Genesys Cloud permissions by operation family
Exact Genesys permissions vary by tenant role design. GenEmails does not use elevated credentials for user actions; all user-initiated operations use the signed-in user's OAuth token.
| Operation family | Genesys permission category | Used by |
|---|---|---|
| Queue and user lookup | Routing queue and user read permissions plus division visibility. | Mailbox Management, queue mode, assignment eligibility, and mapping validation. |
| Email domain and route inspection | Email domain and route read permissions. | Domain Inspector and mailbox-to-queue diagnostics. |
| Conversation assignment and transfer | Conversation assign, participant replace queue, transfer, and attribute update permissions. | Assign to Me, Assign to Agent, Assign to Skill, Send to Review Queue, Move To SPAM, and Return to Original Queue. |
| Conversation disconnect | Conversation disconnect permission. | Disconnect and final SPAM confirmation after successful table write. |
| Data Table read | Architect Data Table and Data Table Row read or view permissions. | Spam Management list or search and SPAM table validation. |
| Data Table add or update | Architect Data Table Row add or edit permissions. | SPAM confirmation and Spam Management Add Entry when GenEmails allows Spam Table Write. |
| Data Table delete | Architect Data Table Row delete permission. | Spam Management row delete when GenEmails allows Spam Table Delete. |
Notes: Keep division scoping aligned with the queues, users, conversations, and SPAM data tables that GenEmails must read or modify. For queue movement, prefer the granular transfer permission Conversation > Communication > blindTransferQueue when the role should transfer only to queues. If a feature appears in GenEmails but the API call fails, correct the Genesys role or scope assignment rather than weakening the GenEmails role matrix.