Capabilities

A capability is a Chat permission such as messages.send. A tenant maps capabilities to its roles in Chat Administration, separately for each application. A capability says which kind of operation a user may perform, never with whom. See Chat permissions.

Capability	What it unlocks	Machine scopes that carry it
conversations.create	Start a conversation. Direct conversations need only this; groups and channels also need their own create permission.	chat:sync, chat:conversations.manage
conversations.read	List and open conversations the caller belongs to, and PUBLIC channels.	chat:sync, chat:conversations.read
conversations.update	Rename a group or channel, change its description or visibility, archive or reactivate a conversation.	chat:sync, chat:conversations.manage
conversations.delete	Delete a conversation (soft delete).
groups.create	Create group conversations, and add members to a group the caller owns.	chat:sync, chat:groups.manage
groups.manage	Manage any group: members, name, description.	chat:sync, chat:groups.manage
channels.create	Create channels.	chat:sync, chat:channels.manage
channels.manage	Manage any channel: members, name, description, visibility.	chat:sync, chat:channels.manage
messages.send	Send messages, including replies and mentions.	chat:sync, chat:messages.send
messages.read	Read messages. Also needed for reactions, read state and typing.	chat:sync, chat:conversations.read
messages.update	Edit and delete the caller's own messages.
messages.delete	Moderate messages: delete and edit other members' messages. Never granted to machines.	Never available to machines
users.lookup	Search the tenant members Chat already knows.	chat:sync, chat:users.lookup
users.lookup.directory	Search the whole tenant directory at the Identity Server. Never granted to machines.	Never available to machines
attachments.upload	Attach files to messages.
attachments.download	Download attachments.
administration.read	Open Chat Administration and read its data. Never granted to machines.	Never available to machines
administration.manage	Change Chat Administration: role permissions, settings, moderation. Never granted to machines.	Never available to machines

Each operation in the API reference lists the capabilities it needs, and the OpenAPI document carries them as x-required-capabilities.

Four capabilities are never available to a machine client, whatever scopes it holds: messages.delete, users.lookup.directory, administration.read and administration.manage. See Scopes.