Proxmox VE Permissions
cv4pve-admin connects to Proxmox VE through the API. The permissions it needs depend on the modules and features you use.
Recommended: PVEAdmin role
Section titled “Recommended: PVEAdmin role”The simplest and recommended setup is to assign the built-in PVEAdmin role at path / to the Proxmox VE user or API token used by cv4pve-admin.
With this role every module has full functionality, with no further configuration.
Automatic API Token Creation: cv4pve-admin can create a dedicated Proxmox VE user and API token for you automatically. Learn more
Minimum permissions
Section titled “Minimum permissions”If you prefer a least-privilege setup, assign a custom Proxmox VE role at path / with only the permissions required for the features you use.
Base (required for all modules)
Section titled “Base (required for all modules)”These are the privileges of the built-in PVEAuditor role on Proxmox VE 9. Assigning that role is equivalent and simpler.
| Privilege | Purpose |
|---|---|
Sys.Audit |
Cluster status, node info, tasks, firewall, HA |
VM.Audit |
VM/CT list, status, config |
VM.GuestAgent.Audit |
Information read through the QEMU Guest Agent (host name, IP addresses) |
Datastore.Audit |
Storage list, status, content |
Pool.Audit |
Resource pool list |
SDN.Audit |
SDN zones, VNets, subnets |
Mapping.Audit |
Resource mappings |
This page describes Proxmox VE 9. Earlier releases use other privileges for some reads, for example VM.Monitor for the QEMU Guest Agent and the monitor: on those releases assign PVEAdmin, or check the privileges in the Proxmox VE documentation.
How cv4pve-admin checks the privileges
Section titled “How cv4pve-admin checks the privileges”Before enabling an action on a VM/CT or on a node, cv4pve-admin reads the permissions of the Proxmox VE user or API token configured for the cluster. It then checks that the user or token holds the matching privilege. The privilege is accepted when it is granted on the object itself (/vms/<vmid> or /nodes/<node>), on /vms or /nodes, or on /. When it is missing, the button or tab is not available, even if the cv4pve-admin user has the application permission.
| cv4pve-admin permission | Proxmox VE privilege |
|---|---|
| VM: Audit | VM.Audit |
| VM: Console | VM.Console |
| VM: Power Management | VM.PowerMgmt |
| VM: Snapshot manager | VM.Snapshot |
| VM: Snapshot Rollback | VM.Snapshot.Rollback |
| VM: Replication manager, Replication Schedule Now | VM.Replicate |
| VM: Backup manager | VM.Backup |
| VM: Backup Restore, Backup Restore File | Datastore.AllocateSpace |
| VM: Migrate | VM.Migrate |
| VM: Clone | VM.Clone |
| VM: Resize disk | VM.Config.Disk |
| VM: Convert to template | VM.Allocate |
| VM: High Availability | Sys.Console |
| Node: Audit | Sys.Audit |
| Node: Console | Sys.Console |
| Node: Power Management | Sys.PowerMgmt |
| Node: Replication manager, Replication Schedule Now | VM.Replicate |
| Storage: Delete Content | Datastore.Allocate |
The same checks apply in every module that offers these actions (Dashboard, Resources, Portal, Command Palette, AI Server, Workflow). In the web interface, migration and deletion of storage content are not available: they are used by AI Server tools and, for migration, by the Workflow activity. Clone, Resize disk, Convert to template and High Availability are used only by the Workflow activities, and among the built-in roles only Cluster.Admin (Cluster Admin User) includes them. A workflow runs its actions as the built-in system user.
Privileges by module
Section titled “Privileges by module”What each module needs beyond the base. None means the base is enough. The page of each module says what each privilege is used for and what happens without it: click the name of the module.
| Module | Beyond the base |
|---|---|
| AI Server | By tool: see the list |
| AutoSnap | VM.Snapshot |
| Backup Analytics | VM.Backup, Datastore.AllocateSpace |
| Bots | VM.PowerMgmt, Sys.PowerMgmt |
| Command Palette | VM.PowerMgmt, VM.Console, VM.Snapshot |
| Dashboard | By action: see Actions on guests and nodes |
| Diagnostics | Sys.Modify, VM.Backup, Datastore.AllocateSpace |
| Metrics Exporter | None. |
| Node Protect | None. It works over SSH. |
| Portal | By action: see Actions on guests and nodes |
| Replication Analytics | None. |
| Resources | By action: see Actions on guests and nodes |
| System Report | Sys.Modify, Sys.Syslog, VM.Console, VM.Backup, Datastore.AllocateSpace, VM.Config.Disk |
| Update Manager | None. It works over SSH. |
| UPS Monitor | None. It reads the UPS over SNMP. |
| VM Performance | None. |
| Workflow | By activity: see the list |
Backup files
Section titled “Backup files”Proxmox VE lists a backup file only to an account that has both VM.Backup on the guest and Datastore.AllocateSpace on the storage. Without them the list of backups is empty, with no error. This is why Backup Analytics, the Backups tab of a guest, the backup checks of Diagnostics and the backup sections of System Report need these two privileges only to read.
Actions on guests and nodes
Section titled “Actions on guests and nodes”Dashboard, Resources and Portal offer these actions. Each privilege is needed only for its action.
| Privilege | Used for |
|---|---|
VM.PowerMgmt | Start, stop, shutdown, reboot, reset, suspend, resume a guest |
VM.Console | Guest console |
VM.Snapshot | Create, edit, delete a snapshot |
VM.Snapshot.Rollback | Roll back a snapshot |
VM.Replicate | Replication: Schedule Now |
VM.Backup, Datastore.AllocateSpace | Backups tab: list, configuration and deletion of backups |
Sys.Console | Node console |
Sys.PowerMgmt | Shut down, reboot a node |
Example: monitoring + AutoSnap custom role
Section titled “Example: monitoring + AutoSnap custom role”Sys.AuditVM.AuditVM.GuestAgent.AuditVM.SnapshotDatastore.AuditPool.AuditSDN.AuditMapping.AuditAssign the role at path / to the Proxmox VE user or API token used by cv4pve-admin.
On Proxmox VE 8 and earlier add Pool.Allocate if AutoSnap jobs select guests by pool.
A feature that lacks a required privilege shows errors or empty data. The other features keep working normally.
