---
lang: en
title: 'API docs: security.permission'
keywords: LoopBack 4.0, LoopBack 4, Node.js, TypeScript, OpenAPI
sidebar: lb4_sidebar
editurl: https://github.com/loopbackio/loopback-next/tree/master/packages/security
permalink: /doc/en/lb4/apidocs.security.permission.html
---

<!-- Do not edit this file. It is automatically generated by API Documenter. -->

[Home](./index.md) &gt; [@loopback/security](./security.md) &gt; [Permission](./security.permission.md)

## Permission class

`Permission` defines an action/access against a protected resource. It's the `what` for security.

There are three levels of permissions

- Resource level (Order, User) - Instance level (Order-0001, User-1001) - Property level (User-0001.email)

**Signature:**

```typescript
export declare class Permission 
```

## Example

- create a user (action: create, resource type: user) - read email of a user (action: read, resource property: user.email) - change email of a user (action: update, resource property: user.email) - cancel an order (action: delete, resource type: order)

## Properties

<table><thead><tr><th>

Property


</th><th>

Modifiers


</th><th>

Type


</th><th>

Description


</th></tr></thead>
<tbody><tr><td markdown="1">

[\[securityId\]](./security.permission._securityid_.md)


</td><td markdown="1">

`readonly`


</td><td markdown="1">

string


</td><td markdown="1">


</td></tr>
<tr><td markdown="1">

[action](./security.permission.action.md)


</td><td markdown="1">


</td><td markdown="1">

string


</td><td markdown="1">

Action or access of a protected resources, such as `read`<!-- -->, `create`<!-- -->, `update`<!-- -->, or `delete`


</td></tr>
<tr><td markdown="1">

[resourceId?](./security.permission.resourceid.md)


</td><td markdown="1">


</td><td markdown="1">

string


</td><td markdown="1">

_(Optional)_ Identity of a protected resource instance, such as `order-0001` or `customer-101`


</td></tr>
<tr><td markdown="1">

[resourceProperty?](./security.permission.resourceproperty.md)


</td><td markdown="1">


</td><td markdown="1">

string


</td><td markdown="1">

_(Optional)_ Property of a protected resource type/instance, such as `email`


</td></tr>
<tr><td markdown="1">

[resourceType](./security.permission.resourcetype.md)


</td><td markdown="1">


</td><td markdown="1">

string


</td><td markdown="1">

Type of protected resource, such as `Order` or `Customer`


</td></tr>
</tbody></table>