit. [Read more](/access-control/roles) about how roles work. + ### External Auth Method Considerations - To use an external auth provider for programmatic authentication with Phase to access sensitive data (e.g., Secrets) via the Phase API, SDKs, or the Kubernetes Operator, you must enable Server-side Encryption (SSE) so that Phase can generate a Service Token on the server side with access to given application(s) or environment(s). diff --git a/public/access-control/roles.md b/public/access-control/roles.md index ffb44750..13e9cfb1 100644 --- a/public/access-control/roles.md +++ b/public/access-control/roles.md @@ -21,6 +21,10 @@ To assign a role to a user or change a user's role: ![3-click-current-role](/assets/images/console/access-control/roles/switch-user-role/3-switch-user-role.png) 4. Once selected, you will see a toast notification confirming that the role has been updated. + + You can only assign a role whose permissions your own role also has. The dropdown disables roles with permissions that your role does not have. This limit does not apply to users with the `Owner` or `Admin` role. + + ## Managed Roles Phase provides managed roles out of the box to every organization. @@ -44,9 +48,11 @@ The organization owner. This role is automatically assigned when a user creates | **Roles** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integration Credentials** | Full access | ✅ | ✅ | ✅ | ✅ | | **Network Access Policies** | Full access | ✅ | ✅ | ✅ | ✅ | +| **Logs** | Full access | ✅ | | | | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | | **SCIM** | Full access | ✅ | ✅ | ✅ | ✅ | | **SSO** | Full access | ✅ | ✅ | ✅ | ✅ | +| **Log Streams** | Full access | ✅ | ✅ | ✅ | ✅ | #### App-level permissions: @@ -84,9 +90,11 @@ Admin users have access to most resources and permissions, and have global acces | **Roles** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integration Credentials** | Full access | ✅ | ✅ | ✅ | ✅ | | **Network Access Policies** | Full access | ✅ | ✅ | ✅ | ✅ | +| **Logs** | Full access | ✅ | | | | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | | **SCIM** | Full access | ✅ | ✅ | ✅ | ✅ | | **SSO** | Full access | ✅ | ✅ | ✅ | ✅ | +| **Log Streams** | Full access | ✅ | ✅ | ✅ | ✅ | #### App-level permissions: @@ -102,7 +110,7 @@ Admin users have access to most resources and permissions, and have global acces | **Members** | Full access | ✅ | ✅ | ✅ | ✅ | | **Service Accounts** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integrations** | Full access | ✅ | ✅ | ✅ | ✅ | -| **Encryption Mode** | Custom access | ✅ | | ✅ | | +| **Encryption Mode** | Full access | ✅ | | ✅ | | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | The `Owner` and `Admin` roles have global access. Learn more about global access [here](/access-control#global-access). @@ -126,15 +134,17 @@ Management users with broad access to environments, secrets, and service account | **Roles** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integration Credentials** | Full access | ✅ | ✅ | ✅ | ✅ | | **Network Access Policies** | Full access | ✅ | ✅ | ✅ | ✅ | +| **Logs** | Full access | ✅ | | | | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | | **SCIM** | No access | ❌ | ❌ | ❌ | ❌ | | **SSO** | No access | ❌ | ❌ | ❌ | ❌ | +| **Log Streams** | No access | ❌ | ❌ | ❌ | ❌ | #### App-level permissions: | Resource | Access | Read | Create | Update | Delete | |----------|--------|------|--------|--------|--------| -| **Environments** | Custom access | ✅ | ✅ | ✅ | ❌ | +| **Environments** | Full access | ✅ | ✅ | ✅ | ✅ | | **Secrets** | Full access | ✅ | ✅ | ✅ | ✅ | | **DynamicSecretLeases** | Full access | ✅ | ✅ | ✅ | ✅ | | **RotatingSecrets** | Full access | ✅ | ✅ | ✅ | ✅ | @@ -144,7 +154,7 @@ Management users with broad access to environments, secrets, and service account | **Members** | Full access | ✅ | ✅ | ✅ | ✅ | | **Service Accounts** | Full access | ✅ | ✅ | ✅ | ✅ | | **Integrations** | Full access | ✅ | ✅ | ✅ | ✅ | -| **Encryption Mode** | Custom access | ✅ | ❌ | ✅ | ❌ | +| **Encryption Mode** | Full access | ✅ | | ✅ | | | **Teams** | Full access | ✅ | ✅ | ✅ | ✅ | ### Service @@ -166,9 +176,11 @@ Default role for Service Accounts, providing programmatic access to secrets with | **Roles** | Read access | ✅ | ❌ | ❌ | ❌ | | **Integration Credentials** | Read access | ✅ | ❌ | ❌ | ❌ | | **Network Access Policies** | Read access | ✅ | ❌ | ❌ | ❌ | +| **Logs** | No access | ❌ | | | | | **Teams** | No access | ❌ | ❌ | ❌ | ❌ | | **SCIM** | No access | ❌ | ❌ | ❌ | ❌ | | **SSO** | No access | ❌ | ❌ | ❌ | ❌ | +| **Log Streams** | No access | ❌ | ❌ | ❌ | ❌ | #### App-level permissions: @@ -176,7 +188,7 @@ Default role for Service Accounts, providing programmatic access to secrets with |----------|--------|------|--------|--------|--------| | **Environments** | Full access | ✅ | ✅ | ✅ | ✅ | | **Secrets** | Full access | ✅ | ✅ | ✅ | ✅ | -| **DynamicSecretLeases** | Full access | ✅ | ✅ | ❌ | ❌ | +| **DynamicSecretLeases** | Custom access | ✅ | ✅ | ❌ | ❌ | | **RotatingSecrets** | Read access | ✅ | ❌ | ❌ | ❌ | | **Lockbox** | No access | ❌ | ❌ | ❌ | ❌ | | **Logs** | No access | ❌ | ❌ | ❌ | ❌ | @@ -184,7 +196,7 @@ Default role for Service Accounts, providing programmatic access to secrets with | **Members** | Read access | ✅ | ❌ | ❌ | ❌ | | **Service Accounts** | Read access | ✅ | ❌ | ❌ | ❌ | | **Integrations** | Read access | ✅ | ❌ | ❌ | ❌ | -| **Encryption Mode** | Read access | ✅ | ❌ | ❌ | ❌ | +| **Encryption Mode** | Read access | ✅ | | ❌ | | | **Teams** | Read access | ✅ | ❌ | ❌ | ❌ | ### Developer @@ -206,9 +218,11 @@ Developers have limited permissions at the organization level and must be given | **Roles** | Read access | ✅ | ❌ | ❌ | ❌ | | **Integration Credentials** | Custom access | ✅ | ✅ | ✅ | ❌ | | **Network Access Policies** | Read access | ✅ | ❌ | ❌ | ❌ | +| **Logs** | Full access | ✅ | | | | | **Teams** | Read access | ✅ | ❌ | ❌ | ❌ | | **SCIM** | No access | ❌ | ❌ | ❌ | ❌ | | **SSO** | No access | ❌ | ❌ | ❌ | ❌ | +| **Log Streams** | No access | ❌ | ❌ | ❌ | ❌ | #### App-level permissions: @@ -216,7 +230,7 @@ Developers have limited permissions at the organization level and must be given |----------|--------|------|--------|--------|--------| | **Environments** | Custom access | ✅ | ✅ | ✅ | ❌ | | **Secrets** | Full access | ✅ | ✅ | ✅ | ✅ | -| **DynamicSecretLeases** | Full access | ✅ | ✅ | ❌ | ❌ | +| **DynamicSecretLeases** | Custom access | ✅ | ✅ | ❌ | ❌ | | **RotatingSecrets** | Read access | ✅ | ❌ | ❌ | ❌ | | **Lockbox** | Full access | ✅ | ✅ | ✅ | ✅ | | **Logs** | Read access | ✅ | ❌ | ❌ | ❌ | @@ -224,7 +238,7 @@ Developers have limited permissions at the organization level and must be given | **Members** | Read access | ✅ | ❌ | ❌ | ❌ | | **Service Accounts** | Custom access | ❌ | ✅ | ❌ | ❌ | | **Integrations** | Full access | ✅ | ✅ | ✅ | ✅ | -| **Encryption Mode** | Custom access | ✅ | | ✅ | | +| **Encryption Mode** | Full access | ✅ | | ✅ | | | **Teams** | Read access | ✅ | ❌ | ❌ | ❌ | ## Custom Roles @@ -241,6 +255,10 @@ In addition to the managed roles, Phase allows you to create custom roles tailor Please make sure to follow the [Principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) when setting the access policy for roles. Casting a wider scope may inadvertently lead to [Privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation). + + You can only grant permissions that your own role has. Phase disables the toggles for permissions that your role does not have. This limit does not apply to users with the `Owner` or `Admin` role. + + 1. Navigate to the Access Control page from the sidebar and click on the Roles tab. ![1-navigate-to-access-control](/assets/images/console/access-control/roles/create-custom-roles/1-navigate-to-access-control.png) ![2-navigate-to-access-control-roles](/assets/images/console/access-control/roles/create-custom-roles/2-navigate-to-access-control-roles.png) @@ -308,3 +326,7 @@ Some actions require a combination of permissions across multiple resources. Bel 3. Modify the role as needed. 4. Save your changes. ![4-save-modified-role](/assets/images/console/access-control/roles/edit-custom-roles/4-save-modified-role.png) + + + You can only add permissions that your own role has. If the role already has permissions that your role does not have, you can keep them or remove them, but you cannot add them back. This limit does not apply to users with the `Owner` or `Admin` role. + diff --git a/public/access-control/service-accounts.md b/public/access-control/service-accounts.md index 4f415b99..eb13fd7d 100644 --- a/public/access-control/service-accounts.md +++ b/public/access-control/service-accounts.md @@ -46,6 +46,10 @@ By default, when you create a new Service Account it uses the [Service](/access- You may choose to select a different Managed role or a Custom role by clicking one from the dropdown. + + You can only select a role whose permissions your own role also has. The dropdown disables roles with permissions that your role does not have. This limit does not apply to users with the `Owner` or `Admin` role. + + ![Create new service account](/assets/images/console/access-control/service-accounts/create-new-service-accounts/4-create-new-service-account.png) Click "Create service account". This will create a new account with the chosen name and role. @@ -73,6 +77,10 @@ To update the name of an account, simply click the account name at the top of th To update an account's role, click the role label to open the dropdown and select a role from the list. The selected role will be applied on selection. + + You can only select a role whose permissions your own role also has. For a team-owned account, Phase also counts the permissions of the team [role override](/access-control/teams#role-overrides). This limit does not apply to users with the `Owner` or `Admin` role. + + ![Update service account role](/assets/images/console/access-control/service-accounts/manage-account/service-account-update-role.png) ### Delete account diff --git a/public/access-control/teams.md b/public/access-control/teams.md index 1c004717..a5f0c9c6 100644 --- a/public/access-control/teams.md +++ b/public/access-control/teams.md @@ -140,6 +140,8 @@ Teams support two optional role overrides that change what permissions members h When a role override is set, it replaces the org role's `app_permissions` for resources accessed through that team. Org-level permissions are unaffected. +The [limit on the permissions you can grant](/access-control/roles) does not apply to role overrides. When a team member creates or updates a team-owned service account, Phase adds the **Member role** override permissions to that member's own permissions. + ### Union semantics When a user has multiple access grants to the same app — whether through individual (direct) access, one or more teams, or a combination — Phase takes the **union** of all applicable permissions. If *any* grant permits an action, the user is allowed to perform it. @@ -164,6 +166,10 @@ Service accounts can be **owned by a team**, meaning their lifecycle and visibil ### Creating a team-owned service account + + You can only select a role whose permissions your own role also has. If the team has a **Member role** override, Phase adds the permissions of that override to your own permissions for this check. This limit does not apply to users with the `Owner` or `Admin` role. + + 1. On the team detail page, click **Create Team Service Account** in the Service Accounts section. 2. Enter a name for the account. diff --git a/public/console/organisation.md b/public/console/organisation.md index fa3f77f9..81f14b07 100644 --- a/public/console/organisation.md +++ b/public/console/organisation.md @@ -36,6 +36,8 @@ You can also invite new members to your Organisation. To invite a new member, cl You are limited to selecting a non Global Access role when inviting a new member. This is because the user has not created an account and associated cryptographic keys. For more information on Global Access roles, see [Roles](/access-control#global-access). +When you invite a member or change a member's role, you can only select a role whose permissions your own role also has. This limit does not apply to users with the Owner or Admin role. + ## Settings This page shows your account and recovery info related to this Organisation. You can view your current role, preferences and download your account recovery kit from this screen. This page will also show you the current billing status of your Organisation. diff --git a/public/console/users.md b/public/console/users.md index 9416084c..5dbfe326 100644 --- a/public/console/users.md +++ b/public/console/users.md @@ -94,4 +94,8 @@ You can permanently remove a member from an Organisation from the [Organisation Users in Phase must be given a role. By default, users are given the managed "Developer" role when they join an Organisation. This role can be changed once they join. + + When you invite a member or change a member's role, you can only select a role whose permissions your own role also has. This limit does not apply to users with the "Owner" or "Admin" role. + + [Learn about how roles work](/access-control/roles). \ No newline at end of file diff --git a/public/public-api/errors.md b/public/public-api/errors.md index e02d3b92..ef88ac00 100644 --- a/public/public-api/errors.md +++ b/public/public-api/errors.md @@ -44,6 +44,8 @@ Here is a list of the different categories of status codes returned by the Proto This error may also occur due to a [Network Access Policy](/access-control/network#network-access-policies) that restricts access from your IP address. [Read more](https://docs.phase.dev/access-control/network#access-denied-exceptions) about Network Access Policy exceptions. + + When a role holds permissions that the caller's own role does not have, a create or assign request returns this error. Assignment covers members, invites, and service accounts. A request that updates a role returns this error only when the update adds such a permission. A 404 status code indicates that the requested resource does not exist, has been deleted, or belongs to a different organisation. The API does not distinguish between these cases to avoid leaking cross-organisation information. diff --git a/public/public-api/invites.md b/public/public-api/invites.md index a0e41868..18187716 100644 --- a/public/public-api/invites.md +++ b/public/public-api/invites.md @@ -64,6 +64,7 @@ Invites live under the Members resource — all endpoints are namespaced as `/v1 - The role must not have global access (i.e. Owner and Admin roles cannot be invited to). - The role must not permit creating service account tokens. + - The role must not include permissions that the caller's own role does not have. Otherwise the request returns `403 Forbidden` with `{"error": "You cannot assign the '' role: it includes permissions your own role does not: "}`. Callers with a global-access role are exempt. - The email is validated against RFC format; whitespace is trimmed and the local + domain parts are lowercased. Invalid emails return `400 Bad Request`. - The email must not already belong to an active member or a pending invite. Duplicate invites return `409 Conflict` with `{"error": "An active invite already exists for ''."}`. diff --git a/public/public-api/members.md b/public/public-api/members.md index 233b35af..e025e1d7 100644 --- a/public/public-api/members.md +++ b/public/public-api/members.md @@ -175,6 +175,7 @@ To add a new member, send an invite via the [Invites API](/public-api/invites) - **The Owner's role is immutable via the API.** Any attempt to PUT the Owner's membership returns `403 Forbidden` with `{"error": "The Owner's role cannot be changed via the API. Use the ownership transfer flow."}`. Ownership transfer is a console-only flow. - Users cannot update their own role (`403`). + - Callers cannot assign a role that includes permissions their own role does not have. The request returns `403 Forbidden` with `{"error": "You cannot assign the '' role: it includes permissions your own role does not: "}`. Callers with a global-access role are exempt. - User callers cannot update a member who holds a global-access role (e.g. Admin) unless they themselves hold a global-access role (`403`). - Service Account callers cannot update any member who holds a global-access role (`403`), nor can they assign a global-access role to any member (`403`). diff --git a/public/public-api/roles.md b/public/public-api/roles.md index 1fcf5f42..aa0cbc34 100644 --- a/public/public-api/roles.md +++ b/public/public-api/roles.md @@ -213,6 +213,8 @@ Responses use camelCase keys (`appPermissions`, `globalAccess`). On POST and PUT Custom roles are not available on the Free plan. You must be on a Pro or Enterprise plan to create custom roles. + - The role can only include permissions that the caller's own role has. Otherwise the request returns `403 Forbidden` with `{"error": "You cannot grant permissions your own role does not include: "}`. The error lists each extra permission as `::`, for example `permissions:SSO:create`. Callers with a global-access role (Owner or Admin) are exempt. + ### JSON Body #### Required fields @@ -333,6 +335,8 @@ Responses use camelCase keys (`appPermissions`, `globalAccess`). On POST and PUT Update a custom role's name, description, color, and/or permissions. At least one field must be provided. Default roles cannot be modified (`403 Forbidden`). + - The request can only add permissions that the caller's own role has. Otherwise the request returns `403 Forbidden` with `{"error": "You cannot grant permissions your own role does not include: "}`. This limit applies only to the permissions that the request adds. The caller can change `name`, `description`, or `color`, or remove permissions that the caller does not have. Callers with a global-access role (Owner or Admin) are exempt. + ### URL parameters diff --git a/public/public-api/service-accounts.md b/public/public-api/service-accounts.md index 1a6b84db..ece924ef 100644 --- a/public/public-api/service-accounts.md +++ b/public/public-api/service-accounts.md @@ -125,7 +125,7 @@ When fetching a single service account, additional detail fields are included: The service account name. Maximum 64 characters. - The ID of the role to assign. Must not be a role with global access (e.g. Owner or Admin). + The ID of the role to assign. Must not be a role with global access (e.g. Owner or Admin). The role can only include permissions that the caller's own role has. Otherwise the request returns `403 Forbidden` and the error lists each extra permission. For a team-owned service account, the caller's permissions also include the team's `memberRole` override (or `serviceAccountRole` for service account callers). Callers with a global-access role are exempt. @@ -314,7 +314,7 @@ When fetching a single service account, additional detail fields are included: The new name. Maximum 64 characters. HTML tags and ASCII control characters are stripped; whitespace is trimmed. - The ID of the new role. Must not be a global-access role — service accounts cannot hold roles with `global_access: true`. + The ID of the new role. Must not be a global-access role — service accounts cannot hold roles with `global_access: true`. If the role changes, the new role can only include permissions that the caller's own role has. Otherwise the request returns `403 Forbidden` and the error lists each extra permission. For a team-owned service account, the caller's permissions also include the team's `memberRole` override (or `serviceAccountRole` for service account callers). Callers with a global-access role are exempt. diff --git a/public/public-api/teams.md b/public/public-api/teams.md index 2e95d46f..32b6e730 100644 --- a/public/public-api/teams.md +++ b/public/public-api/teams.md @@ -144,10 +144,10 @@ Server-side Encryption (SSE) is required for an app to be granted to a team — A description for the team. Maximum 10,000 characters. - Role ID to apply as the team's `memberRole` override. Must reference a role in the same organisation. + Role ID to apply as the team's `memberRole` override. Must reference a role in the same organisation. The limit on the permissions a caller can grant does not apply to overrides. Phase adds this override to the permissions of a user caller who creates or updates a team-owned service account. - Role ID to apply as the team's `serviceAccountRole` override. Must reference a role in the same organisation. + Role ID to apply as the team's `serviceAccountRole` override. Must reference a role in the same organisation. The limit on the permissions a caller can grant does not apply to overrides. Phase adds this override to the permissions of a service account caller who creates or updates a team-owned service account. @@ -336,10 +336,10 @@ Server-side Encryption (SSE) is required for an app to be granted to a team — The new description. Maximum 10,000 characters. - New role override for human members. Pass `""` to clear the existing override. + New role override for human members. Pass `""` to clear the existing override. The limit on the permissions a caller can grant does not apply to overrides. Phase adds this override to the permissions of a user caller who creates or updates a team-owned service account. - New role override for service-account members. Pass `""` to clear the existing override. + New role override for service-account members. Pass `""` to clear the existing override. The limit on the permissions a caller can grant does not apply to overrides. Phase adds this override to the permissions of a service account caller who creates or updates a team-owned service account. diff --git a/public/sitemap.xml b/public/sitemap.xml index 0c87c415..73306c51 100644 --- a/public/sitemap.xml +++ b/public/sitemap.xml @@ -1,105 +1,105 @@ -https://docs.phase.dev2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/authentication2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/authentication/account2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/authentication/mfa2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/authentication/oauth-sso2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/authentication/oidc-sso2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/authentication/password2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/authentication/sso2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/authentication/tokens2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/external-identities2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/network2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/provisioning/scim2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/roles2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/service-accounts2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/access-control/teams2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/cli2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/cli/commands2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/cli/install2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/cli/usage2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/console2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/console/apps2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/console/dynamic-secrets2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/console/environments2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/console/logstreams2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/console/organisation2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/console/rotating-secrets2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/console/secrets2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/console/users2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/agents/claude-code2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/agents/codex2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/agents/cursor2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/agents/opencode2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/agents/vscode-copilot2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/frameworks2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/aws-codebuild2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/aws-elastic-container-service2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/aws-iam2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/aws-secrets-manager2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/azure-key-vault2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/azure-pipelines2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/bitbucket-pipelines2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/buildkite2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/circleci2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/cloudflare-pages2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/cloudflare-workers2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/docker2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/docker-compose2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/drone-ci2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/github-actions2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/github-dependabot2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/gitlab-ci2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/hashicorp-nomad2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/hashicorp-terraform2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/hashicorp-vault2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/jenkins2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/jetbrains2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/kubernetes2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/litellm2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/openai2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/railway2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/render2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/supabase2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/teamcity2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/travis-ci2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/integrations/platforms/vercel2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/apps2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/dynamic-secrets2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/environments2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/errors2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/external-identities2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/invites2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/members2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/roles2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/secrets2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/service-accounts2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/public-api/teams2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/quickstart2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/sdks2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/sdks/go2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/sdks/js2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/sdks/node2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/sdks/python2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/security2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/security/architecture2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/security/cryptography2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/aws2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/aws-eks2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/azure2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/azure-aks2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/configuration/envars2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/digitalocean2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/docker-compose2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/gcp2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/kubernetes2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/maintenance2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/railway2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/raspberrypi2026-09-12T12:19:08.995Zdaily0.7 -https://docs.phase.dev/self-hosting/tailscale2026-09-12T12:19:08.995Zdaily0.7 +https://docs.phase.dev2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control/authentication2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control/authentication/account2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control/authentication/mfa2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control/authentication/oauth-sso2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control/authentication/oidc-sso2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control/authentication/password2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control/authentication/sso2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control/authentication/tokens2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control/external-identities2026-09-15T09:48:23.733Zdaily0.7 +https://docs.phase.dev/access-control/network2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/access-control/provisioning/scim2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/access-control/roles2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/access-control/service-accounts2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/access-control/teams2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/cli2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/cli/commands2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/cli/install2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/cli/usage2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/console2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/console/apps2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/console/dynamic-secrets2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/console/environments2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/console/logstreams2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/console/organisation2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/console/rotating-secrets2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/console/secrets2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/console/users2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/agents/claude-code2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/agents/codex2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/agents/cursor2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/agents/opencode2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/agents/vscode-copilot2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/frameworks2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/aws-codebuild2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/aws-elastic-container-service2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/aws-iam2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/aws-secrets-manager2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/azure-key-vault2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/azure-pipelines2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/bitbucket-pipelines2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/buildkite2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/circleci2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/cloudflare-pages2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/cloudflare-workers2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/docker2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/docker-compose2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/drone-ci2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/github-actions2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/github-dependabot2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/gitlab-ci2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/hashicorp-nomad2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/hashicorp-terraform2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/hashicorp-vault2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/jenkins2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/jetbrains2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/kubernetes2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/litellm2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/openai2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/railway2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/render2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/supabase2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/teamcity2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/travis-ci2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/integrations/platforms/vercel2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/apps2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/dynamic-secrets2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/environments2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/errors2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/external-identities2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/invites2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/members2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/roles2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/secrets2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/service-accounts2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/public-api/teams2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/quickstart2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/sdks2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/sdks/go2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/sdks/js2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/sdks/node2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/sdks/python2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/security2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/security/architecture2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/security/cryptography2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/aws2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/aws-eks2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/azure2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/azure-aks2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/configuration/envars2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/digitalocean2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/docker-compose2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/gcp2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/kubernetes2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/maintenance2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/railway2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/raspberrypi2026-09-15T09:48:23.734Zdaily0.7 +https://docs.phase.dev/self-hosting/tailscale2026-09-15T09:48:23.734Zdaily0.7 \ No newline at end of file