---
title: Privilege Reference
url: https://docs.kaltura.com/docs/getting-started/authentication/app-tokens-privileges
---

## Privilege Reference

These privileges can be set on the AppToken (`sessionPrivileges`) or passed at `startSession` time.

### Access Control Privileges

| Privilege | Description |
|-----------|-------------|
| `sview:*` | View/play all entries |
| `sview:<entryId>` | View/play a specific entry only |
| `list:*` | List entries across all owners |
| `edit:*` | Edit any entry |
| `edit:<entryId>` | Edit a specific entry only |
| `download:<entryId>` | Download a specific entry |
| `enableentitlement` | Enable entitlement checks |
| `disableentitlement` | Disable entitlement checks (limit to admin-only backend operations) |
| `privacycontext:<label>` | Scope to a specific privacy context |

### Session Control Privileges

| Privilege | Description |
|-----------|-------------|
| `setrole:<roleId>` | Restrict to a specific user role |
| `actionslimit:&lt;N&gt;` | Max number of API calls this session can make |
| `iprestrict:&lt;IP&gt;` | Restrict session to a specific IP address |
| `urirestrict:<path>` | Restrict session to specific API paths |
| `sessionid:&lt;GUID&gt;` | Group sessions for bulk revocation |
| `appId:<name-domain>` | Tag session for analytics tracking |

### Common Privilege Sets

```
# Read-only playback (with entitlements)
sview:*,enableentitlement,privacycontext:MY_PORTAL

# Upload integration (scoped to user's own content)
edit:*,sview:*

# Single-entry playback ticket
sview:1_abc123,setrole:PLAYBACK_BASE_ROLE,actionslimit:10

# Analytics-tagged integration
sview:*,list:*,appId:my-app-example.com
```