This page lists the IAM roles and permissions for Service Extensions. To
search through all roles and permissions, see the [role and
permission index](https://docs.cloud.google.com/iam/docs/roles-permissions).

## Service Extensions roles

| Role | Permissions |
|---|---|
| #### Service Extensions Admin ^Beta^ (`roles/serviceextensions.admin`) Grants full access to Service Extensions resources. | `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceextensions.*` - `serviceextensions.callouts.invoke` - `serviceextensions.locations.get` - `serviceextensions.locations.list` |
| #### Service Extensions Editor ^Beta^ (`roles/serviceextensions.editor`) Grants access to edit Service Extensions resources. | `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceextensions.*` - `serviceextensions.callouts.invoke` - `serviceextensions.locations.get` - `serviceextensions.locations.list` |
| #### Service Extensions Viewer ^Beta^ (`roles/serviceextensions.viewer`) Grants read access to Service Extensions resources. | `resourcemanager.projects.get` `resourcemanager.projects.list` `serviceextensions.locations.*` - `serviceextensions.locations.get` - `serviceextensions.locations.list` |

### Service agent roles


Service agent roles should only be granted to [service agents](https://docs.cloud.google.com/iam/docs/service-agents.md.txt).

| Role | Permissions |
|---|---|
| #### Network Actions Service Agent (`roles/networkactions.serviceAgent`) Gives Network Actions service account access to read required resources. > [!WARNING] > **Warning:** Do not grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents.md.txt). | `artifactregistry.files.download` `artifactregistry.repositories.downloadArtifacts` |

## Service Extensions permissions

| Permission | Included in roles |
|---|---|
| #### `serviceextensions.callouts.invoke` | [Admin](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/admin`) [Owner (Legacy)](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/owner`) [Writer](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/writer`) [Editor (Legacy)](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/editor`) [Service Extensions Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceextensions.md.txt#serviceextensions.admin) (`roles/serviceextensions.admin`) [Service Extensions Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceextensions.md.txt#serviceextensions.editor) (`roles/serviceextensions.editor`) Service agent roles > [!WARNING] > **Warning:** Don't grant service agent roles to any principals except [service agents](https://docs.cloud.google.com/iam/docs/service-agents.md.txt). - [Discovery Engine Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/discoveryengine.md.txt#discoveryengine.serviceAgent) (`roles/discoveryengine.serviceAgent`) |
| #### `serviceextensions.locations.get` | [Admin](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/admin`) [Owner (Legacy)](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/owner`) [Writer](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/writer`) [Editor (Legacy)](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/editor`) [Reader](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/reader`) [Viewer (Legacy)](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/viewer`) [Service Extensions Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceextensions.md.txt#serviceextensions.admin) (`roles/serviceextensions.admin`) [Service Extensions Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceextensions.md.txt#serviceextensions.editor) (`roles/serviceextensions.editor`) [Service Extensions Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceextensions.md.txt#serviceextensions.viewer) (`roles/serviceextensions.viewer`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions.md.txt#iam.supportUser) (`roles/iam.supportUser`) |
| #### `serviceextensions.locations.list` | [Admin](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/admin`) [Owner (Legacy)](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/owner`) [Writer](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/writer`) [Editor (Legacy)](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/editor`) [Reader](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/reader`) [Viewer (Legacy)](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic) (`roles/viewer`) [Security Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/iam.md.txt#iam.securityAdmin) (`roles/iam.securityAdmin`) [Security Reviewer](https://docs.cloud.google.com/iam/docs/roles-permissions/iam.md.txt#iam.securityReviewer) (`roles/iam.securityReviewer`) [Service Extensions Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceextensions.md.txt#serviceextensions.admin) (`roles/serviceextensions.admin`) [Service Extensions Editor](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceextensions.md.txt#serviceextensions.editor) (`roles/serviceextensions.editor`) [Service Extensions Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/serviceextensions.md.txt#serviceextensions.viewer) (`roles/serviceextensions.viewer`) [Security Auditor](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions.md.txt#iam.securityAuditor) (`roles/iam.securityAuditor`) [Support User](https://docs.cloud.google.com/iam/docs/roles-permissions/jobfunctions.md.txt#iam.supportUser) (`roles/iam.supportUser`) |