Proxmox /access/permissions pool: Why GET Returns Wrong Permissions for Pool Members

Proxmox /access/permissions pool results look wrong because the endpoint doesn’t expand pool ACLs to member resources. It reports the pool path itself, not the VMs and storages inside it. Here’s what’s actually happening.

The path-based ACL model

Proxmox permissions are path-based. An ACL entry maps a user or token to a role on a path like /vms/100 or /pool/backup. When you assign a role on a pool, that ACL applies to the pool object itself, not automatically to every VM inside it.

But the web UI and most API calls evaluate permissions by walking up the path. If you ask whether a user can power on VM 100, Proxmox checks /vms/100, then /vms, then /. It does not check /pool/backup unless the VM’s path is under that pool. It isn’t.

Reproduce it with a pool, user, and API token

Create a pool, a user, and a token:

pvesh create /pools -poolid testpool
pveum useradd testuser@pve
pveum user token add testuser@pve testtoken -privsep 0
pveum acl modify /pool/testpool -user testuser@pve -role PVEVMUser

Now query the endpoint:

pvesh get /access/permissions -user testuser@pve

You’ll see an entry for /pool/testpool with the role, but nothing for /vms/100 even if VM 100 is in that pool. That’s the “incorrect” result people hit.

What the endpoint actually returns

The endpoint returns the user’s effective permissions on each path, but only for paths that have an ACL or are ancestors of one. It does not enumerate pool members. If you need to know whether a user can act on a specific VM, query that VM’s path directly:

pvesh get /access/permissions -user testuser@pve -path /vms/100

That returns the role inherited from the pool, because Proxmox resolves pool membership at evaluation time. The endpoint just doesn’t do that resolution when listing all permissions.

Why it’s confusing

The web UI shows pool members as if they inherit the pool’s permissions, and the API docs don’t spell out that /access/permissions is a raw ACL dump. The forum thread on this is unresolved for a reason: people expect the endpoint to be a full permission map, but it’s not.

If you’re scripting around this, query per resource. Don’t rely on the list endpoint to tell you what a user can do inside a pool. It won’t.

Related: Proxmox Export Summary to CSV: pvesh Recipe for Host and Datacenter shows how to script pvesh output for bulk queries.