> For the complete documentation index, see [llms.txt](https://docs.coherent.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coherent.global/spark-apis/authorization-api-keys/permissions-features-permissions.md).

# Permissions - Features permissions

{% hint style="warning" %}
Coherent plans to deprecate the features permissions functionality in the near future.

Although API keys can be used for machine-to-machine integrations, [Client credentials](/identity-and-access-management/client-credentials.md) are a more secure form of authorization. See [Benefits of client credentials versus API keys](/identity-and-access-management/client-credentials/benefits-of-client-credentials-versus-api-keys.md).
{% endhint %}

**Features permissions** can be found in the [Options](/navigation/options.md) menu under [Tenant configuration](/tenant-administration/tenant-configuration.md#features-permissions).

Some Spark features can be executed independently from the Spark UI through APIs. These API endpoints have been grouped together by function and stored in feature permissions objects.

When using [Authorization - API keys](/spark-apis/authorization-api-keys.md), access to the additional Spark API endpoints is managed through the features permissions objects. Features permissions allow the granular control of [Authorization - API keys](/spark-apis/authorization-api-keys.md) against different permissions to minimize the permissible access.

Use this to define API keys that have limited access to tenants and actions.

## Prerequisites

* You must be a `tenant-admin` user.
* You must be a member `supervisor:pf` to view all the features permissions.

## Manage features permissions

Select the **View** icon to view the user groups assigned. There is a **Description** of the feature permission, the list of **User groups** that have access, and the **Related API endpoints**. API keys that contain these assigned user groups will be able to call the API endpoints listed while using their API key for authorization..

### Add a user group to feature permissions

1. Identify the appropriate feature permission and the user group to give access.
2. Select the **View** icon for the feature permission.
3. Select the user group name from the dropdown box. For feature permissions other than `Spark.AllEncompassingProxy.json`, you cannot assign `user:pf`.
4. Select **Add**.
5. The user group is added right away.

## Best practices

### Minimize the permissible access

The optimal way to manage features permissions would be to create [Authorization - API keys](/spark-apis/authorization-api-keys.md) that each contain two or more user groups:

1. One or more [User groups](/identity-and-access-management/user-groups.md) with access to the Spark services that should be actioned upon.
   * For example, if the Mexico team has full privileges to the multiple folders relating to Mexican insurance plans because they are members of the `user:mexico`, include `user:mexico` in the API key.
   * In a shared tenant, `user:pf` is the user group that provides universal access to services.
2. Additional [User groups](/identity-and-access-management/user-groups.md) should be attributed to the permissible API key actions (feature permission). For example, to enable this key to use the [Broken mention](broken://pages/T5Go0A7brj2VzQbTCv72) API that provides a copy download services using the `call_id`,
   1. Select **Options** from the [Navigation menu](/navigation/navigation-menu.md#user-menu).
   2. Select **User groups**.
   3. Select **Add user group**.
   4. Enter the **User group name**. In this example, name this `user:download_call`.
   5. You can enter a **Description**.
   6. No users need to be added to this user group.
   7. Select **Submit**.
   8. Make a new user group `user:download_call`. It does not need to have any users.
   9. Select **Tenant configuration**.
   10. Select [Tenant configuration](/tenant-administration/tenant-configuration.md#features-permissions).
   11. Select the feature permission  `Spark.DownloadAPILog.json` .
   12. From the dropdown, select the user group `user:download_call`.
   13. Select **Add**.

Once you have identified these two user groups, then create new [Authorization - API keys](/spark-apis/authorization-api-keys.md) that includes both `user:mexico` and `user:download_call`. In this manner, it is possible to limit the accessible Spark services and backend APIs.

### Avoid using `Spark.AllEncompassingProxy.json`

* Any user groups that are assigned to this feature permission will have access to all the APIs. The user groups `supervisor:pf` or `user:api_integration` are automatically part of this group.
* In some cases, `user:pf` may also be assigned to this group. If you do not want keys containing `user:pf` to be able to also access all the listed backend APIs, then remove it from `Spark.AllEncompassingProxy.json`.

### Manage and test permissions between environments

Customers should use similar setups for [Authorization - API keys](/spark-apis/authorization-api-keys.md) and [Permissions - Features permissions](/spark-apis/authorization-api-keys/permissions-features-permissions.md) in their testing and production environments to ensure that verification of the security in the testing environment aligns with the behaviors in production.