Permissions
The nine permissions of a connection, the presets, and which tools need which permission.
Every connection has permissions. Read & diagnostics is always on; add only what the app needs for the job. You choose them when you create the connection (or when you allow an app that signs in), and you can change them later in PowerWP AI › Connections.
The permissions#
| Permission | What it allows |
|---|---|
| Read & diagnostics | Site and server info, logs, health checks, files (secrets redacted), SELECT queries, content, options and WooCommerce data. Always granted. |
| Content & store data | Create, edit and delete posts, pages, products, orders, terms and media, WordPress REST writes and Elementor's page abilities. |
| Settings & maintenance | Change options, flush caches, manage cron, maintenance mode, debug mode, WooCommerce tools and other WordPress abilities that make changes. |
| Files | Write, edit, move, delete, upload and extract files. This allows code changes, so treat it like developer access. |
| Database writes | Run write SQL (with automatic row and table snapshots), search and replace, and database clean-ups. |
| Plugins & themes | Install, activate, deactivate, update and delete plugins and themes. |
| Users | Create, edit and delete users and change roles. |
| Backups & restore | Create and download full backups and restore them. |
| Secrets | Reveal secrets (wp-config credentials, API keys, password hashes) and edit wp-config.php and .htaccess. |
Presets#
Presets are ready-made sets of permissions. Pick one, then add or remove single permissions if you need to.
| Preset | For | Permissions |
|---|---|---|
| Read-only diagnostics | Investigate problems without changing anything. | Read & diagnostics |
| Content manager | Edit content and store data. | Read & diagnostics, Content & store data |
| Developer | Content, settings, files, database, plugins and backups, without secrets or user accounts. | Read & diagnostics, Content & store data, Settings & maintenance, Files, Database writes, Plugins & themes, Backups & restore |
| Full access | Everything, including secrets and user accounts. | Read & diagnostics, Content & store data, Settings & maintenance, Files, Database writes, Plugins & themes, Users, Backups & restore, Secrets |
On the Free plan every connection can only read: new connections get Read-only diagnostics, and AI apps are told the site is on the Free plan.
When a permission is missing#
If your app tries something its connection may not do, PowerWP AI refuses the call and names the permission it needs (required_scope). Nothing is changed. Add the permission to the connection, or ask the app to do the job another way.
Tools by permission#
Read & diagnostics#
abilities_list ability_run change_details changes_list changes_rollback checkpoint_create content_get content_query elementor_outline terms_query db_describe db_query db_tables audit_log cron_events error_log_read hooks_inspect integrity_check rescue_mode security_scan plugins_list themes_list updates_check fs_find fs_list fs_read fs_search fs_stat fs_transfer_link memory_list recipe_get recipes_list rest_request rest_routes maintenance_mode option_get http_request page_check server_info site_health site_overview users_list wc_order_inspect wc_overview wc_product_inspect wc_scheduled_actions wc_status wc_tools
Content & store data#
content_create content_delete content_update elementor_edit media_import term_manage memory_save recipe_save
Also needed for parts of: ability_run rest_request
Settings & maintenance#
cron_manage debug_mode cache_flush option_delete option_update wc_scheduled_action_manage
Also needed for parts of: ability_run rescue_mode maintenance_mode wc_tools http_request page_check
Files#
archive_create archive_extract fs_copy fs_delete fs_edit fs_mkdir fs_move fs_write
Also needed for parts of: fs_transfer_link
Database writes#
db_cleanup db_execute db_search_replace
Plugins & themes#
Users#
Also needed for parts of: option_update
Backups & restore#
backup_confirm_downloaded backup_create backup_delete backup_download_links backups_list job_cancel job_status restore_prepare restore_start
Secrets#
Also needed for parts of: rest_request http_request fs_read fs_write fs_edit fs_transfer_link option_update error_log_read archive_extract