Node reference
GitLab
GitLab node reference - all 259 operations, the credential it needs, and a worked example.
GitLab REST API (Developer tools). 259 operations: issues, issue time tracking and issue links; merge requests, approvals, notes and discussions; labels and milestones; projects, repository tree, files, branches, tags and commits; pipelines, schedules, jobs and artifacts; releases; environments and deployments; CI/CD variables; groups and members; users, to-dos and events; project and group webhooks; snippets and wiki; search. Works against gitlab.com or a self-managed host.
Credential: GitLab personal/project access token - see Credentials.
Each operation below lists the scope it needs. Scopes are ticked when the token is created -- but GitLab gates every request on TWO independent things, and its 403 body never says which one tripped. The first is the token SCOPE: api is complete read/write over the API, read_api is the read-only half, read_repository additionally covers repository reads through the Repository Files API, and read_user covers only /user. The second is the ROLE the token's user holds in that project or group -- Guest (10), Planner (15), Reporter (20), Security Manager (25), Developer (30), Maintainer (40), Owner (50) -- because a token can never exceed its owner, so an api-scoped token belonging to a Reporter still cannot push a commit. The column below states both. The trap that costs the most time: write_repository does not work here. GitLab defines it as "read-write access to repositories on private projects using Git-over-HTTP (not using the API)", so a token created with read_repository + write_repository can git push all day and still gets a 403 from every write in this node; API writes need api, full stop. Three more failures are not scopes at all. A 401 is the token itself -- GitLab expires personal access tokens after a year by default and revokes unused ones, so "it worked last month" is a common shape of this. A 404 is very often a permission problem wearing a disguise: GitLab's own status-code table says 404 means "an ID for a resource couldn't be found, or the user isn't authorized to access the resource", so a private project the token cannot see is indistinguishable from one that does not exist. And a 429 is the rate limit -- 2,000 authenticated requests per minute per user on GitLab.com, with far tighter per-endpoint caps (5/min for repository archives, 25/min for pipeline creation), answered with RateLimit-* and Retry-After headers. One operation is outside all of this: Trigger pipeline authenticates with the project's CI/CD pipeline trigger token posted as a form field and no PRIVATE-TOKEN header at all, so an access token in that credential slot fails no matter what is ticked on it. If a run fails with a permission error, the node names the missing scope in the error - grant it and re-run; you do not need to rebuild the workflow.
| Operation | What it does | Scope |
|---|
createIssue | Create issue | api — role: Guest or higher |
updateIssue | Update / close issue | api — role: Developer or higher |
getIssue | Get issue | read_api (or api) — role: Reporter or higher |
listProjectIssues | List project issues | read_api (or api) — role: Reporter or higher |
listGroupIssues | List group issues | read_api (or api) — role: Reporter or higher |
listIssues | List issues across all projects | read_api (or api) — role: Reporter or higher |
deleteIssue | Delete issue | api — role: Maintainer or higher |
moveIssue | Move issue to another project | api — role: Developer or higher |
cloneIssue | Clone issue into another project | api — role: Developer or higher |
reorderIssue | Reorder issue on a board | api — role: Developer or higher |
subscribeIssue | Subscribe to issue | api — role: Guest or higher |
unsubscribeIssue | Unsubscribe from issue | api — role: Guest or higher |
createIssueTodo | Add issue to my to-do list | api — role: Guest or higher |
listIssueParticipants | List issue participants | read_api (or api) — role: Reporter or higher |
listIssueRelatedMergeRequests | List merge requests that mention the issue | read_api (or api) — role: Reporter or higher |
listIssueClosedBy | List merge requests that close the issue | read_api (or api) — role: Reporter or higher |
| Operation | What it does | Scope |
|---|
setIssueTimeEstimate | Set time estimate | api — role: Developer or higher |
resetIssueTimeEstimate | Reset time estimate | api — role: Developer or higher |
addIssueSpentTime | Add spent time | api — role: Developer or higher |
resetIssueSpentTime | Reset spent time | api — role: Developer or higher |
getIssueTimeStats | Get time tracking stats | read_api (or api) — role: Reporter or higher |
| Operation | What it does | Scope |
|---|
listIssueLinks | List linked issues | read_api (or api) — role: Reporter or higher |
getIssueLink | Get issue link | read_api (or api) — role: Reporter or higher |
createIssueLink | Link two issues | api — role: Developer or higher |
deleteIssueLink | Unlink issues | api — role: Developer or higher |
| Operation | What it does | Scope |
|---|
createMergeRequest | Create merge request | api — role: Developer or higher |
updateMergeRequest | Update merge request | api — role: Developer or higher |
getMergeRequest | Get merge request | read_api (or api) — role: Reporter or higher |
listProjectMergeRequests | List project merge requests | read_api (or api) — role: Reporter or higher |
listGroupMergeRequests | List group merge requests | read_api (or api) — role: Reporter or higher |
listMergeRequests | List merge requests across all projects | read_api (or api) — role: Reporter or higher |
mergeMergeRequest | Merge merge request | api — role: Developer or higher |
cancelMergeRequestAutoMerge | Cancel auto-merge | api — role: Developer or higher |
getMergeRequestMergeRef | Get merge ref | read_api (or api) — role: Reporter or higher |
deleteMergeRequest | Delete merge request | api — role: Maintainer or higher |
rebaseMergeRequest | Rebase merge request | api — role: Developer or higher |
listMergeRequestCommits | List merge request commits | read_api (or api) — role: Reporter or higher |
listMergeRequestDiffs | List merge request diffs | read_api (or api) — role: Reporter or higher |
listMergeRequestChanges | Get merge request changes (deprecated) | read_api (or api) — role: Reporter or higher |
listMergeRequestPipelines | List merge request pipelines | read_api (or api) — role: Reporter or higher |
createMergeRequestPipeline | Run a pipeline for the merge request | api — role: Developer or higher |
listMergeRequestClosesIssues | List issues the merge request closes | read_api (or api) — role: Reporter or higher |
listMergeRequestParticipants | List merge request participants | read_api (or api) — role: Reporter or higher |
listMergeRequestReviewers | List merge request reviewers | read_api (or api) — role: Reporter or higher |
subscribeMergeRequest | Subscribe to merge request | api — role: Developer or higher |
unsubscribeMergeRequest | Unsubscribe from merge request | api — role: Developer or higher |
| Operation | What it does | Scope |
|---|
approveMergeRequest | Approve merge request | api — role: Developer or higher |
unapproveMergeRequest | Revoke approval | api — role: Developer or higher |
getMergeRequestApprovals | Get approval status | read_api (or api) — role: Reporter or higher |
getMergeRequestApprovalState | Get approval rule state | read_api (or api) — role: Reporter or higher |
listMergeRequestApprovalRules | List approval rules | read_api (or api) — role: Reporter or higher |
createMergeRequestApprovalRule | Create approval rule | api — role: Developer or higher |
deleteMergeRequestApprovalRule | Delete approval rule | api — role: Developer or higher |
| Operation | What it does | Scope |
|---|
addNote | Comment on an issue or merge request | api — role: Guest or higher |
listIssueNotes | List issue comments | read_api (or api) — role: Reporter or higher |
getIssueNote | Get issue comment | read_api (or api) — role: Reporter or higher |
updateIssueNote | Update issue comment | api — role: Developer or higher |
deleteIssueNote | Delete issue comment | api — role: Developer or higher |
listMergeRequestNotes | List merge request comments | read_api (or api) — role: Reporter or higher |
getMergeRequestNote | Get merge request comment | read_api (or api) — role: Reporter or higher |
updateMergeRequestNote | Update merge request comment | api — role: Developer or higher |
deleteMergeRequestNote | Delete merge request comment | api — role: Developer or higher |
| Operation | What it does | Scope |
|---|
listIssueDiscussions | List issue discussions | read_api (or api) — role: Reporter or higher |
getIssueDiscussion | Get issue discussion | read_api (or api) — role: Reporter or higher |
createIssueDiscussion | Start an issue discussion | api — role: Guest or higher |
addIssueDiscussionNote | Reply in an issue discussion | api — role: Guest or higher |
listMergeRequestDiscussions | List merge request discussions | read_api (or api) — role: Reporter or higher |
getMergeRequestDiscussion | Get merge request discussion | read_api (or api) — role: Reporter or higher |
createMergeRequestDiscussion | Start a merge request discussion | api — role: Developer or higher |
addMergeRequestDiscussionNote | Reply in a merge request discussion | api — role: Developer or higher |
resolveMergeRequestDiscussion | Resolve / unresolve a discussion | api — role: Developer or higher |
listCommitDiscussions | List commit discussions | read_api (or api) — role: Reporter or higher |
| Operation | What it does | Scope |
|---|
listLabels | List project labels | read_api (or api) — role: Reporter or higher |
getLabel | Get project label | read_api (or api) — role: Reporter or higher |
createLabel | Create project label | api — role: Developer or higher |
updateLabel | Update project label | api — role: Developer or higher |
deleteLabel | Delete project label | api — role: Developer or higher |
promoteLabel | Promote project label to group label | api — role: Maintainer or higher |
subscribeLabel | Subscribe to label | api — role: Guest or higher |
unsubscribeLabel | Unsubscribe from label | api — role: Guest or higher |
listGroupLabels | List group labels | read_api (or api) — role: Reporter or higher |
createGroupLabel | Create group label | api — role: Maintainer or higher |
updateGroupLabel | Update group label | api — role: Maintainer or higher |
deleteGroupLabel | Delete group label | api — role: Maintainer or higher |
| Operation | What it does | Scope |
|---|
listMilestones | List project milestones | read_api (or api) — role: Reporter or higher |
getMilestone | Get project milestone | read_api (or api) — role: Reporter or higher |
createMilestone | Create project milestone | api — role: Developer or higher |
updateMilestone | Update project milestone | api — role: Developer or higher |
deleteMilestone | Delete project milestone | api — role: Developer or higher |
promoteMilestone | Promote project milestone to group milestone | api — role: Maintainer or higher |
listMilestoneIssues | List milestone issues | read_api (or api) — role: Reporter or higher |
listMilestoneMergeRequests | List milestone merge requests | read_api (or api) — role: Reporter or higher |
listGroupMilestones | List group milestones | read_api (or api) — role: Reporter or higher |
createGroupMilestone | Create group milestone | api — role: Maintainer or higher |
updateGroupMilestone | Update group milestone | api — role: Maintainer or higher |
| Operation | What it does | Scope |
|---|
getProject | Get project | read_api (or api) — role: Reporter or higher |
listProjects | List projects | read_api (or api) — role: Reporter or higher |
listUserProjects | List a user's projects | read_api (or api) — role: Reporter or higher |
createProject | Create project | api — role: Maintainer or higher |
updateProject | Update project | api — role: Maintainer or higher |
deleteProject | Delete project | api — role: Owner or higher |
forkProject | Fork project | api — role: Maintainer or higher |
listProjectForks | List forks | read_api (or api) — role: Reporter or higher |
starProject | Star project | api — role: Developer or higher |
unstarProject | Unstar project | api — role: Developer or higher |
archiveProject | Archive project | api — role: Maintainer or higher |
unarchiveProject | Unarchive project | api — role: Maintainer or higher |
listProjectUsers | List project users | read_api (or api) — role: Reporter or higher |
shareProjectWithGroup | Share project with a group | api — role: Maintainer or higher |
listProjectLanguages | List project languages | read_api (or api) — role: Reporter or higher |
| Operation | What it does | Scope |
|---|
listRepositoryTree | List repository tree | read_api or read_repository (or api) — role: Reporter or higher |
getBlob | Get blob metadata | read_api or read_repository (or api) — role: Reporter or higher |
getBlobRaw | Get blob contents (raw) | read_api or read_repository (or api) — role: Reporter or higher |
compareRefs | Compare two refs | read_api (or api) — role: Reporter or higher |
listContributors | List contributors | read_api (or api) — role: Reporter or higher |
getMergeBase | Get merge base of two refs | read_api (or api) — role: Reporter or higher |
| Operation | What it does | Scope |
|---|
commitFile | Create / update file | api — role: Developer or higher |
getFile | Get file | read_api or read_repository (or api) — role: Reporter or higher |
getRawFile | Get file contents (raw) | read_api or read_repository (or api) — role: Reporter or higher |
deleteFile | Delete file | api — role: Developer or higher |
getFileBlame | Get file blame | read_api or read_repository (or api) — role: Reporter or higher |
| Operation | What it does | Scope |
|---|
listBranches | List branches | read_api (or api) — role: Reporter or higher |
getBranch | Get branch | read_api (or api) — role: Reporter or higher |
createBranch | Create branch | api — role: Developer or higher |
deleteBranch | Delete branch | api — role: Developer or higher |
deleteMergedBranches | Delete all merged branches | api — role: Maintainer or higher |
listProtectedBranches | List protected branches | read_api (or api) — role: Maintainer or higher |
protectBranch | Protect branch | api — role: Maintainer or higher |
unprotectBranch | Unprotect branch | api — role: Maintainer or higher |
createTag | Create tag | api — role: Developer or higher |
listTags | List tags | read_api (or api) — role: Reporter or higher |
getTag | Get tag | read_api (or api) — role: Reporter or higher |
deleteTag | Delete tag | api — role: Developer or higher |
| Operation | What it does | Scope |
|---|
listCommits | List commits | read_api (or api) — role: Reporter or higher |
getCommit | Get commit | read_api (or api) — role: Reporter or higher |
createCommit | Create commit (multiple file actions) | api — role: Developer or higher |
cherryPickCommit | Cherry-pick commit | api — role: Developer or higher |
revertCommit | Revert commit | api — role: Developer or higher |
getCommitDiff | Get commit diff | read_api (or api) — role: Reporter or higher |
listCommitRefs | List refs a commit is pushed to | read_api (or api) — role: Reporter or higher |
listCommitMergeRequests | List merge requests containing the commit | read_api (or api) — role: Reporter or higher |
listCommitComments | List commit comments | read_api (or api) — role: Reporter or higher |
createCommitComment | Comment on a commit | api — role: Developer or higher |
listCommitStatuses | List commit statuses | read_api (or api) — role: Reporter or higher |
setCommitStatus | Set commit status | api — role: Developer or higher |
| Operation | What it does | Scope |
|---|
triggerPipeline | Trigger pipeline (trigger token) | (no API scope at all — this operation authenticates with the project's CI/CD PIPELINE TRIGGER TOKEN sent as a form field, never with a personal access token. Create one under Settings > CI/CD > Pipeline trigger tokens and store THAT as the credential.) |
createPipeline | Create pipeline | api — role: Developer or higher |
listPipelines | List pipelines | read_api (or api) — role: Reporter or higher |
getPipeline | Get pipeline | read_api (or api) — role: Reporter or higher |
getLatestPipeline | Get the latest pipeline for a ref | read_api (or api) — role: Reporter or higher |
retryPipeline | Retry pipeline | api — role: Developer or higher |
cancelPipeline | Cancel pipeline | api — role: Developer or higher |
deletePipeline | Delete pipeline | api — role: Developer or higher |
getPipelineVariables | Get pipeline variables | read_api (or api) — role: Reporter or higher |
getPipelineTestReport | Get pipeline test report | read_api (or api) — role: Reporter or higher |
listPipelineSchedules | List pipeline schedules | read_api (or api) — role: Reporter or higher |
getPipelineSchedule | Get pipeline schedule | read_api (or api) — role: Reporter or higher |
createPipelineSchedule | Create pipeline schedule | api — role: Developer or higher |
updatePipelineSchedule | Update pipeline schedule | api — role: Developer or higher |
deletePipelineSchedule | Delete pipeline schedule | api — role: Developer or higher |
playPipelineSchedule | Run a pipeline schedule now | api — role: Developer or higher |
| Operation | What it does | Scope |
|---|
listProjectJobs | List project jobs | read_api (or api) — role: Reporter or higher |
listPipelineJobs | List pipeline jobs | read_api (or api) — role: Reporter or higher |
listPipelineTriggerJobs | List pipeline trigger (bridge) jobs | read_api (or api) — role: Reporter or higher |
getJob | Get job | read_api (or api) — role: Reporter or higher |
getJobLog | Get job log | read_api (or api) — role: Reporter or higher |
cancelJob | Cancel job | api — role: Developer or higher |
retryJob | Retry job | api — role: Developer or higher |
eraseJob | Erase job | api — role: Developer or higher |
playJob | Run a manual job | api — role: Developer or higher |
listJobArtifactFiles | List files inside a job's artifacts | read_api (or api) — role: Reporter or higher |
keepJobArtifacts | Keep job artifacts | api — role: Developer or higher |
deleteJobArtifacts | Delete job artifacts | api — role: Maintainer or higher |
| Operation | What it does | Scope |
|---|
listReleases | List releases | read_api (or api) — role: Reporter or higher |
getRelease | Get release | read_api (or api) — role: Reporter or higher |
createRelease | Create release | api — role: Developer or higher |
updateRelease | Update release | api — role: Developer or higher |
deleteRelease | Delete release | api — role: Maintainer or higher |
listReleaseLinks | List release asset links | read_api (or api) — role: Reporter or higher |
createReleaseLink | Create release asset link | api — role: Developer or higher |
deleteReleaseLink | Delete release asset link | api — role: Developer or higher |
| Operation | What it does | Scope |
|---|
listEnvironments | List environments | read_api (or api) — role: Reporter or higher |
getEnvironment | Get environment | read_api (or api) — role: Reporter or higher |
createEnvironment | Create environment | api — role: Developer or higher |
updateEnvironment | Update environment | api — role: Developer or higher |
deleteEnvironment | Delete environment | api — role: Developer or higher |
stopEnvironment | Stop environment | api — role: Developer or higher |
listDeployments | List deployments | read_api (or api) — role: Reporter or higher |
getDeployment | Get deployment | read_api (or api) — role: Reporter or higher |
createDeployment | Create deployment | api — role: Developer or higher |
updateDeployment | Update deployment | api — role: Developer or higher |
approveDeployment | Approve / reject a blocked deployment | api — role: Developer or higher |
listDeploymentMergeRequests | List merge requests in a deployment | read_api (or api) — role: Reporter or higher |
| Operation | What it does | Scope |
|---|
createVariable | Create project variable | api — role: Maintainer or higher |
listProjectVariables | List project variables | read_api (or api) — role: Maintainer or higher |
getProjectVariable | Get project variable | read_api (or api) — role: Maintainer or higher |
updateProjectVariable | Update project variable | api — role: Maintainer or higher |
deleteProjectVariable | Delete project variable | api — role: Maintainer or higher |
listGroupVariables | List group variables | read_api (or api) — role: Owner or higher |
getGroupVariable | Get group variable | read_api (or api) — role: Owner or higher |
createGroupVariable | Create group variable | api — role: Owner or higher |
updateGroupVariable | Update group variable | api — role: Owner or higher |
deleteGroupVariable | Delete group variable | api — role: Owner or higher |
| Operation | What it does | Scope |
|---|
listGroups | List groups | read_api (or api) — role: Reporter or higher |
getGroup | Get group | read_api (or api) — role: Reporter or higher |
createGroup | Create group | api — role: Owner or higher |
updateGroup | Update group | api — role: Owner or higher |
deleteGroup | Delete group | api — role: Owner or higher |
listSubgroups | List subgroups | read_api (or api) — role: Reporter or higher |
listDescendantGroups | List descendant groups | read_api (or api) — role: Reporter or higher |
listGroupProjects | List group projects | read_api (or api) — role: Reporter or higher |
shareGroupWithGroup | Share group with another group | api — role: Owner or higher |
listProjectMembers | List project members | read_api (or api) — role: Reporter or higher |
listAllProjectMembers | List project members (including inherited) | read_api (or api) — role: Reporter or higher |
getProjectMember | Get project member | read_api (or api) — role: Reporter or higher |
addProjectMember | Add project member | api — role: Maintainer or higher |
editProjectMember | Change a project member's access level | api — role: Maintainer or higher |
removeProjectMember | Remove project member | api — role: Maintainer or higher |
listGroupMembers | List group members | read_api (or api) — role: Reporter or higher |
listAllGroupMembers | List group members (including inherited) | read_api (or api) — role: Reporter or higher |
addGroupMember | Add group member | api — role: Owner or higher |
editGroupMember | Change a group member's access level | api — role: Owner or higher |
removeGroupMember | Remove group member | api — role: Owner or higher |
| Operation | What it does | Scope |
|---|
getCurrentUser | Get the authenticated user | read_user (or read_api, or api) — any authenticated user |
listUsers | List users | read_api (or api) — role: Guest or higher |
getUser | Get user | read_api (or api) — role: Guest or higher |
getUserStatus | Get a user's status | read_api (or api) — role: Guest or higher |
listTodos | List my to-dos | read_api (or api) — role: Guest or higher |
markTodoDone | Mark a to-do done | api — role: Guest or higher |
markAllTodosDone | Mark all to-dos done | api — role: Guest or higher |
listMyEvents | List my events | read_api (or api) — role: Guest or higher |
listUserEvents | List a user's events | read_api (or api) — role: Guest or higher |
listProjectEvents | List project events | read_api (or api) — role: Reporter or higher |
| Operation | What it does | Scope |
|---|
listProjectHooks | List project webhooks | read_api (or api) — role: Maintainer or higher |
getProjectHook | Get project webhook | read_api (or api) — role: Maintainer or higher |
createProjectHook | Create project webhook | api — role: Maintainer or higher |
updateProjectHook | Update project webhook | api — role: Maintainer or higher |
deleteProjectHook | Delete project webhook | api — role: Maintainer or higher |
listGroupHooks | List group webhooks | read_api (or api) — role: Owner or higher |
getGroupHook | Get group webhook | read_api (or api) — role: Owner or higher |
createGroupHook | Create group webhook | api — role: Owner or higher |
updateGroupHook | Update group webhook | api — role: Owner or higher |
deleteGroupHook | Delete group webhook | api — role: Owner or higher |
| Operation | What it does | Scope |
|---|
listProjectSnippets | List project snippets | read_api (or api) — role: Reporter or higher |
getProjectSnippet | Get project snippet | read_api (or api) — role: Reporter or higher |
getProjectSnippetRaw | Get project snippet contents (raw) | read_api (or api) — role: Reporter or higher |
createProjectSnippet | Create project snippet | api — role: Developer or higher |
updateProjectSnippet | Update project snippet | api — role: Developer or higher |
deleteProjectSnippet | Delete project snippet | api — role: Developer or higher |
listSnippets | List my snippets | read_api (or api) — role: Guest or higher |
createSnippet | Create personal snippet | api — role: Guest or higher |
listWikiPages | List wiki pages | read_api (or api) — role: Reporter or higher |
getWikiPage | Get wiki page | read_api (or api) — role: Reporter or higher |
createWikiPage | Create wiki page | api — role: Developer or higher |
updateWikiPage | Update wiki page | api — role: Developer or higher |
deleteWikiPage | Delete wiki page | api — role: Developer or higher |
| Operation | What it does | Scope |
|---|
search | Search the whole instance | read_api (or api) — role: Guest or higher |
searchGroup | Search within a group | read_api (or api) — role: Reporter or higher |
searchProject | Search within a project | read_api (or api) — role: Reporter or higher |