Comment on page

App Permission System

Each feature available in the Apps-Engine is mapped to a permission. Adding the permission in the app's manifest (app.json file) will unlock said feature to be used by the app. For example, if you add the send messages permission to your app's manifest, your app can send messages in the Rocket.Chat server. If your app tries to send a message without having the send messages permission listed in the manifest, Apps-Engine will block the feature and the app will not be able to perform the desired action.
When installing an app, be it via the Marketplace or installing it manually via zip file, a window asks the user to review the permissions that the app requires to work properly. The user installing the app can either accept and install the app or deny the permissions and not install it.

Add permissions to your app

In your app's manifest file (app.json), add the field permissions. It receives a list containing all the permissions that you are asking for. For example:
"permissions": [
"name": ""
"name": "user.write"
"name": ""

Notice about rule enforcement

Currently, the Apps-Engine does not enforce the use of the permissions to make your apps work, meaning your current apps (including those published on the Marketplace) will still work as expected. All the apps that do not have the permissions listed in their manifest will still have access to all the features they need through default permissions. They are applied to your app automatically when no permissions property is found in the app's manifest.
Until the sunsetting period for the "permissionless engine" is not defined, setting permissions in your app's manifest will be optional.

List of permissions

Here is a list of the available permissions:
Permission Name
Access user information
Modify user information
Access files uploaded to the server
Upload files to the server
Access settings in the server
Modify settings in the server
Access room information
Create and modify rooms
Access messages
Send and modify messages
Access Livechat status information
Modify Livechat custom field configuration
Access Livechat visitor information
Modify Livechat visitor information
Access Livechat message information
Modify Livechat message information
Access Livechat room information
Modify Livechat room information
Access Livechat department information
Modify Livechat department information
Register new slash commands
Register new HTTP endpoints
Access minimal information about the server environment
Access to the server network
Store internal data in the database
Register and maintain scheduled jobs
Interact with the UI (UIKit)
Once an app is on the Rocket.Chat workspace, it goes through several lifecycle phases unique to Rocket.Chat. The phases depend on the capabilities that your app has. To learn about the app lifecycle, head over to the next page.
Last modified 13d ago
Deprecation for cloud services and apps is now extended to November 20, 2023. Rocket.Chat versions receive support for six months after release.