Permissions

The access rights that control which resources a user can read from or write to.

Permissions are assigned through roles: you add permissions to a role, then assign that role to users. Each permission targets a single resource — an MQTT topic or an HTTP endpoint — and grants read, write, or read/write access.

To create or modify permissions, see Roles.

Permission Types

Connectware supports the following permission types:

Type	Controls access to	Example resource path
MQTT	MQTT topics on CybusMQ	services/myservice/temperature
HTTP	REST API endpoints	/api/services

MQTT Permission Syntax

MQTT permissions follow standard MQTT topic syntax. A resource path identifies the topic or topic pattern the permission applies to.

The rules are:

• Paths are case-sensitive.

• Wildcards are supported: + matches a single level, # matches all remaining levels.

• The # wildcard must always be the last character in a path.

For example:

Path	Matches
services/myservice/temperature	Exactly that topic
services/myservice/+	Any single-level topic under services/myservice/
services/myservice/#	All topics under services/myservice/ at any depth
#	All topics (use with caution)

HTTP Permission Syntax

HTTP permissions follow the same MQTT topic syntax conventions, including wildcard support. Paths must start with a leading slash (/).

For example:

Path	Matches
/api/services	Exactly that endpoint
/api/services/+	Any single-level path under /api/services/
/api/#	All API endpoints

Access Levels

Each permission has one of the following access levels:

Access level	Read	Write
read	Yes	No
write	No	Yes
read/write	Yes	Yes

For MQTT topics, read means subscribe and write means publish.

How Permissions Are Evaluated

Connectware uses an allow-only model: access is denied unless a matching permission explicitly grants it. There are no deny rules.

If a user has multiple roles, permissions from all roles are combined. A user with read access through one role and write access through another role ends up with effective read/write access on that resource.

Permissions assigned directly to a user are combined with their role permissions in the same way.

Broad wildcard permissions, such as #, grant access to everything, including system topics. Use them only for administrative roles.

Viewing All Permissions

The Permissions View gives you a system-wide overview of every permission configured in Connectware, which roles and users hold each permission, and what access level each grants. This is useful for auditing your access control structure.

• To open the Permissions View, click User in the navigation panel, then click the Permissions tab.

Permissions overview

Clicking any permission in the list opens the Permission Details dialog, which shows:

• The complete resource path

• The permission type (MQTT or HTTP)

• The access level (read, write, or read/write)

• All users who have this permission assigned directly

• All roles that include this permission

Permission Details dialog

Permissions cannot be edited from this view. To create, modify, or delete permissions, open the relevant role in the Roles View or the relevant user in the Users View.