Permissions

UmbSocial’s permissions live on Umbraco user groups, like core’s own permissions. They are not in Social’s settings. Set them in Users › User groups › (group): give the group the Social section under Sections, then turn on the permissions it needs in the Social box (under Posts and publishing) further down the page.

A user needs two things for any Social action:

1. access to the Social section (section alias UmbSocial.Section), and
2. the permission (verb) for the action.

They can come from different groups: a user in one group with the section and another group with the verb is allowed.

The permissions

Permission	Lets the group
UmbSocial.View	See posts, channels and the posting schedule.
UmbSocial.Write	Write posts, and edit or delete your own drafts. Check a post against its channels’ limits.
UmbSocial.Schedule	Put posts in the queue, schedule them for a time, or publish them now (together with Write). Edit or delete anyone’s post.
UmbSocial.Approve	Approve, edit or return posts submitted for approval and AI drafts. Pro.
UmbSocial.UseAi	Draft with Claude, rewrite, and suggest alt text. Pro.
UmbSocial.Resolve	Retry a failed or unknown post on a channel, or mark it as published.
UmbSocial.ManageSettings	Add, change and remove channels, see the available networks, and change the posting schedule and time zone.

Writing a draft needs only Write. Saving a post with any other timing (queue, a specific time, now) needs Write and Schedule. Without Schedule, the request is refused.

Approve and UseAi are used by the paid packages. On the free edition, no action asks for them.

What users see

The backoffice shows each page and action only to users who can use it, and a page opened by its address shows nothing without its permission.

Page or action	Needs
Queue, Calendar, Published	View
Compose, with Save draft only (a notification says someone with Schedule publishes drafts)	Write
Editing or deleting a post that is your own draft	Write
Editing or deleting anyone else’s post, or one that is scheduled or published	Schedule
Compose’s When choices, and the queue’s free slots (Empty slot. Add a post)	Write and Schedule
Moving a post on the calendar	Schedule
Retry, Mark as published on the Published page	Resolve
Settings › Social (Connections, Schedule & writing, Licence)	Manage settings, and access to Umbraco’s Settings section

Social’s settings pages are in Umbraco’s own Settings section, so a group that manages Social’s settings needs that section too.

Defaults on install

When UmbSocial is installed, the Administrators group is given the Social section and every Social permission. No other group is changed: give editors access yourself.

Because the permissions are stored on the user group with core’s permissions, tools that synchronise user groups (such as uSync) carry them too.

The management API

Every endpoint has an authorisation policy that needs the section and one verb. The policy names are UmbSocialPolicy.<Verb>, for example UmbSocialPolicy.Schedule. They are available as constants in UmbSocial.Core.Permissions.SocialPolicies, and the verbs in SocialPermissions, so your own controllers can use them:

MySocialReportController.cs

using Asp.Versioning;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using UmbSocial.Core.Permissions;
using Umbraco.Cms.Api.Management.Controllers;
using Umbraco.Cms.Api.Management.Routing;

[ApiVersion("1.0")]
[VersionedApiBackOfficeRoute("my-social-report")]
public class MySocialReportController : ManagementApiControllerBase
{
    [HttpGet]
    [Authorize(Policy = SocialPolicies.View)]
    public IActionResult Get() => Ok();
}

Only backoffice users can be authorised. Members and other principals are always refused. The permission each endpoint needs is in the Management API reference.