# Permissions

**URL:** <https://hotbunny.dev/t/permissions/72>\
**Category:** Reference\
**Created:** [October 21, 2026, 4:03pm UTC](https://hotbunny.dev/t/permissions/72 "2026-10-21T16:03:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![SteelWaffe7](https://hotbunny.dev/user_avatar/hotbunny.dev/steelwaffe7/32/11_2.png) [@SteelWaffe7](https://hotbunny.dev/u/SteelWaffe7)\
**Post date:** [October 21, 2026, 4:03pm UTC](https://hotbunny.dev/t/permissions/72/1 "2026-10-21T16:03:17Z")

</div>

Mods declare their required permissions in `manifest.json`. Each permission grants access to specific API namespaces.

## Permission List

| Permission | API Access | Description |
| --- | --- | --- |
| `filesystem` | `Files` | Create, read, write, delete in-game files |
| `network` | `Network`, `Database` | Create and manage networks, Wi-Fi access points, ports, domains, and databases |
| `events` | `Events` | Listen to game events, emit custom events |
| `mail` | `Mail` | Send in-game emails |
| `bank` | `Bank` | Manage bank accounts and transfers |
| `shell` | `Shell` | Execute terminal commands programmatically |
| `ui` | `UI` | Show notifications, toasts and input dialogs |

## APIs Without Permissions

The following APIs are always available and do not require permissions:

| API | Description |
| --- | --- |
| `Storage` | Persistent key-value storage |
| `Variables` | Session-only variables |
| `SharedStorage` | Shared persistent storage |
| `SharedVariables` | Shared session variables |
| `ModSettings` | Mod settings (player config) |
| `Random` | Random generation utilities |
| `Twotter` | In-game social media |
| `Kisscord` | In-game messaging |
| `WeeChat` | In-game IRC chat |

## Enforcement

When a mod declares a `permissions` array in its manifest, only the listed permissions are allowed. API calls requiring a non-declared permission will throw an error.

An **empty** array (`"permissions": []`) means exactly what it says: no gated API is available. It used to be treated the same as omitting the field, which quietly turned the most conservative manifest into the most permissive one.

If a mod **omits** the `permissions` field entirely, all APIs are accessible without restriction. This legacy default is deprecated, logs a warning on load, and is intended for local development only. Declare the permissions your mod needs before publishing.

> **Warning**
> 
> Permissions shape which SDK namespaces a mod asks for. They are not a security sandbox: mod code runs inside the game with the game’s own access. Install mods only from authors you trust.

## Usage

```json
{
    "permissions": ["events", "network", "filesystem"]
}

```

> **Tip**
> 
> Only request the permissions your mod actually needs. Players can see which permissions a mod requires in the Mods menu.