Mattermost

Mattermost node reference - all 157 operations, the credential it needs, and a worked example.

Mattermost v4 REST API (Communication). 157 operations: messages (post, reply in thread, ephemeral, edit, delete, pin, search, threads, reminders, acknowledgements), scheduled posts and drafts, channels and channel members, channel bookmarks, teams, team members and invites, users, statuses and custom statuses, custom profile attributes, files, reactions, custom emoji, preferences, slash commands, incoming and outgoing webhook management, bots — plus the original credential-free incoming-webhook post.

Credential: Mattermost - see Credentials.

Permissions

Each operation below lists the permission it needs. Permissions are held by the OWNER of the personal access or bot token, not by the token itself. Mattermost has NO OAuth scopes and no consent screen - a token is one opaque string that carries its creator's full roles and memberships, so you cannot mint a narrower one. The equivalent question is which RBAC permission that user holds, which is exactly what a 403 is asking for, and it is granted in System Console -> User Management -> Permissions (or by adding the user to the team or channel). Two things this catches people out on: a 404 rather than a 403 is Mattermost's answer for a channel or team the token owner is not a member of, so a missing membership reads as a missing resource; and a handful of operations answer 501 instead, which means the admin has the FEATURE switched off (synced drafts, public file links) rather than the permission missing. If a run fails with a permission error, the node names the missing permission in the error - grant it and re-run; you do not need to rebuild the workflow.

Operations (157)

Messages

Operation	What it does	Permission
`postToWebhook`	Post via incoming webhook (no credential)	(no permission — an incoming webhook URL is its own credential; what limits it is the channel the webhook was created against, and whether the admin allowed webhooks to override the channel and username)
`createPost`	Post a message	`create_post` (for the target channel)
`replyToPost`	Reply in a thread	`create_post` (for the target channel)
`createEphemeralPost`	Post an ephemeral message (system admin)	`create_post_ephemeral — currently granted to SYSTEM ADMINS only, so a normal personal access token cannot use this`
`getPost`	Get a post	`read_channel` (or read_public_channels for a public channel)
`getPostsByIds`	Get posts by IDs	`read_channel` (or read_public_channels)
`updatePost`	Update a post (replaces omitted fields)	`edit_post` (for the channel the post is in)
`patchPost`	Patch a post	`edit_post` (for the channel the post is in)
`deletePost`	Delete a post	`own post, or delete_others_posts` (for the channel the post is in)
`getPostThread`	Get a thread	`read_channel` (or read_public_channels)
`getChannelPosts`	Get posts in a channel	`read_channel`
`searchPosts`	Search posts in a team	`view_team`
`searchPostsAllTeams`	Search posts across all teams	(any valid token — results are limited to the posts the token owner can already see)
`pinPost`	Pin a post	`read_channel`
`unpinPost`	Unpin a post	`read_channel`
`getPinnedPosts`	Get a channel's pinned posts	`read_channel`
`getPostFileInfos`	Get a post's attachments	`read_channel`
`getPostEditHistory`	Get a post's edit history	`edit_post — and for most posts only the original author can read the history`
`getFlaggedPosts`	Get saved (flagged) posts	`own account, or manage_system`
`setPostUnread`	Mark a channel unread from a post	`read_channel — plus edit_other_users when marking for somebody else`
`setPostReminder`	Set a reminder about a post	`read_channel`
`acknowledgePost`	Acknowledge a priority post	`read_channel`
`removePostAcknowledgement`	Remove a post acknowledgement	`read_channel`
`doPostAction`	Trigger an interactive message action	`read_channel`

Scheduled posts

Operation	What it does	Permission
`createScheduledPost`	Schedule a message	`create_post` (for the target channel)
`listScheduledPosts`	List scheduled messages for a team	`view_team`
`updateScheduledPost`	Update a scheduled message	`create_post` (for the scheduled post's channel)
`deleteScheduledPost`	Cancel a scheduled message	`create_post` (for the scheduled post's channel)

Drafts

Operation	What it does	Permission
`upsertDraft`	Create or update a draft	`create_post for the channel, and the server must have synced drafts enabled` (otherwise 501)
`listDrafts`	List drafts for a team	`view_team, and the server must have synced drafts enabled` (otherwise 501)
`deleteDraft`	Delete a channel draft	`own draft, and the server must have synced drafts enabled` (otherwise 501)
`deleteThreadDraft`	Delete a thread draft	`own draft, and the server must have synced drafts enabled` (otherwise 501)

Channels

Operation	What it does	Permission
`createChannel`	Create a channel	`create_public_channel or create_private_channel`
`createDirectChannel`	Open a direct message channel	`create_direct_channel`
`createGroupChannel`	Open a group message channel	`create_group_channel`
`getChannel`	Get a channel	`read_channel`
`getChannelByName`	Get a channel by name (team ID)	`read_channel`
`getChannelByTeamName`	Get a channel by name (team name)	`read_channel`
`updateChannel`	Update a channel (replaces omitted fields)	`manage_*_channel_members`
`patchChannel`	Patch a channel	`manage_*_channel_properties`
`archiveChannel`	Archive a channel	`delete_*_channel` (or manage_system)
`restoreChannel`	Restore an archived channel	`manage_team`
`convertChannelPrivacy`	Convert a channel public / private	`convert_public_channel_to_private / convert_private_channel_to_public` (manage_team on servers older than 5.28)
`listTeamChannels`	List a team's public channels	`list_team_channels`
`listPrivateChannels`	List a team's private channels	`manage_system`
`listDeletedChannels`	List a team's archived channels	(any valid token with access to the team)
`getChannelsByIds`	Get team channels by IDs	`view_team`
`searchTeamChannels`	Search a team's channels	`list_team_channels — without it` (server 5.16+) the results are limited to channels the token owner is in
`searchAllChannels`	Search all channels	`manage_system for a true cross-workspace search; without it the results are limited to the token owner's channels`
`getChannelStats`	Get channel member counts	`read_channel`
`getChannelMemberTimezones`	Get channel member timezones	`read_channel`
`getChannelUnread`	Get a user's unread counts for a channel	`read_channel`
`viewChannel`	Mark a channel as viewed	`own account, or edit_other_users`

Channel members

Operation	What it does	Permission
`listChannelMembers`	List channel members	`read_channel`
`addChannelMember`	Add member(s) to a channel	(membership-dependent — joining a public channel needs join_public_channels; adding somebody else needs manage_*_channel_members)
`getChannelMember`	Get a channel membership	`read_channel`
`getChannelMembersByIds`	Get channel memberships by user IDs	`read_channel`
`removeChannelMember`	Remove a member from a channel	`manage_*_channel_members`
`updateChannelMemberRoles`	Set a member's channel roles	`manage_channel_roles`
`updateChannelNotifyProps`	Set a member's channel notifications	`own account, or edit_other_users`
`listUserChannelMemberships`	List a user's memberships on a team	`view_team`
`listUserChannels`	List a user's channels on a team	`own account, or edit_other_users`
`listAllUserChannels`	List all of a user's channels	`own account, or edit_other_users`

Channel bookmarks

Operation	What it does	Permission
`listChannelBookmarks`	List channel bookmarks	`read_channel` (must be a channel member)
`createChannelBookmark`	Create a channel bookmark	`add_bookmark_public_channel / add_bookmark_private_channel` (server 9.5+)
`updateChannelBookmark`	Update a channel bookmark	`edit_bookmark_public_channel / edit_bookmark_private_channel` (server 9.5+)
`deleteChannelBookmark`	Delete a channel bookmark	`delete_bookmark_public_channel / delete_bookmark_private_channel` (server 9.5+)
`reorderChannelBookmark`	Reorder a channel bookmark	`order_bookmark_public_channel / order_bookmark_private_channel` (server 9.5+)

Teams

Operation	What it does	Permission
`createTeam`	Create a team	`create_team`
`listTeams`	List teams	(any valid token — regular users see open teams only; manage_system sees every team)
`getTeam`	Get a team	`view_team`
`getTeamByName`	Get a team by name	`view_team`
`teamExists`	Check whether a team name is taken	(any valid token)
`updateTeam`	Update a team (replaces omitted fields)	`manage_team`
`patchTeam`	Patch a team	`manage_team`
`updateTeamPrivacy`	Convert a team open / invite-only	`manage_team`
`deleteTeam`	Delete a team	`manage_team`
`restoreTeam`	Restore a deleted team	`manage_team`
`searchTeams`	Search teams	(any valid token — manage_system is what widens the results to private teams)
`getTeamStats`	Get team member counts	`view_team`
`listUserTeams`	List a user's teams	`own account, or edit_other_users`
`getTeamUnreads`	Get a user's unread counts across teams	`own account, or edit_other_users`

Team members & invites

Operation	What it does	Permission
`listTeamMembers`	List team members	`view_team`
`addTeamMember`	Add a member to a team	`add_user_to_team`
`addTeamMembers`	Add members to a team (bulk)	`add_user_to_team`
`getTeamMember`	Get a team membership	`view_team`
`getTeamMembersByIds`	Get team memberships by user IDs	`view_team`
`removeTeamMember`	Remove a member from a team	`remove_user_from_team`
`listUserTeamMemberships`	List a user's team memberships	`own account, or edit_other_users`
`updateTeamMemberRoles`	Set a member's team roles	`manage_team_roles`
`inviteToTeam`	Invite members by email	`invite_user and add_user_to_team`
`inviteGuestsToTeam`	Invite guests by email	`invite_guest`
`getTeamInviteInfo`	Get team info for an invite ID	(no permission — this is the public info behind an invite link)
`regenerateTeamInviteId`	Rotate a team's invite link	`manage_team`

Users

Operation	What it does	Permission
`listUsers`	List users	(any valid token)
`getUser`	Get a user	(any valid token)
`getUserByUsername`	Get a user by username	(any valid token)
`getUserByEmail`	Get a user by email	(any valid token — but the server hides email addresses unless ShowEmailAddress is on or the token owner is a system admin)
`getUsersByIds`	Get users by IDs	(any valid token)
`getUsersByUsernames`	Get users by usernames	(any valid token)
`searchUsers`	Search users	(any valid token)
`createUser`	Create a user	`create_user — or an open server that allows signup; creating a user with roles set needs manage_system`
`updateUser`	Update a user (replaces omitted fields)	`own account, or edit_other_users`
`patchUser`	Patch a user	`own account, or edit_other_users`
`updateUserActive`	Activate / deactivate a user	`own account to deactivate yourself; manage_system to change anybody else`

Status

Operation	What it does	Permission
`getUserStatus`	Get a user's status	(any valid token)
`getStatusesByIds`	Get statuses by user IDs	(any valid token)
`updateUserStatus`	Set a user's status	`own account, or edit_other_users`
`setCustomStatus`	Set a custom status	`own account only`
`clearCustomStatus`	Clear a custom status	`own account only`

Custom profile attributes

Operation	What it does	Permission
`listCustomAttributeFields`	List custom profile fields	(any valid token — server 10.5+)
`getUserCustomAttributes`	Get a user's custom profile values	(any valid token that can view the member — server 10.5+)
`updateOwnCustomAttributes`	Set my custom profile values	(any valid token — sets your own values only)

Files

Operation	What it does	Permission
`uploadFile`	Upload a file	`upload_file` (for the target channel)
`getFile`	Download a file	`read_channel for the post that owns the file, or be its uploader`
`getFileInfo`	Get file metadata	`read_channel`
`getFileLink`	Get a file's public link	`read_channel — and the admin must have EnablePublicLink switched on, otherwise this 501s`
`searchFiles`	Search files in a team	`view_team`
`searchFilesAllTeams`	Search files across all teams	(any valid token — results are limited to the files the token owner can already see)

Reactions

Operation	What it does	Permission
`addReaction`	React to a post	`read_channel`
`getReactions`	Get a post's reactions	`read_channel`
`removeReaction`	Remove a reaction	`read_channel`
`getBulkReactions`	Get reactions for many posts	`read_channel`

Custom emoji

Operation	What it does	Permission
`listEmoji`	List custom emoji	(any valid token)
`getEmoji`	Get a custom emoji	(any valid token)
`getEmojiByName`	Get a custom emoji by name	(any valid token)
`getEmojisByNames`	Get custom emoji by names	(any valid token)
`searchEmoji`	Search custom emoji	(any valid token)

Preferences

Operation	What it does	Permission
`getPreferences`	Get a user's preferences	`own account only`
`getPreferencesByCategory`	Get preferences in a category	`own account only`
`savePreferences`	Save preferences	`own account only`
`deletePreferences`	Delete preferences	`own account only`

Slash commands

Operation	What it does	Permission
`executeCommand`	Run a slash command	`use_slash_commands` (for the channel)
`listCommands`	List slash commands	`manage_slash_commands to see custom commands`
`createCommand`	Create a slash command	`manage_slash_commands` (for the team)
`getCommand`	Get a slash command	`manage_slash_commands`
`updateCommand`	Update a slash command	`manage_slash_commands`
`deleteCommand`	Delete a slash command	`manage_slash_commands`

Webhook integrations

Operation	What it does	Permission
`listIncomingWebhooks`	List incoming webhooks	`manage_incoming_webhooks` (for the team)
`createIncomingWebhook`	Create an incoming webhook	`manage_incoming_webhooks` (for the team)
`getIncomingWebhook`	Get an incoming webhook	`manage_incoming_webhooks`
`updateIncomingWebhook`	Update an incoming webhook	`manage_incoming_webhooks`
`deleteIncomingWebhook`	Delete an incoming webhook	`manage_incoming_webhooks`
`listOutgoingWebhooks`	List outgoing webhooks	`manage_outgoing_webhooks` (for the team)
`createOutgoingWebhook`	Create an outgoing webhook	`manage_outgoing_webhooks` (for the team)
`getOutgoingWebhook`	Get an outgoing webhook	`manage_outgoing_webhooks`
`updateOutgoingWebhook`	Update an outgoing webhook	`manage_outgoing_webhooks`
`deleteOutgoingWebhook`	Delete an outgoing webhook	`manage_outgoing_webhooks`
`regenerateOutgoingWebhookToken`	Rotate an outgoing webhook token	`manage_outgoing_webhooks`

Bots

Operation	What it does	Permission
`createBot`	Create a bot account	`create_bot`
`listBots`	List bot accounts	`read_bots, plus read_others_bots to see bots you do not own`
`getBot`	Get a bot account	`read_bots` (read_others_bots for somebody else's bot)
`patchBot`	Update a bot account	`manage_bots` (manage_others_bots for somebody else's bot)
`disableBot`	Disable a bot account	`manage_bots` (manage_others_bots for somebody else's bot)
`enableBot`	Enable a bot account	`manage_bots` (manage_others_bots for somebody else's bot)
`assignBot`	Reassign a bot's owner	`manage_bots` (manage_others_bots for somebody else's bot)

System

Operation	What it does	Permission
`ping`	Ping the server	(no permission — the health check is unauthenticated)

Example

Reply in a thread instead of starting a new one

Before the operation wave this node could only POST to a pasted incoming-webhook URL — no credential, no reading, no threading. With a token it can create a real post, and rootId is what makes it a threaded reply rather than a new message in the channel, which is the difference between a useful bot and a noisy one.

Set Operation to replyToPost, then fill in:

Field	Value	Notes
`postId`	`{{ myTrigger.postId }}`	The post being replied to
`message`	`On it — run {{ myTrigger.executionId }} started.`	Markdown
`rootId`	`{{ myTrigger.rootId }}`	The thread root. Reply to a reply and Mattermost still threads under the ROOT, not the parent

Sets {{reply.postId}}, {{reply.channelId}} and {{reply.message}}. Remember the host lives in the credential — Mattermost is self-hosted and there is no shared API host to default to.

On this page