Granular Permissions Free

Control who can view, deploy, manage, and delete resources at the project and environment level — with optional per-environment overrides.

Overview

By default, Coolify grants all team members full access to every project. Granular Permissions replaces this with a fine-grained access control system:

• Assign permission levels per user per project
• Optionally override permissions for specific environments (e.g., restrict production while keeping staging open)
• Owners and Admins always bypass all permission checks

Permission Levels

Level	View	Deploy	Manage	Delete
view_only	Yes	—	—	—
deploy	Yes	Yes	—	—
full_access	Yes	Yes	Yes	Yes

• View: See resources, logs, and configuration
• Deploy: Trigger deployments and restarts
• Manage: Edit resource settings, environment variables, and domains
• Delete: Remove resources permanently

Role Bypass

Team members with the Owner or Admin role bypass all permission checks and always have full access. Permission levels only apply to Member and Viewer roles.

How Permissions Cascade

Permissions flow from project level down to environment level:

Project Permission (project_user)
    └── Environment Override (environment_user) — optional

1. A user is granted a permission level on a project (e.g., deploy)
2. That permission applies to all environments within the project by default
3. An environment override can restrict or expand access for a specific environment

Example: A developer has full_access to the "Marketing Site" project. You can add a view_only override on the "production" environment so they can deploy to staging but only view production.

Enabling Granular Permissions

Granular Permissions is enabled by default when Corelix is installed. To verify or toggle:

CORELIX_PLATFORM=true

When disabled, Coolify's default behavior is restored — all team members have full access to everything.

Using the Access Matrix

The Access Matrix is the primary UI for managing permissions. To access it:

1. Navigate to Team in the sidebar
2. Click the Admin tab
3. The Access Matrix section shows a grid of users and projects/environments

Setting Project Permissions

Each cell in the matrix shows the current permission level for a user on a project. Click the dropdown to change it:

• No access — user cannot see or interact with the project
• View Only — read-only access
• Deploy — can trigger deployments
• Full Access — complete control

Adding Environment Overrides

To override a user's project-level permission for a specific environment:

1. Expand the project row to reveal its environments
2. Each environment cell shows "Inherited" by default (using the project-level permission)
3. Click the dropdown and select a different permission level
4. The environment override now takes precedence

To remove an override and revert to the project-level permission, set the environment cell back to "Inherited".

Bulk Operations

• Set all users on a project to the same level using the column header dropdown
• Set all projects for a user to the same level using the row header dropdown

API

Permissions can also be managed via the REST API. All endpoints require Bearer token authentication.

Project Permissions

# List all project permissions
curl -H "Authorization: Bearer $TOKEN" \
  https://coolify.example.com/api/v1/permissions/project

# Grant access
curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"project_uuid":"abc123","user_id":5,"permission_level":"deploy"}' \
  https://coolify.example.com/api/v1/permissions/project

# Update permission level
curl -X PUT -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"permission_level":"full_access"}' \
  https://coolify.example.com/api/v1/permissions/project/1

# Revoke access
curl -X DELETE -H "Authorization: Bearer $TOKEN" \
  https://coolify.example.com/api/v1/permissions/project/1

Environment Overrides

# Create override
curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"environment_id":10,"user_id":5,"permission_level":"view_only"}' \
  https://coolify.example.com/api/v1/permissions/environment

# Remove override (reverts to project-level)
curl -X DELETE -H "Authorization: Bearer $TOKEN" \
  https://coolify.example.com/api/v1/permissions/environment/1

Bulk Operations

# Grant access to all team members
curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"project_uuid":"abc123","permission_level":"view_only"}' \
  https://coolify.example.com/api/v1/permissions/project/bulk

# Revoke all access from a project
curl -X DELETE -H "Authorization: Bearer $TOKEN" \
  https://coolify.example.com/api/v1/permissions/project/bulk/abc123

Troubleshooting

Permissions not being enforced

1. Verify the feature is enabled: CORELIX_PLATFORM=true in your environment
2. Check the user's team role — Owners and Admins bypass all checks
3. Clear the application cache: php artisan cache:clear

Environment override not working

1. Confirm the override exists in the Access Matrix (should not show "Inherited")
2. The override is checked first — if it exists, the project-level permission is ignored for that environment

Access Matrix not visible

The Access Matrix only appears for users with the Owner or Admin team role. Regular members cannot manage permissions.