> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Notifications permissions

> IAM actions for the Notifications API and the additional grants used across services.

Publishing, subscription management, and signing-secret access use separate IAM actions. Email and webhook confirmation endpoints use their confirmation tokens instead of an IAM action.

## Actions

The endpoint reference describes request fields and responses. This table maps each call to its IAM action.

| Call | Required action |
| - | - |
| `GET /v1/topics` | `notifications:ListTopics` |
| `POST /v1/topics` | `notifications:CreateTopic` |
| `GET /v1/topics/{topic_id}` | `notifications:DescribeTopic` |
| `PATCH /v1/topics/{topic_id}` | `notifications:UpdateTopic` |
| `DELETE /v1/topics/{topic_id}` | `notifications:DeleteTopic` |
| `GET /v1/topics/{topic_id}/policy` | `notifications:GetTopicPolicy` |
| `PUT /v1/topics/{topic_id}/policy` | `notifications:PutTopicPolicy` |
| `DELETE /v1/topics/{topic_id}/policy` | `notifications:DeleteTopicPolicy` |
| `POST /v1/topics/{topic_id}/publish` | `notifications:Publish` |
| `POST /v1/topics/{topic_id}/publish-batch` | `notifications:Publish` |
| `GET /v1/topics/{topic_id}/subscriptions` | `notifications:ListSubscriptions` |
| `POST /v1/topics/{topic_id}/subscriptions` | `notifications:Subscribe` |
| `GET /v1/topics/{topic_id}/subscriptions/{subscription_id}` | `notifications:DescribeSubscription` |
| `PATCH /v1/topics/{topic_id}/subscriptions/{subscription_id}` | `notifications:UpdateSubscription` |
| `DELETE /v1/topics/{topic_id}/subscriptions/{subscription_id}` | `notifications:Unsubscribe` |
| `POST /v1/topics/{topic_id}/subscriptions/{subscription_id}/resend-confirmation` | `notifications:ResendConfirmation` |
| `GET /v1/topics/{topic_id}/subscriptions/{subscription_id}/signing-secret` | `notifications:GetSubscriptionSigningSecret` |
| `POST /v1/topics/{topic_id}/subscriptions/{subscription_id}/signing-secret/rotate` | `notifications:RotateSubscriptionSigningSecret` |
| `GET /v1/topics/{topic_id}/messages` | `notifications:ListMessages` |
| `GET /v1/topics/{topic_id}/messages/{message_id}` | `notifications:DescribeMessage` |
| `GET /v1/topics/{topic_id}/deliveries` | `notifications:ListDeliveries` |

Message and delivery reads authorize against the parent topic and its tags.
Metrics use `telemetry:ReadMetrics` in the selected account and region.

## Cross-service permissions

Subscribing a queue requires `notifications:Subscribe` on the topic and
`queue:SendMessage` on the destination queue. The queue must belong to the
same account and region. A dead-letter queue also requires
`queue:SendMessage`; updating a subscription to use a new dead-letter queue
checks that grant again.

## Signing secrets

`notifications:DescribeSubscription` returns subscription metadata.
`notifications:GetSubscriptionSigningSecret` reads the webhook signing
secret, and `notifications:RotateSubscriptionSigningSecret` rotates it.
Grant these independently.

## Example policy

This policy grants only the listed collection reads. It does not grant permission to send messages or manage resources.

```json theme={null}
{
  "version": "2024-01-01",
  "statements": [
    {
      "effect": "allow",
      "actions": [
        "notifications:ListTopics",
        "notifications:ListSubscriptions"
      ],
      "resources": [
        "*"
      ]
    }
  ]
}
```

See [IAM policies](/iam/policies) for policy evaluation and [Notifications](/notifications) for the service overview.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.